« back to all changes in this revision
Viewing changes to serverguide/po/id.po
- browse files at revision 377
- compare with another revision
- download diff
- download tarball
- view history from revision 377
- Committer: Doug Smythies
- Date: 2019-09-16 23:27:40 UTC
- Revision ID: dsmythies@telus.net-20190916232740-6q2xgomajmxmwhki
Remove all content from trunk branch, leave behind a README note.
added
removed
serverguide/po/id.po
1
# Indonesian translation for serverguide
2
# Copyright (c) 2014 Rosetta Contributors and Canonical Ltd 2014
3
# This file is distributed under the same license as the serverguide package.
4
# FIRST AUTHOR <EMAIL@ADDRESS>, 2014.
5
#
6
msgid ""
7
msgstr ""
8
"Project-Id-Version: serverguide\n"
9
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
10
"POT-Creation-Date: 2017-12-07 21:16-0800\n"
11
"PO-Revision-Date: 2017-06-22 22:53+0000\n"
12
"Last-Translator: Andika Triwidada <andika@gmail.com>\n"
13
"Language-Team: Indonesian <id@li.org>\n"
14
"MIME-Version: 1.0\n"
15
"Content-Type: text/plain; charset=UTF-8\n"
16
"Content-Transfer-Encoding: 8bit\n"
17
"X-Launchpad-Export-Date: 2017-12-08 05:30+0000\n"
18
"X-Generator: Launchpad (build 18511)\n"
19
"Language: id\n"
20
21
#: serverguide/C/web-servers.xml:11(title)
22
msgid "Web Servers"
23
msgstr "Server Web"
24
25
#: serverguide/C/web-servers.xml:12(para)
26
msgid ""
27
"A Web server is a software responsible for accepting HTTP requests from "
28
"clients, which are known as Web browsers, and serving them HTTP responses "
29
"along with optional data contents, which usually are Web pages such as HTML "
30
"documents and linked objects (images, etc.)."
31
msgstr ""
32
"Server web adalah perangkat lunak yang bertanggungjawab menerima permintaan "
33
"HTTP dari klien, yang dikenal sebagai peramban Web, dan melayani balasan "
34
"HTTP untuk klien beserta isi data opsional, yang biasanya berupa halaman Web "
35
"seperti dokumen HTML dan objek tautan (gambar, dsb.)."
36
37
#: serverguide/C/web-servers.xml:17(title)
38
msgid "HTTPD - Apache2 Web Server"
39
msgstr "HTTPD - Server Web Apache2"
40
41
#: serverguide/C/web-servers.xml:18(para)
42
msgid ""
43
"Apache is the most commonly used Web server on Linux systems. Web servers "
44
"are used to serve Web pages requested by client computers. Clients typically "
45
"request and view Web pages using Web browser applications such as "
46
"<application>Firefox</application>, <application>Opera</application>, "
47
"<application>Chromium</application>, or <application>Internet "
48
"Explorer</application>."
49
msgstr ""
50
51
#: serverguide/C/web-servers.xml:24(para)
52
msgid ""
53
"Users enter a Uniform Resource Locator (URL) to point to a Web server by "
54
"means of its Fully Qualified Domain Name (FQDN) and a path to the required "
55
"resource. For example, to view the home page of the <ulink "
56
"url=\"http://www.ubuntu.com\">Ubuntu Web site</ulink> a user will enter only "
57
"the FQDN:"
58
msgstr ""
59
60
#: serverguide/C/web-servers.xml:29(userinput)
61
#, no-wrap
62
msgid "www.ubuntu.com"
63
msgstr "www.ubuntu.com"
64
65
#: serverguide/C/web-servers.xml:32(para)
66
msgid ""
67
"To view the <ulink url=\"http://www.ubuntu.com/community\">community</ulink> "
68
"sub-page, a user will enter the FQDN followed by a path:"
69
msgstr ""
70
71
#: serverguide/C/web-servers.xml:35(userinput)
72
#, no-wrap
73
msgid "www.ubuntu.com/community"
74
msgstr "www.ubuntu.com/community"
75
76
#: serverguide/C/web-servers.xml:38(para)
77
msgid ""
78
"The most common protocol used to transfer Web pages is the Hyper Text "
79
"Transfer Protocol (HTTP). Protocols such as Hyper Text Transfer Protocol "
80
"over Secure Sockets Layer (HTTPS), and File Transfer Protocol (FTP), a "
81
"protocol for uploading and downloading files, are also supported."
82
msgstr ""
83
"Protokol yang sering digunakan untuk mentransfer halaman web adalah Protokol "
84
"Transfer Hiper Teks (HTTP). Protokol lain seperti Protokol Transfer Hiper "
85
"Teks diatas Lapisan Soket Aman (HTTPS), dan Protokol Transfer Berkas (FTP), "
86
"yaitusebuah protokol untuk mengunggah dan mengunduh, juga dudukung."
87
88
#: serverguide/C/web-servers.xml:43(para)
89
msgid ""
90
"Apache Web Servers are often used in combination with the "
91
"<application>MySQL</application> database engine, the HyperText Preprocessor "
92
"(<application>PHP</application>) scripting language, and other popular "
93
"scripting languages such as <application>Python</application> and "
94
"<application>Perl</application>. This configuration is termed LAMP (Linux, "
95
"Apache, MySQL and Perl/Python/PHP) and forms a powerful and robust platform "
96
"for the development and deployment of Web-based applications."
97
msgstr ""
98
"Dalam penggunaannya Server Web Apache sering dikombinasikan dengan mesin "
99
"basis data <application>MySQL</application>, bahasa skrip Prapengolah Teks "
100
"Hiper (<application>PHP</application>), dan bahasa skrip populer lainnya "
101
"seperti <application>Python</application> "
102
"dan<application>Perl</application>. Konfigurasi ini dikenal sebagai LAMP "
103
"(Linux, Apache, MySQL and Perl/Python/PHP) dan membentuk landasan yang kuat "
104
"dan cepat untuk pengembangan dan penerapan aplikasi berbasis Web."
105
106
#: serverguide/C/web-servers.xml:51(title) serverguide/C/web-servers.xml:710(title) serverguide/C/web-servers.xml:857(title) serverguide/C/web-servers.xml:991(title) serverguide/C/virtualization.xml:70(title) serverguide/C/virtualization.xml:1000(title) serverguide/C/virtualization.xml:1859(title) serverguide/C/vcs.xml:33(title) serverguide/C/vcs.xml:94(title) serverguide/C/vcs.xml:226(title) serverguide/C/samba.xml:81(title) serverguide/C/samba.xml:291(title) serverguide/C/remote-administration.xml:46(title) serverguide/C/remote-administration.xml:269(title) serverguide/C/remote-administration.xml:471(title) serverguide/C/network-config.xml:973(title) serverguide/C/network-config.xml:1153(title) serverguide/C/network-auth.xml:142(title) serverguide/C/network-auth.xml:2763(title) serverguide/C/network-auth.xml:3235(title) serverguide/C/monitoring.xml:40(title) serverguide/C/monitoring.xml:429(title) serverguide/C/mail.xml:38(title) serverguide/C/mail.xml:548(title) serverguide/C/mail.xml:737(title) serverguide/C/mail.xml:887(title) serverguide/C/mail.xml:1377(title) serverguide/C/lamp-applications.xml:110(title) serverguide/C/lamp-applications.xml:287(title) serverguide/C/lamp-applications.xml:401(title) serverguide/C/installation.xml:11(title) serverguide/C/installation.xml:129(title) serverguide/C/installation.xml:946(title) serverguide/C/installation.xml:1401(title) serverguide/C/file-server.xml:357(title) serverguide/C/file-server.xml:645(title) serverguide/C/dns.xml:21(title) serverguide/C/databases.xml:37(title) serverguide/C/databases.xml:300(title) serverguide/C/chat.xml:35(title) serverguide/C/chat.xml:135(title) serverguide/C/backups.xml:602(title)
107
msgid "Installation"
108
msgstr "Instalasi"
109
110
#: serverguide/C/web-servers.xml:52(para)
111
msgid ""
112
"The <application>Apache2</application> web server is available in Ubuntu "
113
"Linux. To install Apache2:"
114
msgstr ""
115
116
#: serverguide/C/web-servers.xml:58(para) serverguide/C/lamp-applications.xml:37(para)
117
msgid "At a terminal prompt enter the following command:"
118
msgstr ""
119
120
#: serverguide/C/web-servers.xml:63(command)
121
msgid "sudo apt install apache2"
122
msgstr "sudo apt install apache2"
123
124
#: serverguide/C/web-servers.xml:71(title) serverguide/C/web-servers.xml:763(title) serverguide/C/web-servers.xml:868(title) serverguide/C/web-servers.xml:1018(title) serverguide/C/web-servers.xml:1121(title) serverguide/C/virtualization.xml:1031(title) serverguide/C/vcs.xml:44(title) serverguide/C/vcs.xml:103(title) serverguide/C/samba.xml:97(title) serverguide/C/samba.xml:308(title) serverguide/C/remote-administration.xml:68(title) serverguide/C/remote-administration.xml:289(title) serverguide/C/package-management.xml:422(title) serverguide/C/network-config.xml:995(title) serverguide/C/network-config.xml:1163(title) serverguide/C/network-auth.xml:2850(title) serverguide/C/network-auth.xml:3256(title) serverguide/C/monitoring.xml:185(title) serverguide/C/monitoring.xml:455(title) serverguide/C/mail.xml:557(title) serverguide/C/mail.xml:747(title) serverguide/C/mail.xml:970(title) serverguide/C/mail.xml:1406(title) serverguide/C/lamp-applications.xml:130(title) serverguide/C/lamp-applications.xml:317(title) serverguide/C/lamp-applications.xml:422(title) serverguide/C/installation.xml:1446(title) serverguide/C/file-server.xml:370(title) serverguide/C/file-server.xml:671(title) serverguide/C/dns.xml:37(title) serverguide/C/databases.xml:73(title) serverguide/C/databases.xml:316(title) serverguide/C/clustering.xml:45(title) serverguide/C/chat.xml:55(title) serverguide/C/chat.xml:147(title) serverguide/C/backups.xml:631(title)
125
msgid "Configuration"
126
msgstr "Konfigurasi"
127
128
#: serverguide/C/web-servers.xml:73(para)
129
msgid ""
130
"Apache2 is configured by placing <emphasis>directives</emphasis> in plain "
131
"text configuration files. These <emphasis>directives</emphasis> are "
132
"separated between the following files and directories:"
133
msgstr ""
134
135
#: serverguide/C/web-servers.xml:81(para)
136
msgid ""
137
"<emphasis>apache2.conf:</emphasis> the main Apache2 configuration file. "
138
"Contains settings that are <emphasis>global</emphasis> to Apache2."
139
msgstr ""
140
141
#: serverguide/C/web-servers.xml:87(para)
142
msgid ""
143
"<emphasis>httpd.conf:</emphasis> historically the main Apache2 configuration "
144
"file, named after the <application>httpd</application> daemon. Now the file "
145
"does not exist. In older versions of Ubuntu the file might be present, but "
146
"empty, as all configuration options have been moved to the below referenced "
147
"directories."
148
msgstr ""
149
150
#: serverguide/C/web-servers.xml:94(para)
151
msgid ""
152
"<emphasis>conf-available:</emphasis> this directory contains available "
153
"configuration files. All files that were previously in "
154
"<filename>/etc/apache2/conf.d</filename> should be moved to "
155
"<filename>/etc/apache2/conf-available</filename>."
156
msgstr ""
157
158
#: serverguide/C/web-servers.xml:101(para)
159
msgid ""
160
"<emphasis>conf-enabled:</emphasis> holds <emphasis>symlinks</emphasis> to "
161
"the files in <filename>/etc/apache2/conf-available</filename>. When a "
162
"configuration file is symlinked, it will be enabled the next time "
163
"<application>apache2</application> is restarted."
164
msgstr ""
165
166
#: serverguide/C/web-servers.xml:108(para)
167
msgid ""
168
"<emphasis>envvars:</emphasis> file where Apache2 "
169
"<emphasis>environment</emphasis> variables are set."
170
msgstr ""
171
172
#: serverguide/C/web-servers.xml:113(para)
173
msgid ""
174
"<emphasis>mods-available:</emphasis> this directory contains configuration "
175
"files to both load <emphasis>modules</emphasis> and configure them. Not all "
176
"modules will have specific configuration files, however."
177
msgstr ""
178
179
#: serverguide/C/web-servers.xml:119(para)
180
msgid ""
181
"<emphasis>mods-enabled:</emphasis> holds <emphasis>symlinks</emphasis> to "
182
"the files in <filename>/etc/apache2/mods-available</filename>. When a module "
183
"configuration file is symlinked it will be enabled the next time "
184
"<application>apache2</application> is restarted."
185
msgstr ""
186
187
#: serverguide/C/web-servers.xml:126(para)
188
msgid ""
189
"<emphasis>ports.conf:</emphasis> houses the directives that determine which "
190
"TCP ports Apache2 is listening on."
191
msgstr ""
192
193
#: serverguide/C/web-servers.xml:131(para)
194
msgid ""
195
"<emphasis>sites-available:</emphasis> this directory has configuration files "
196
"for Apache2 <emphasis>Virtual Hosts</emphasis>. Virtual Hosts allow Apache2 "
197
"to be configured for multiple sites that have separate configurations."
198
msgstr ""
199
200
#: serverguide/C/web-servers.xml:138(para)
201
msgid ""
202
"<emphasis>sites-enabled:</emphasis> like mods-enabled, <filename "
203
"role=\"directory\">sites-enabled</filename> contains symlinks to the "
204
"<filename>/etc/apache2/sites-available</filename> directory. Similarly when "
205
"a configuration file in sites-available is symlinked, the site configured by "
206
"it will be active once Apache2 is restarted."
207
msgstr ""
208
209
#: serverguide/C/web-servers.xml:145(para)
210
msgid ""
211
"<emphasis>magic:</emphasis> instructions for determining MIME type based on "
212
"the first few bytes of a file."
213
msgstr ""
214
215
#: serverguide/C/web-servers.xml:151(para)
216
msgid ""
217
"In addition, other configuration files may be added using the "
218
"<emphasis>Include</emphasis> directive, and wildcards can be used to include "
219
"many configuration files. Any directive may be placed in any of these "
220
"configuration files. Changes to the main configuration files are only "
221
"recognized by Apache2 when it is started or restarted."
222
msgstr ""
223
224
#: serverguide/C/web-servers.xml:160(para)
225
msgid ""
226
"The server also reads a file containing mime document types; the filename is "
227
"set by the <emphasis>TypesConfig</emphasis> directive, typically via "
228
"<filename>/etc/apache2/mods-available/mime.conf</filename>, which might also "
229
"include additions and overrides, and is <filename>/etc/mime.types</filename> "
230
"by default."
231
msgstr ""
232
233
#: serverguide/C/web-servers.xml:168(title)
234
msgid "Basic Settings"
235
msgstr "Penataan Dasar"
236
237
#: serverguide/C/web-servers.xml:169(para)
238
msgid ""
239
"This section explains Apache2 server essential configuration parameters. "
240
"Refer to the <ulink url=\"http://httpd.apache.org/docs/2.4/\">Apache2 "
241
"Documentation</ulink> for more details."
242
msgstr ""
243
244
#: serverguide/C/web-servers.xml:177(para)
245
msgid ""
246
"Apache2 ships with a virtual-host-friendly default configuration. That is, "
247
"it is configured with a single default virtual host (using the "
248
"<emphasis>VirtualHost</emphasis> directive) which can be modified or used as-"
249
"is if you have a single site, or used as a template for additional virtual "
250
"hosts if you have multiple sites. If left alone, the default virtual host "
251
"will serve as your default site, or the site users will see if the URL they "
252
"enter does not match the <emphasis>ServerName</emphasis> directive of any of "
253
"your custom sites. To modify the default virtual host, edit the file "
254
"<filename>/etc/apache2/sites-available/000-default.conf</filename>."
255
msgstr ""
256
257
#: serverguide/C/web-servers.xml:190(para)
258
msgid ""
259
"The directives set for a virtual host only apply to that particular virtual "
260
"host. If a directive is set server-wide and not defined within the virtual "
261
"host settings, the default setting is used. For example, you can define a "
262
"Webmaster email address and not define individual email addresses for each "
263
"virtual host."
264
msgstr ""
265
266
#: serverguide/C/web-servers.xml:198(para)
267
msgid ""
268
"If you wish to configure a new virtual host or site, copy that file into the "
269
"same directory with a name you choose. For example:"
270
msgstr ""
271
272
#: serverguide/C/web-servers.xml:204(command)
273
msgid ""
274
"sudo cp /etc/apache2/sites-available/000-default.conf /etc/apache2/sites-"
275
"available/mynewsite.conf"
276
msgstr ""
277
278
#: serverguide/C/web-servers.xml:207(para)
279
msgid ""
280
"Edit the new file to configure the new site using some of the directives "
281
"described below."
282
msgstr ""
283
284
#: serverguide/C/web-servers.xml:214(para)
285
msgid ""
286
"The <emphasis>ServerAdmin</emphasis> directive specifies the email address "
287
"to be advertised for the server's administrator. The default value is "
288
"webmaster@localhost. This should be changed to an email address that is "
289
"delivered to you (if you are the server's administrator). If your website "
290
"has a problem, Apache2 will display an error message containing this email "
291
"address to report the problem to. Find this directive in your site's "
292
"configuration file in /etc/apache2/sites-available."
293
msgstr ""
294
295
#: serverguide/C/web-servers.xml:225(para)
296
msgid ""
297
"The <emphasis>Listen</emphasis> directive specifies the port, and optionally "
298
"the IP address, Apache2 should listen on. If the IP address is not "
299
"specified, Apache2 will listen on all IP addresses assigned to the machine "
300
"it runs on. The default value for the Listen directive is 80. Change this to "
301
"127.0.0.1:80 to cause Apache2 to listen only on your loopback interface so "
302
"that it will not be available to the Internet, to (for example) 81 to change "
303
"the port that it listens on, or leave it as is for normal operation. This "
304
"directive can be found and changed in its own file, "
305
"<filename>/etc/apache2/ports.conf</filename>"
306
msgstr ""
307
308
#: serverguide/C/web-servers.xml:238(para)
309
msgid ""
310
"The <emphasis>ServerName</emphasis> directive is optional and specifies what "
311
"FQDN your site should answer to. The default virtual host has no ServerName "
312
"directive specified, so it will respond to all requests that do not match a "
313
"ServerName directive in another virtual host. If you have just acquired the "
314
"domain name ubunturocks.com and wish to host it on your Ubuntu server, the "
315
"value of the ServerName directive in your virtual host configuration file "
316
"should be ubunturocks.com. Add this directive to the new virtual host file "
317
"you created earlier (<filename>/etc/apache2/sites-"
318
"available/mynewsite.conf</filename>)."
319
msgstr ""
320
321
#: serverguide/C/web-servers.xml:250(para)
322
msgid ""
323
"You may also want your site to respond to www.ubunturocks.com, since many "
324
"users will assume the www prefix is appropriate. Use the "
325
"<emphasis>ServerAlias</emphasis> directive for this. You may also use "
326
"wildcards in the ServerAlias directive."
327
msgstr ""
328
329
#: serverguide/C/web-servers.xml:257(para)
330
msgid ""
331
"For example, the following configuration will cause your site to respond to "
332
"any domain request ending in <emphasis>.ubunturocks.com</emphasis>."
333
msgstr ""
334
335
#: serverguide/C/web-servers.xml:263(programlisting)
336
#, no-wrap
337
msgid ""
338
"\n"
339
"ServerAlias *.ubunturocks.com\n"
340
msgstr ""
341
"\n"
342
"ServerAlias *.ubunturocks.com\n"
343
344
#: serverguide/C/web-servers.xml:269(para)
345
msgid ""
346
"The <emphasis>DocumentRoot</emphasis> directive specifies where Apache2 "
347
"should look for the files that make up the site. The default value is "
348
"/var/www/html, as specified in <filename>/etc/apache2/sites-available/000-"
349
"default.conf</filename>. If desired, change this value in your site's "
350
"virtual host file, and remember to create that directory if necessary!"
351
msgstr ""
352
353
#: serverguide/C/web-servers.xml:278(para)
354
msgid ""
355
"Enable the new <emphasis>VirtualHost</emphasis> using the "
356
"<application>a2ensite</application> utility and restart Apache2:"
357
msgstr ""
358
359
#: serverguide/C/web-servers.xml:284(command)
360
msgid "sudo a2ensite mynewsite"
361
msgstr "sudo a2ensite mynewsite"
362
363
#: serverguide/C/web-servers.xml:285(command) serverguide/C/web-servers.xml:303(command) serverguide/C/web-servers.xml:544(command) serverguide/C/web-servers.xml:553(command) serverguide/C/web-servers.xml:612(command) serverguide/C/mail.xml:994(command) serverguide/C/lamp-applications.xml:238(command) serverguide/C/lamp-applications.xml:462(command)
364
msgid "sudo systemctl restart apache2.service"
365
msgstr "sudo systemctl restart apache2.service"
366
367
#: serverguide/C/web-servers.xml:289(para)
368
msgid ""
369
"Be sure to replace <emphasis>mynewsite</emphasis> with a more descriptive "
370
"name for the VirtualHost. One method is to name the file after the "
371
"<emphasis>ServerName</emphasis> directive of the VirtualHost."
372
msgstr ""
373
374
#: serverguide/C/web-servers.xml:296(para)
375
msgid ""
376
"Similarly, use the <application>a2dissite</application> utility to disable "
377
"sites. This is can be useful when troubleshooting configuration problems "
378
"with multiple VirtualHosts:"
379
msgstr ""
380
381
#: serverguide/C/web-servers.xml:302(command)
382
msgid "sudo a2dissite mynewsite"
383
msgstr "sudo a2dissite mynewsite"
384
385
#: serverguide/C/web-servers.xml:308(title)
386
msgid "Default Settings"
387
msgstr "Penataan Baku"
388
389
#: serverguide/C/web-servers.xml:310(para)
390
msgid ""
391
"This section explains configuration of the Apache2 server default settings. "
392
"For example, if you add a virtual host, the settings you configure for the "
393
"virtual host take precedence for that virtual host. For a directive not "
394
"defined within the virtual host settings, the default value is used."
395
msgstr ""
396
397
#: serverguide/C/web-servers.xml:322(para)
398
msgid ""
399
"The <emphasis>DirectoryIndex</emphasis> is the default page served by the "
400
"server when a user requests an index of a directory by specifying a forward "
401
"slash (/) at the end of the directory name."
402
msgstr ""
403
404
#: serverguide/C/web-servers.xml:329(para)
405
msgid ""
406
"For example, when a user requests the page "
407
"http://www.example.com/this_directory/, he or she will get either the "
408
"DirectoryIndex page if it exists, a server-generated directory list if it "
409
"does not and the Indexes option is specified, or a Permission Denied page if "
410
"neither is true. The server will try to find one of the files listed in the "
411
"DirectoryIndex directive and will return the first one it finds. If it does "
412
"not find any of these files and if <emphasis>Options Indexes</emphasis> is "
413
"set for that directory, the server will generate and return a list, in HTML "
414
"format, of the subdirectories and files in the directory. The default value, "
415
"found in <filename>/etc/apache2/mods-available/dir.conf</filename> is "
416
"\"index.html index.cgi index.pl index.php index.xhtml index.htm\". Thus, if "
417
"Apache2 finds a file in a requested directory matching any of these names, "
418
"the first will be displayed."
419
msgstr ""
420
421
#: serverguide/C/web-servers.xml:350(para)
422
msgid ""
423
"The <emphasis>ErrorDocument</emphasis> directive allows you to specify a "
424
"file for Apache2 to use for specific error events. For example, if a user "
425
"requests a resource that does not exist, a 404 error will occur. By default, "
426
"Apache2 will simply return a HTTP 404 Return code. Read "
427
"<filename>/etc/apache2/conf-available/localized-error-pages.conf</filename> "
428
"for detailed instructions for using ErrorDocument, including locations of "
429
"example files."
430
msgstr ""
431
432
#: serverguide/C/web-servers.xml:360(para)
433
msgid ""
434
"By default, the server writes the transfer log to the file "
435
"<filename>/var/log/apache2/access.log</filename>. You can change this on a "
436
"per-site basis in your virtual host configuration files with the "
437
"<emphasis>CustomLog</emphasis> directive, or omit it to accept the default, "
438
"specified in <filename> /etc/apache2/conf-available/other-vhosts-access-"
439
"log.conf</filename>. You may also specify the file to which errors are "
440
"logged, via the <emphasis>ErrorLog</emphasis> directive, whose default is "
441
"<filename>/var/log/apache2/error.log</filename>. These are kept separate "
442
"from the transfer logs to aid in troubleshooting problems with your Apache2 "
443
"server. You may also specify the <emphasis>LogLevel</emphasis> (the default "
444
"value is \"warn\") and the <emphasis>LogFormat</emphasis> (see <filename> "
445
"/etc/apache2/apache2.conf</filename> for the default value)."
446
msgstr ""
447
448
#: serverguide/C/web-servers.xml:375(para)
449
msgid ""
450
"Some options are specified on a per-directory basis rather than per-server. "
451
"<emphasis>Options</emphasis> is one of these directives. A Directory stanza "
452
"is enclosed in XML-like tags, like so:"
453
msgstr ""
454
455
#: serverguide/C/web-servers.xml:381(programlisting)
456
#, no-wrap
457
msgid ""
458
"\n"
459
"<Directory /var/www/html/mynewsite>\n"
460
"...\n"
461
"</Directory>\n"
462
msgstr ""
463
464
#: serverguide/C/web-servers.xml:387(para)
465
msgid ""
466
"The <emphasis>Options</emphasis> directive within a Directory stanza accepts "
467
"one or more of the following values (among others), separated by spaces:"
468
msgstr ""
469
470
#: serverguide/C/web-servers.xml:399(para)
471
msgid ""
472
"Most files should not be executed as CGI scripts. This would be very "
473
"dangerous. CGI scripts should kept in a directory separate from and outside "
474
"your DocumentRoot, and only this directory should have the ExecCGI option "
475
"set. This is the default, and the default location for CGI scripts is "
476
"<filename>/usr/lib/cgi-bin</filename>."
477
msgstr ""
478
479
#: serverguide/C/web-servers.xml:394(para)
480
msgid ""
481
"<emphasis role=\"bold\">ExecCGI</emphasis> - Allow execution of CGI scripts. "
482
"CGI scripts are not executed if this option is not chosen. <placeholder-1/>"
483
msgstr ""
484
"<emphasis role=\"bold\">ExecCGI</emphasis> - Memperbolehkan skrip CGI di "
485
"jalankan. jika ini tidah di pilih maka skrip CGI tidak akan di eksekusi"
486
487
#: serverguide/C/web-servers.xml:410(para)
488
msgid ""
489
"<emphasis role=\"bold\">Includes</emphasis> - Allow server-side includes. "
490
"Server-side includes allow an HTML file to <emphasis> include</emphasis> "
491
"other files. See <ulink "
492
"url=\"https://help.ubuntu.com/community/ServerSideIncludes\">Apache SSI "
493
"documentation (Ubuntu community)</ulink> for more information."
494
msgstr ""
495
496
#: serverguide/C/web-servers.xml:419(para)
497
msgid ""
498
"<emphasis role=\"bold\">IncludesNOEXEC</emphasis> - Allow server-side "
499
"includes, but disable the <emphasis>#exec</emphasis> and "
500
"<emphasis>#include</emphasis> commands in CGI scripts."
501
msgstr ""
502
503
#: serverguide/C/web-servers.xml:431(para)
504
msgid ""
505
"For security reasons, this should usually not be set, and certainly should "
506
"not be set on your DocumentRoot directory. Enable this option carefully on a "
507
"per-directory basis only if you are certain you want users to see the entire "
508
"contents of the directory."
509
msgstr ""
510
"Karena alasan keamanan, ini selalu tidak akan diatur, dan tentu saja tidak "
511
"akan di atur di direktori DocumentRoot. Di setiap direktori aktifkan opsi "
512
"ini secara hari-hati jika anda ingin pengguna tertentu untuk melihat seluruh "
513
"isi dari direktori"
514
515
#: serverguide/C/web-servers.xml:426(para)
516
msgid ""
517
"<emphasis role=\"bold\">Indexes</emphasis> - Display a formatted list of the "
518
"directory's contents, if no <emphasis>DirectoryIndex</emphasis> (such as "
519
"index.html) exists in the requested directory. <placeholder-1/>"
520
msgstr ""
521
522
#: serverguide/C/web-servers.xml:441(para)
523
msgid ""
524
"<emphasis role=\"bold\">Multiview</emphasis> - Support content-negotiated "
525
"multiviews; this option is disabled by default for security reasons. See the "
526
"<ulink "
527
"url=\"http://httpd.apache.org/docs/2.4/mod/mod_negotiation.html#multiviews\">"
528
"Apache2 documentation on this option</ulink>."
529
msgstr ""
530
531
#: serverguide/C/web-servers.xml:449(para)
532
msgid ""
533
"<emphasis role=\"bold\">SymLinksIfOwnerMatch</emphasis> - Only follow "
534
"symbolic links if the target file or directory has the same owner as the "
535
"link."
536
msgstr ""
537
538
#: serverguide/C/web-servers.xml:461(title)
539
msgid "httpd Settings"
540
msgstr ""
541
542
#: serverguide/C/web-servers.xml:463(para)
543
msgid ""
544
"This section explains some basic <application>httpd</application> daemon "
545
"configuration settings."
546
msgstr ""
547
548
#: serverguide/C/web-servers.xml:467(para)
549
msgid ""
550
"<emphasis role=\"bold\">LockFile</emphasis> - The LockFile directive sets "
551
"the path to the lockfile used when the server is compiled with either "
552
"USE_FCNTL_SERIALIZED_ACCEPT or USE_FLOCK_SERIALIZED_ACCEPT. It must be "
553
"stored on the local disk. It should be left to the default value unless the "
554
"logs directory is located on an NFS share. If this is the case, the default "
555
"value should be changed to a location on the local disk and to a directory "
556
"that is readable only by root."
557
msgstr ""
558
559
#: serverguide/C/web-servers.xml:476(para)
560
msgid ""
561
"<emphasis role=\"bold\">PidFile</emphasis> - The PidFile directive sets the "
562
"file in which the server records its process ID (pid). This file should only "
563
"be readable by root. In most cases, it should be left to the default value."
564
msgstr ""
565
566
#: serverguide/C/web-servers.xml:482(para)
567
msgid ""
568
"<emphasis role=\"bold\">User</emphasis> - The User directive sets the userid "
569
"used by the server to answer requests. This setting determines the server's "
570
"access. Any files inaccessible to this user will also be inaccessible to "
571
"your website's visitors. The default value for User is \"www-data\"."
572
msgstr ""
573
574
#: serverguide/C/web-servers.xml:489(para)
575
msgid ""
576
"Unless you know exactly what you are doing, do not set the User directive to "
577
"root. Using root as the User will create large security holes for your Web "
578
"server."
579
msgstr ""
580
581
#: serverguide/C/web-servers.xml:495(para)
582
msgid ""
583
"<emphasis role=\"bold\">Group</emphasis> - The Group directive is similar to "
584
"the User directive. Group sets the group under which the server will answer "
585
"requests. The default group is also \"www-data\"."
586
msgstr ""
587
588
#: serverguide/C/web-servers.xml:502(title)
589
msgid "Apache2 Modules"
590
msgstr ""
591
592
#: serverguide/C/web-servers.xml:504(para)
593
msgid ""
594
"Apache2 is a modular server. This implies that only the most basic "
595
"functionality is included in the core server. Extended features are "
596
"available through modules which can be loaded into Apache2. By default, a "
597
"base set of modules is included in the server at compile-time. If the server "
598
"is compiled to use dynamically loaded modules, then modules can be compiled "
599
"separately, and added at any time using the LoadModule directive. Otherwise, "
600
"Apache2 must be recompiled to add or remove modules."
601
msgstr ""
602
603
#: serverguide/C/web-servers.xml:516(para)
604
msgid ""
605
"Ubuntu compiles Apache2 to allow the dynamic loading of modules. "
606
"Configuration directives may be conditionally included on the presence of a "
607
"particular module by enclosing them in an "
608
"<emphasis><IfModule></emphasis> block."
609
msgstr ""
610
611
#: serverguide/C/web-servers.xml:523(para)
612
msgid ""
613
"You can install additional Apache2 modules and use them with your Web "
614
"server. For example, run the following command at a terminal prompt to "
615
"install the <emphasis>MySQL Authentication</emphasis> module:"
616
msgstr ""
617
618
#: serverguide/C/web-servers.xml:530(command)
619
msgid "sudo apt install libapache2-mod-auth-mysql"
620
msgstr ""
621
622
#: serverguide/C/web-servers.xml:533(para)
623
msgid ""
624
"See the <filename>/etc/apache2/mods-available</filename> directory, for "
625
"additional modules."
626
msgstr ""
627
628
#: serverguide/C/web-servers.xml:537(para)
629
msgid ""
630
"Use the <application>a2enmod</application> utility to enable a module:"
631
msgstr ""
632
633
#: serverguide/C/web-servers.xml:543(command)
634
msgid "sudo a2enmod auth_mysql"
635
msgstr "sudo a2enmod auth_mysql"
636
637
#: serverguide/C/web-servers.xml:547(para)
638
msgid "Similarly, <application>a2dismod</application> will disable a module:"
639
msgstr ""
640
641
#: serverguide/C/web-servers.xml:552(command)
642
msgid "sudo a2dismod auth_mysql"
643
msgstr "sudo a2dismod auth_mysql"
644
645
#: serverguide/C/web-servers.xml:559(title)
646
msgid "HTTPS Configuration"
647
msgstr "Konfigurasi HTTPS"
648
649
#: serverguide/C/web-servers.xml:561(para)
650
msgid ""
651
"The <application>mod_ssl</application> module adds an important feature to "
652
"the Apache2 server - the ability to encrypt communications. Thus, when your "
653
"browser is communicating using SSL, the https:// prefix is used at the "
654
"beginning of the Uniform Resource Locator (URL) in the browser navigation "
655
"bar."
656
msgstr ""
657
658
#: serverguide/C/web-servers.xml:570(para)
659
msgid ""
660
"The <application>mod_ssl</application> module is available in "
661
"<application>apache2-common</application> package. Execute the following "
662
"command at a terminal prompt to enable the "
663
"<application>mod_ssl</application> module:"
664
msgstr ""
665
666
#: serverguide/C/web-servers.xml:577(command)
667
msgid "sudo a2enmod ssl"
668
msgstr "sudo a2enmod ssl"
669
670
#: serverguide/C/web-servers.xml:580(para)
671
msgid ""
672
"There is a default HTTPS configuration file in <filename>/etc/apache2/sites-"
673
"available/default-ssl.conf</filename>. In order for "
674
"<application>Apache2</application> to provide HTTPS, a "
675
"<emphasis>certificate</emphasis> and <emphasis>key</emphasis> file are also "
676
"needed. The default HTTPS configuration will use a certificate and key "
677
"generated by the <application>ssl-cert</application> package. They are good "
678
"for testing, but the auto-generated certificate and key should be replaced "
679
"by a certificate specific to the site or server. For information on "
680
"generating a key and obtaining a certificate see <xref "
681
"linkend=\"certificates-and-security\"/>"
682
msgstr ""
683
684
#: serverguide/C/web-servers.xml:590(para)
685
msgid ""
686
"To configure <application>Apache2</application> for HTTPS, enter the "
687
"following:"
688
msgstr ""
689
690
#: serverguide/C/web-servers.xml:595(command)
691
msgid "sudo a2ensite default-ssl"
692
msgstr ""
693
694
#: serverguide/C/web-servers.xml:599(para)
695
msgid ""
696
"The directories <filename>/etc/ssl/certs</filename> and "
697
"<filename>/etc/ssl/private</filename> are the default locations. If you "
698
"install the certificate and key in another directory make sure to change "
699
"<emphasis>SSLCertificateFile</emphasis> and "
700
"<emphasis>SSLCertificateKeyFile</emphasis> appropriately."
701
msgstr ""
702
703
#: serverguide/C/web-servers.xml:606(para)
704
msgid ""
705
"With Apache2 now configured for HTTPS, restart the service to enable the new "
706
"settings:"
707
msgstr ""
708
709
#: serverguide/C/web-servers.xml:617(para)
710
msgid ""
711
"Depending on how you obtained your certificate you may need to enter a "
712
"passphrase when <application>Apache2</application> starts."
713
msgstr ""
714
715
#: serverguide/C/web-servers.xml:623(para)
716
msgid ""
717
"You can access the secure server pages by typing https://your_hostname/url/ "
718
"in your browser address bar."
719
msgstr ""
720
721
#: serverguide/C/web-servers.xml:630(title)
722
msgid "Sharing Write Permission"
723
msgstr ""
724
725
#: serverguide/C/web-servers.xml:631(para)
726
msgid ""
727
"For more than one user to be able to write to the same directory it will be "
728
"necessary to grant write permission to a group they share in common. The "
729
"following example grants shared write permission to "
730
"<filename>/var/www/html</filename> to the group \"webmasters\"."
731
msgstr ""
732
733
#: serverguide/C/web-servers.xml:639(command)
734
msgid "sudo chgrp -R webmasters /var/www/html"
735
msgstr "sudo chgrp -R webmasters /var/www/html"
736
737
#: serverguide/C/web-servers.xml:640(command)
738
msgid "sudo find /var/www/html -type d -exec chmod g=rwxs \"{}\" \\;"
739
msgstr "sudo find /var/www/html -type d -exec chmod g=rwxs \"{}\" \\;"
740
741
#: serverguide/C/web-servers.xml:641(command)
742
msgid "sudo find /var/www/html -type f -exec chmod g=rw \"{}\" \\;"
743
msgstr "sudo find /var/www/html -type f -exec chmod g=rw \"{}\" \\;"
744
745
#: serverguide/C/web-servers.xml:643(para)
746
msgid ""
747
"These commands recursively set the group permission on all files and "
748
"directories in /var/www/html to read write and set user id. This has the "
749
"effect of having the files and directories inherit their group and "
750
"permission from their parrent. Many admins find this useful for allowing "
751
"multiple users to edit files in a directory tree."
752
msgstr ""
753
754
#: serverguide/C/web-servers.xml:652(para)
755
msgid ""
756
"If access must be granted to more than one group per directory, enable "
757
"Access Control Lists (ACLs)."
758
msgstr ""
759
760
#: serverguide/C/web-servers.xml:659(title) serverguide/C/web-servers.xml:812(title) serverguide/C/web-servers.xml:973(title) serverguide/C/web-servers.xml:1068(title) serverguide/C/web-servers.xml:1293(title) serverguide/C/vpn.xml:921(title) serverguide/C/vcs.xml:546(title) serverguide/C/security.xml:876(title) serverguide/C/security.xml:1216(title) serverguide/C/security.xml:1630(title) serverguide/C/security.xml:1816(title) serverguide/C/remote-administration.xml:196(title) serverguide/C/remote-administration.xml:820(title) serverguide/C/package-management.xml:484(title) serverguide/C/network-config.xml:1033(title) serverguide/C/network-config.xml:1223(title) serverguide/C/monitoring.xml:392(title) serverguide/C/monitoring.xml:528(title) serverguide/C/mail.xml:511(title) serverguide/C/mail.xml:706(title) serverguide/C/mail.xml:859(title) serverguide/C/mail.xml:1279(title) serverguide/C/mail.xml:1746(title) serverguide/C/lamp-applications.xml:260(title) serverguide/C/lamp-applications.xml:370(title) serverguide/C/lamp-applications.xml:525(title) serverguide/C/file-server.xml:305(title) serverguide/C/file-server.xml:445(title) serverguide/C/file-server.xml:615(title) serverguide/C/file-server.xml:802(title) serverguide/C/dns.xml:614(title) serverguide/C/clustering.xml:232(title) serverguide/C/chat.xml:106(title) serverguide/C/chat.xml:215(title) serverguide/C/backups.xml:301(title)
761
msgid "References"
762
msgstr "Referensi"
763
764
#: serverguide/C/web-servers.xml:663(para)
765
msgid ""
766
"<ulink url=\"http://httpd.apache.org/docs/2.4/\">Apache2 "
767
"Documentation</ulink> contains in depth information on Apache2 configuration "
768
"directives. Also, see the <application>apache2-doc</application> package for "
769
"the official Apache2 docs."
770
msgstr ""
771
772
#: serverguide/C/web-servers.xml:670(para)
773
msgid ""
774
"See the <ulink url=\"http://www.modssl.org/docs/\">Mod SSL "
775
"Documentation</ulink> site for more SSL related information."
776
msgstr ""
777
778
#: serverguide/C/web-servers.xml:676(para)
779
msgid ""
780
"O'Reilly's <ulink url=\"http://oreilly.com/catalog/9780596001919/\">Apache "
781
"Cookbook</ulink> is a good resource for accomplishing specific Apache2 "
782
"configurations."
783
msgstr ""
784
785
#: serverguide/C/web-servers.xml:682(para)
786
msgid ""
787
"For Ubuntu specific Apache2 questions, ask in the <emphasis>#ubuntu-"
788
"server</emphasis> IRC channel on <ulink "
789
"url=\"http://freenode.net/\">freenode.net</ulink>."
790
msgstr ""
791
792
#: serverguide/C/web-servers.xml:688(para)
793
msgid ""
794
"Usually integrated with PHP and MySQL the <ulink "
795
"url=\"https://help.ubuntu.com/community/ApacheMySQLPHP\">Apache MySQL PHP "
796
"Ubuntu Wiki </ulink> page is a good resource."
797
msgstr ""
798
799
#: serverguide/C/web-servers.xml:699(title)
800
msgid "PHP - Scripting Language"
801
msgstr ""
802
803
#: serverguide/C/web-servers.xml:700(para)
804
msgid ""
805
"PHP is a general-purpose scripting language suited for Web development. PHP "
806
"scripts can be embedded into HTML. This section explains how to install and "
807
"configure PHP in an Ubuntu System with Apache2 and MySQL."
808
msgstr ""
809
810
#: serverguide/C/web-servers.xml:704(para)
811
msgid ""
812
"This section assumes you have installed and configured Apache2 Web Server "
813
"and MySQL Database Server. You can refer to the Apache2 and MySQL sections "
814
"in this document to install and configure Apache2 and MySQL respectively."
815
msgstr ""
816
817
#: serverguide/C/web-servers.xml:711(para)
818
msgid ""
819
"PHP is available in Ubuntu Linux. Unlike python and perl, which are "
820
"installed in the base system, PHP must be added."
821
msgstr ""
822
823
#: serverguide/C/web-servers.xml:715(para)
824
msgid ""
825
"To install PHP and the Apache PHP module you can enter the following command "
826
"at a terminal prompt: <screen>\n"
827
"<command>sudo apt install php libapache2-mod-php</command>\n"
828
"</screen>"
829
msgstr ""
830
831
#: serverguide/C/web-servers.xml:724(para)
832
msgid ""
833
"You can run PHP scripts at a terminal prompt. To run PHP scripts at a "
834
"terminal prompt you should install the <application>php-cli</application> "
835
"package. To install <application>php-cli</application> you can enter the "
836
"following command at a terminal prompt: <screen>\n"
837
"<command>sudo apt install php-cli</command>\n"
838
"</screen>"
839
msgstr ""
840
841
#: serverguide/C/web-servers.xml:733(para)
842
msgid ""
843
"You can also execute PHP scripts without installing the Apache PHP module. "
844
"To accomplish this, you should install the <application>php-"
845
"cgi</application> package. You can run the following command at a terminal "
846
"prompt to install the <application>php-cgi</application> package: <screen>\n"
847
"<command>sudo apt install php-cgi</command>\n"
848
"</screen>"
849
msgstr ""
850
851
#: serverguide/C/web-servers.xml:743(para)
852
msgid ""
853
"To use <application>MySQL</application> with PHP you should install the "
854
"<application>php-mysql</application> package. To install <application>php-"
855
"mysql</application> you can enter the following command at a terminal "
856
"prompt: <screen>\n"
857
"<command>sudo apt install php-mysql</command>\n"
858
"</screen>"
859
msgstr ""
860
861
#: serverguide/C/web-servers.xml:751(para)
862
msgid ""
863
"Similarly, to use <application>PostgreSQL</application> with PHP you should "
864
"install the <application>php-pgsql</application> package. To install "
865
"<application>php-pgsql</application> you can enter the following command at "
866
"a terminal prompt: <screen>\n"
867
"<command>sudo apt install php-pgsql</command>\n"
868
"</screen>"
869
msgstr ""
870
871
#: serverguide/C/web-servers.xml:764(para)
872
msgid ""
873
"If you have installed the <application>libapache2-mod-php</application> or "
874
"<application>php-cgi</application> packages, you can run PHP scripts from "
875
"your web browser. If you have installed the <application>php-"
876
"cli</application> package, you can run PHP scripts at a terminal prompt."
877
msgstr ""
878
879
#: serverguide/C/web-servers.xml:773(para)
880
msgid ""
881
"By default, when <application>libapache2-mod-php</application> is installed, "
882
"the Apache 2 Web server is configured to run PHP scripts. In other words, "
883
"the PHP module is enabled in the Apache Web server when you install the "
884
"module. Please verify if the files <filename>/etc/apache2/mods-"
885
"enabled/php7.0.conf</filename> and <filename>/etc/apache2/mods-"
886
"enabled/php7.0.load</filename> exist. If they do not exist, you can enable "
887
"the module using the <command>a2enmod</command> command."
888
msgstr ""
889
890
#: serverguide/C/web-servers.xml:785(para)
891
msgid ""
892
"Once you have installed the PHP related packages and enabled the Apache PHP "
893
"module, you should restart the Apache2 Web server to run PHP scripts. You "
894
"can run the following command at a terminal prompt to restart your web "
895
"server: <screen><command>sudo systemctl restart apache2.service</command> "
896
"</screen>"
897
msgstr ""
898
899
#: serverguide/C/web-servers.xml:793(title) serverguide/C/network-auth.xml:1063(title) serverguide/C/mail.xml:359(title) serverguide/C/mail.xml:1669(title) serverguide/C/dns.xml:380(title) serverguide/C/clustering.xml:182(title)
900
msgid "Testing"
901
msgstr "Testing"
902
903
#: serverguide/C/web-servers.xml:794(para)
904
msgid ""
905
"To verify your installation, you can run the following PHP phpinfo script:"
906
msgstr ""
907
908
#: serverguide/C/web-servers.xml:797(programlisting)
909
#, no-wrap
910
msgid ""
911
"\n"
912
"<?php\n"
913
" phpinfo();\n"
914
"?>\n"
915
msgstr ""
916
"\n"
917
"<?php\n"
918
" phpinfo();\n"
919
"?>\n"
920
921
#: serverguide/C/web-servers.xml:802(para)
922
msgid ""
923
"You can save the content in a file <filename>phpinfo.php</filename> and "
924
"place it under the <command>DocumentRoot</command> directory of the Apache2 "
925
"Web server. Pointing your browser to "
926
"<filename>http://hostname/phpinfo.php</filename> will display the values of "
927
"various PHP configuration parameters."
928
msgstr ""
929
930
#: serverguide/C/web-servers.xml:816(para)
931
msgid ""
932
"For more in depth information see the <ulink "
933
"url=\"http://www.php.net/docs.php\">php.net</ulink> documentation."
934
msgstr ""
935
936
#: serverguide/C/web-servers.xml:821(para)
937
msgid ""
938
"There are a plethora of books on PHP. A good book from O'Reilly is <ulink "
939
"url=\"http://oreilly.com/catalog/0636920043034/\">Learning PHP</ulink>. "
940
"<ulink url=\"http://oreilly.com/catalog/9781565926813/\">PHP Cook "
941
"Book</ulink> is also good, but has no yet been updated for PHP7."
942
msgstr ""
943
944
#: serverguide/C/web-servers.xml:829(para)
945
msgid ""
946
"Also, see the <ulink "
947
"url=\"https://help.ubuntu.com/community/ApacheMySQLPHP\">Apache MySQL PHP "
948
"Ubuntu Wiki</ulink> page for more information."
949
msgstr ""
950
951
#: serverguide/C/web-servers.xml:840(title)
952
msgid "Squid - Proxy Server"
953
msgstr "Squid - Server Proxy"
954
955
#: serverguide/C/web-servers.xml:841(para)
956
msgid ""
957
"Squid is a full-featured web proxy cache server application which provides "
958
"proxy and cache services for Hyper Text Transport Protocol (HTTP), File "
959
"Transfer Protocol (FTP), and other popular network protocols. Squid can "
960
"implement caching and proxying of Secure Sockets Layer (SSL) requests and "
961
"caching of Domain Name Server (DNS) lookups, and perform transparent "
962
"caching. Squid also supports a wide variety of caching protocols, such as "
963
"Internet Cache Protocol (ICP), the Hyper Text Caching Protocol (HTCP), the "
964
"Cache Array Routing Protocol (CARP), and the Web Cache Coordination Protocol "
965
"(WCCP)."
966
msgstr ""
967
968
#: serverguide/C/web-servers.xml:849(para)
969
msgid ""
970
"The Squid proxy cache server is an excellent solution to a variety of proxy "
971
"and caching server needs, and scales from the branch office to enterprise "
972
"level networks while providing extensive, granular access control "
973
"mechanisms, and monitoring of critical parameters via the Simple Network "
974
"Management Protocol (SNMP). When selecting a computer system for use as a "
975
"dedicated Squid caching proxy server for many users ensure it is configured "
976
"with a large amount of physical memory as Squid maintains an in-memory cache "
977
"for increased performance."
978
msgstr ""
979
980
#: serverguide/C/web-servers.xml:858(para)
981
msgid ""
982
"At a terminal prompt, enter the following command to install the Squid "
983
"server:"
984
msgstr ""
985
"Pada terminal prompt, masukkan perintah berikut untuk menginstal server "
986
"Squid:"
987
988
#: serverguide/C/web-servers.xml:863(command)
989
msgid "sudo apt install squid"
990
msgstr "sudo apt install squid"
991
992
#: serverguide/C/web-servers.xml:869(para)
993
msgid ""
994
"Squid is configured by editing the directives contained within the "
995
"<filename>/etc/squid/squid.conf</filename> configuration file. The following "
996
"examples illustrate some of the directives which may be modified to affect "
997
"the behavior of the Squid server. For more in-depth configuration of Squid, "
998
"see the References section."
999
msgstr ""
1000
1001
#: serverguide/C/web-servers.xml:875(para)
1002
msgid ""
1003
"Prior to editing the configuration file, you should make a copy of the "
1004
"original file and protect it from writing so you will have the original "
1005
"settings as a reference, and to re-use as necessary. Make this copy and "
1006
"protect it from writing using the following commands:"
1007
msgstr ""
1008
1009
#: serverguide/C/web-servers.xml:881(command)
1010
msgid "sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.original"
1011
msgstr "sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.original"
1012
1013
#: serverguide/C/web-servers.xml:882(command)
1014
msgid "sudo chmod a-w /etc/squid/squid.conf.original"
1015
msgstr "sudo chmod a-w /etc/squid/squid.conf.original"
1016
1017
#: serverguide/C/web-servers.xml:889(para)
1018
msgid ""
1019
"To set your Squid server to listen on TCP port 8888 instead of the default "
1020
"TCP port 3128, change the http_port directive as such:"
1021
msgstr ""
1022
1023
#: serverguide/C/web-servers.xml:893(programlisting)
1024
#, no-wrap
1025
msgid ""
1026
"\n"
1027
"http_port 8888\n"
1028
msgstr ""
1029
"\n"
1030
"http_port 8888\n"
1031
1032
#: serverguide/C/web-servers.xml:898(para)
1033
msgid ""
1034
"Change the visible_hostname directive in order to give the Squid server a "
1035
"specific hostname. This hostname does not necessarily need to be the "
1036
"computer's hostname. In this example it is set to <emphasis>weezie</emphasis>"
1037
msgstr ""
1038
1039
#: serverguide/C/web-servers.xml:902(programlisting)
1040
#, no-wrap
1041
msgid ""
1042
"\n"
1043
"visible_hostname weezie\n"
1044
msgstr ""
1045
1046
#: serverguide/C/web-servers.xml:907(para)
1047
msgid ""
1048
"Using Squid's access control, you may configure use of Internet services "
1049
"proxied by Squid to be available only users with certain Internet Protocol "
1050
"(IP) addresses. For example, we will illustrate access by users of the "
1051
"192.168.42.0/24 subnetwork only:"
1052
msgstr ""
1053
1054
#: serverguide/C/web-servers.xml:912(para) serverguide/C/web-servers.xml:932(para)
1055
msgid ""
1056
"Add the following to the <emphasis role=\"bold\">bottom</emphasis> of the "
1057
"ACL section of your <filename>/etc/squid/squid.conf</filename> file:"
1058
msgstr ""
1059
"KTambah yang berikut ini di <emphasis role=\"bold\">bawah</emphasis> dari "
1060
"bagian ACL pada berkas <filename>/etc/squid/squid.conf</filename>:"
1061
1062
#: serverguide/C/web-servers.xml:915(programlisting)
1063
#, no-wrap
1064
msgid ""
1065
"\n"
1066
"acl fortytwo_network src 192.168.42.0/24\n"
1067
msgstr ""
1068
"\n"
1069
"acl fortytwo_network src 192.168.42.0/24\n"
1070
1071
#: serverguide/C/web-servers.xml:918(para) serverguide/C/web-servers.xml:939(para)
1072
msgid ""
1073
"Then, add the following to the <emphasis role=\"bold\">top</emphasis> of the "
1074
"http_access section of your <filename>/etc/squid/squid.conf</filename> file:"
1075
msgstr ""
1076
"Kemudian, tambah yang berikut ini di <emphasis role=\"bold\">atas</emphasis> "
1077
"dari bagian http_access pada berkas "
1078
"<filename>/etc/squid/squid.conf</filename>:"
1079
1080
#: serverguide/C/web-servers.xml:922(programlisting)
1081
#, no-wrap
1082
msgid ""
1083
"\n"
1084
"http_access allow fortytwo_network\n"
1085
msgstr ""
1086
"\n"
1087
"http_access allow fortytwo_network\n"
1088
1089
#: serverguide/C/web-servers.xml:927(para)
1090
msgid ""
1091
"Using the excellent access control features of Squid, you may configure use "
1092
"of Internet services proxied by Squid to be available only during normal "
1093
"business hours. For example, we'll illustrate access by employees of a "
1094
"business which is operating between 9:00AM and 5:00PM, Monday through "
1095
"Friday, and which uses the 10.1.42.0/24 subnetwork:"
1096
msgstr ""
1097
1098
#: serverguide/C/web-servers.xml:935(programlisting)
1099
#, no-wrap
1100
msgid ""
1101
"\n"
1102
"acl biz_network src 10.1.42.0/24\n"
1103
"acl biz_hours time M T W T F 9:00-17:00\n"
1104
msgstr ""
1105
1106
#: serverguide/C/web-servers.xml:943(programlisting)
1107
#, no-wrap
1108
msgid ""
1109
"\n"
1110
"http_access allow biz_network biz_hours\n"
1111
msgstr ""
1112
1113
#: serverguide/C/web-servers.xml:950(para)
1114
msgid ""
1115
"After making changes to the <filename>/etc/squid/squid.conf</filename> file, "
1116
"save the file and restart the <application>squid</application> server "
1117
"application to effect the changes using the following command entered at a "
1118
"terminal prompt:"
1119
msgstr ""
1120
"Setelah membuat perubahan dalam berkas "
1121
"<filename>/etc/squid/squid.conf</filename>, simpan berkas dan mulai ulang "
1122
"aplikasi server <application>squid</application> untuk memberikan efek "
1123
"perubahan dengan menggunakan masukan perintah dalam prompt terminal:"
1124
1125
#: serverguide/C/web-servers.xml:956(command)
1126
msgid "sudo systemctl restart squid.service"
1127
msgstr ""
1128
1129
#: serverguide/C/web-servers.xml:961(para)
1130
msgid ""
1131
"If formerly a customized squid3 was used that set up the spool at "
1132
"<filename>/var/log/squid3</filename> to be a mountpoint, but otherwise kept "
1133
"the default configuration the upgrade will fail. The upgrade tries to "
1134
"rename/move files as needed, but it can't do so for an active mountpoint. In "
1135
"that case please either adapt the mountpoint or the config in "
1136
"<filename>/etc/squid/squid.conf</filename> so that they match."
1137
msgstr ""
1138
1139
#: serverguide/C/web-servers.xml:966(para)
1140
msgid ""
1141
"The same applies if the <emphasis role=\"bold\">include</emphasis> config "
1142
"statement was used to pull in more files from the old path at "
1143
"<filename>/etc/squid3/</filename>. In those cases you should move and adapt "
1144
"your configuration accordingly."
1145
msgstr ""
1146
1147
#: serverguide/C/web-servers.xml:975(ulink)
1148
msgid "Squid Website"
1149
msgstr "Situs Web Squid"
1150
1151
#: serverguide/C/web-servers.xml:977(para)
1152
msgid ""
1153
"<ulink url=\"https://help.ubuntu.com/community/Squid\">Ubuntu Wiki "
1154
"Squid</ulink> page."
1155
msgstr ""
1156
1157
#: serverguide/C/web-servers.xml:984(title)
1158
msgid "Ruby on Rails"
1159
msgstr "Ruby dalam Rails"
1160
1161
#: serverguide/C/web-servers.xml:985(para)
1162
msgid ""
1163
"Ruby on Rails is an open source web framework for developing database backed "
1164
"web applications. It is optimized for sustainable productivity of the "
1165
"programmer since it lets the programmer to write code by favouring "
1166
"convention over configuration."
1167
msgstr ""
1168
1169
#: serverguide/C/web-servers.xml:992(para)
1170
msgid ""
1171
"Before installing <application>Rails</application> you should install "
1172
"<application>Apache</application> and <application>MySQL</application>. To "
1173
"install the <application>Apache</application> package, please refer to <xref "
1174
"linkend=\"httpd\"/>. For instructions on installing "
1175
"<application>MySQL</application> refer to <xref linkend=\"mysql\"/>."
1176
msgstr ""
1177
1178
#: serverguide/C/web-servers.xml:1000(para)
1179
msgid ""
1180
"Once you have <application>Apache</application> and "
1181
"<application>MySQL</application> packages installed, you are ready to "
1182
"install <application>Ruby on Rails</application> package."
1183
msgstr ""
1184
1185
#: serverguide/C/web-servers.xml:1007(para)
1186
msgid ""
1187
"To install the <application>Ruby</application> base packages and "
1188
"<application>Ruby on Rails</application>, you can enter the following "
1189
"command in the terminal prompt:"
1190
msgstr ""
1191
1192
#: serverguide/C/web-servers.xml:1013(command)
1193
msgid "sudo apt install rails"
1194
msgstr "sudo apt install rails"
1195
1196
#: serverguide/C/web-servers.xml:1019(para)
1197
msgid ""
1198
"Modify the <filename>/etc/apache2/sites-available/000-"
1199
"default.conf</filename> configuration file to setup your domains."
1200
msgstr ""
1201
1202
#: serverguide/C/web-servers.xml:1023(para)
1203
msgid ""
1204
"The first thing to change is the <emphasis>DocumentRoot</emphasis> directive:"
1205
msgstr ""
1206
1207
#: serverguide/C/web-servers.xml:1027(programlisting)
1208
#, no-wrap
1209
msgid ""
1210
"\n"
1211
"DocumentRoot /path/to/rails/application/public\n"
1212
msgstr ""
1213
1214
#: serverguide/C/web-servers.xml:1030(para)
1215
msgid ""
1216
"Next, change the <Directory \"/path/to/rails/application/public\"> "
1217
"directive:"
1218
msgstr ""
1219
1220
#: serverguide/C/web-servers.xml:1034(programlisting)
1221
#, no-wrap
1222
msgid ""
1223
"\n"
1224
"<Directory \"/path/to/rails/application/public\">\n"
1225
" Options Indexes FollowSymLinks MultiViews ExecCGI\n"
1226
" AllowOverride All\n"
1227
" Order allow,deny\n"
1228
" allow from all\n"
1229
" AddHandler cgi-script .cgi\n"
1230
"</Directory>\n"
1231
msgstr ""
1232
1233
#: serverguide/C/web-servers.xml:1044(para)
1234
msgid ""
1235
"You should also enable the <application>mod_rewrite</application> module for "
1236
"Apache. To enable <application>mod_rewrite</application> module, please "
1237
"enter the following command in a terminal prompt:"
1238
msgstr ""
1239
1240
#: serverguide/C/web-servers.xml:1050(command)
1241
msgid "sudo a2enmod rewrite"
1242
msgstr "sudo a2enmod rewrite"
1243
1244
#: serverguide/C/web-servers.xml:1053(para)
1245
msgid ""
1246
"Finally you will need to change the ownership of the "
1247
"<filename>/path/to/rails/application/public</filename> and "
1248
"<filename>/path/to/rails/application/tmp</filename> directories to the user "
1249
"used to run the <application>Apache</application> process:"
1250
msgstr ""
1251
1252
#: serverguide/C/web-servers.xml:1059(command)
1253
msgid "sudo chown -R www-data:www-data /path/to/rails/application/public"
1254
msgstr "sudo chown -R www-data:www-data /path/to/rails/application/public"
1255
1256
#: serverguide/C/web-servers.xml:1060(command)
1257
msgid "sudo chown -R www-data:www-data /path/to/rails/application/tmp"
1258
msgstr "sudo chown -R www-data:www-data /path/to/rails/application/tmp"
1259
1260
#: serverguide/C/web-servers.xml:1063(para)
1261
msgid ""
1262
"That's it! Now you have your Server ready for your <application>Ruby on "
1263
"Rails</application> applications."
1264
msgstr ""
1265
1266
#: serverguide/C/web-servers.xml:1072(para)
1267
msgid ""
1268
"See the <ulink url=\"http://rubyonrails.org/\">Ruby on Rails</ulink> website "
1269
"for more information."
1270
msgstr ""
1271
1272
#: serverguide/C/web-servers.xml:1077(para)
1273
msgid ""
1274
"Also <ulink url=\"http://pragprog.com/titles/rails3/agile-web-development-"
1275
"with-rails-third-edition\">Agile Development with Rails</ulink> is a great "
1276
"resource."
1277
msgstr ""
1278
1279
#: serverguide/C/web-servers.xml:1083(para)
1280
msgid ""
1281
"Another place for more information is the <ulink "
1282
"url=\"https://help.ubuntu.com/community/RubyOnRails\">Ruby on Rails Ubuntu "
1283
"Wiki</ulink> page."
1284
msgstr ""
1285
1286
#: serverguide/C/web-servers.xml:1094(title)
1287
msgid "Apache Tomcat"
1288
msgstr "Apache Tomcat"
1289
1290
#: serverguide/C/web-servers.xml:1095(para)
1291
msgid ""
1292
"Apache Tomcat is a web container that allows you to serve Java Servlets and "
1293
"JSP (Java Server Pages) web applications."
1294
msgstr ""
1295
1296
#: serverguide/C/web-servers.xml:1097(para)
1297
msgid ""
1298
"Ubuntu has supported packages for both Tomcat 6 and 7. Tomcat 6 is the "
1299
"legacy version, and Tomcat 7 is the current version where new features are "
1300
"implemented. Both are considered stable. This guide will focus on Tomcat 7, "
1301
"but most configuration details are valid for both versions."
1302
msgstr ""
1303
1304
#: serverguide/C/web-servers.xml:1100(para)
1305
msgid ""
1306
"The Tomcat packages in Ubuntu support two different ways of running Tomcat. "
1307
"You can install them as a classic unique system-wide instance, that will be "
1308
"started at boot time will run as the tomcat7 (or tomcat6) unprivileged user. "
1309
"But you can also deploy private instances that will run with your own user "
1310
"rights, and that you should start and stop by yourself. This second way is "
1311
"particularly useful in a development server context where multiple users "
1312
"need to test on their own private Tomcat instances."
1313
msgstr ""
1314
1315
#: serverguide/C/web-servers.xml:1110(title)
1316
msgid "System-wide installation"
1317
msgstr ""
1318
1319
#: serverguide/C/web-servers.xml:1111(para)
1320
msgid ""
1321
"To install the Tomcat server, you can enter the following command in the "
1322
"terminal prompt:"
1323
msgstr ""
1324
1325
#: serverguide/C/web-servers.xml:1114(command)
1326
msgid "sudo apt install tomcat7"
1327
msgstr ""
1328
1329
#: serverguide/C/web-servers.xml:1116(para)
1330
msgid ""
1331
"This will install a Tomcat server with just a default ROOT webapp that "
1332
"displays a minimal \"It works\" page by default."
1333
msgstr ""
1334
1335
#: serverguide/C/web-servers.xml:1122(para)
1336
msgid ""
1337
"Tomcat configuration files can be found in "
1338
"<filename>/etc/tomcat7</filename>. Only a few common configuration tweaks "
1339
"will be described here, please see <ulink "
1340
"url=\"http://tomcat.apache.org/tomcat-7.0-doc/index.html\">Tomcat 7.0 "
1341
"documentation</ulink> for more."
1342
msgstr ""
1343
1344
#: serverguide/C/web-servers.xml:1128(title)
1345
msgid "Changing default ports"
1346
msgstr ""
1347
1348
#: serverguide/C/web-servers.xml:1129(para)
1349
msgid ""
1350
"By default Tomcat runs a HTTP connector on port 8080 and an AJP connector on "
1351
"port 8009. You might want to change those default ports to avoid conflict "
1352
"with another application on the system. This is done by changing the "
1353
"following lines in <filename>/etc/tomcat7/server.xml</filename>:"
1354
msgstr ""
1355
1356
#: serverguide/C/web-servers.xml:1134(programlisting)
1357
#, no-wrap
1358
msgid ""
1359
"\n"
1360
"<Connector port=\"8080\" protocol=\"HTTP/1.1\" \n"
1361
" connectionTimeout=\"20000\" \n"
1362
" redirectPort=\"8443\" />\n"
1363
"...\n"
1364
"<Connector port=\"8009\" protocol=\"AJP/1.3\" redirectPort=\"8443\" "
1365
"/>\n"
1366
msgstr ""
1367
1368
#: serverguide/C/web-servers.xml:1143(title)
1369
msgid "Changing JVM used"
1370
msgstr ""
1371
1372
#: serverguide/C/web-servers.xml:1144(para)
1373
msgid ""
1374
"By default Tomcat will run preferably with OpenJDK JVMs, then try the Sun "
1375
"JVMs, then try some other JVMs. You can force Tomcat to use a specific JVM "
1376
"by setting JAVA_HOME in <filename>/etc/default/tomcat7</filename>:"
1377
msgstr ""
1378
1379
#: serverguide/C/web-servers.xml:1148(programlisting)
1380
#, no-wrap
1381
msgid ""
1382
"\n"
1383
"JAVA_HOME=/usr/lib/jvm/java-6-sun\n"
1384
msgstr ""
1385
"\n"
1386
"JAVA_HOME=/usr/lib/jvm/java-6-sun\n"
1387
1388
#: serverguide/C/web-servers.xml:1153(title)
1389
msgid "Declaring users and roles"
1390
msgstr ""
1391
1392
#: serverguide/C/web-servers.xml:1154(para)
1393
msgid ""
1394
"Usernames, passwords and roles (groups) can be defined centrally in a "
1395
"Servlet container. This is done in the <filename>/etc/tomcat7/tomcat-"
1396
"users.xml</filename> file:"
1397
msgstr ""
1398
1399
#: serverguide/C/web-servers.xml:1157(programlisting)
1400
#, no-wrap
1401
msgid ""
1402
"\n"
1403
"<role rolename=\"admin\"/>\n"
1404
"<user username=\"tomcat\" password=\"s3cret\" roles=\"admin\"/>\n"
1405
msgstr ""
1406
1407
#: serverguide/C/web-servers.xml:1165(title)
1408
msgid "Using Tomcat standard webapps"
1409
msgstr ""
1410
1411
#: serverguide/C/web-servers.xml:1166(para)
1412
msgid ""
1413
"Tomcat is shipped with webapps that you can install for documentation, "
1414
"administration or demo purposes."
1415
msgstr ""
1416
1417
#: serverguide/C/web-servers.xml:1169(title)
1418
msgid "Tomcat documentation"
1419
msgstr ""
1420
1421
#: serverguide/C/web-servers.xml:1170(para)
1422
msgid ""
1423
"The <application>tomcat7-docs</application> package contains Tomcat "
1424
"documentation, packaged as a webapp that you can access by default at "
1425
"http://yourserver:8080/docs. You can install it by entering the following "
1426
"command in the terminal prompt:"
1427
msgstr ""
1428
1429
#: serverguide/C/web-servers.xml:1175(command)
1430
msgid "sudo apt install tomcat7-docs"
1431
msgstr "sudo apt install tomcat7-docs"
1432
1433
#: serverguide/C/web-servers.xml:1179(title)
1434
msgid "Tomcat administration webapps"
1435
msgstr ""
1436
1437
#: serverguide/C/web-servers.xml:1180(para)
1438
msgid ""
1439
"The <application>tomcat7-admin</application> package contains two webapps "
1440
"that can be used to administer the Tomcat server using a web interface. You "
1441
"can install them by entering the following command in the terminal prompt:"
1442
msgstr ""
1443
1444
#: serverguide/C/web-servers.xml:1185(command)
1445
msgid "sudo apt install tomcat7-admin"
1446
msgstr "sudo apt install tomcat7-admin"
1447
1448
#: serverguide/C/web-servers.xml:1187(para)
1449
msgid ""
1450
"The first one is the <emphasis>manager</emphasis> webapp, which you can "
1451
"access by default at http://yourserver:8080/manager/html. It is primarily "
1452
"used to get server status and restart webapps."
1453
msgstr ""
1454
1455
#: serverguide/C/web-servers.xml:1190(para)
1456
msgid ""
1457
"Access to the <emphasis>manager</emphasis> application is protected by "
1458
"default: you need to define a user with the role \"manager-gui\" in "
1459
"<filename>/etc/tomcat7/tomcat-users.xml</filename> before you can access it."
1460
msgstr ""
1461
1462
#: serverguide/C/web-servers.xml:1194(para)
1463
msgid ""
1464
"The second one is the <emphasis>host-manager</emphasis> webapp, which you "
1465
"can access by default at http://yourserver:8080/host-manager/html. It can be "
1466
"used to create virtual hosts dynamically."
1467
msgstr ""
1468
1469
#: serverguide/C/web-servers.xml:1198(para)
1470
msgid ""
1471
"Access to the <emphasis>host-manager</emphasis> application is also "
1472
"protected by default: you need to define a user with the role \"admin-gui\" "
1473
"in <filename>/etc/tomcat7/tomcat-users.xml</filename> before you can access "
1474
"it."
1475
msgstr ""
1476
1477
#: serverguide/C/web-servers.xml:1203(para)
1478
msgid ""
1479
"For security reasons, the tomcat7 user cannot write to the "
1480
"<filename>/etc/tomcat7</filename> directory by default. Some features in "
1481
"these admin webapps (application deployment, virtual host creation) need "
1482
"write access to that directory. If you want to use these features execute "
1483
"the following, to give users in the tomcat7 group the necessary rights:"
1484
msgstr ""
1485
1486
#: serverguide/C/web-servers.xml:1210(command)
1487
msgid "sudo chgrp -R tomcat7 /etc/tomcat7"
1488
msgstr "sudo chgrp -R tomcat7 /etc/tomcat7"
1489
1490
#: serverguide/C/web-servers.xml:1211(command)
1491
msgid "sudo chmod -R g+w /etc/tomcat7"
1492
msgstr "sudo chmod -R g+w /etc/tomcat7"
1493
1494
#: serverguide/C/web-servers.xml:1216(title)
1495
msgid "Tomcat examples webapps"
1496
msgstr ""
1497
1498
#: serverguide/C/web-servers.xml:1217(para)
1499
msgid ""
1500
"The <application>tomcat7-examples</application> package contains two webapps "
1501
"that can be used to test or demonstrate Servlets and JSP features, which you "
1502
"can access them by default at http://yourserver:8080/examples. You can "
1503
"install them by entering the following command in the terminal prompt:"
1504
msgstr ""
1505
1506
#: serverguide/C/web-servers.xml:1223(command)
1507
msgid "sudo apt install tomcat7-examples"
1508
msgstr "sudo apt install tomcat7-examples"
1509
1510
#: serverguide/C/web-servers.xml:1229(title)
1511
msgid "Using private instances"
1512
msgstr ""
1513
1514
#: serverguide/C/web-servers.xml:1230(para)
1515
msgid ""
1516
"Tomcat is heavily used in development and testing scenarios where using a "
1517
"single system-wide instance doesn't meet the requirements of multiple users "
1518
"on a single system. The Tomcat packages in Ubuntu come with tools to help "
1519
"deploy your own user-oriented instances, allowing every user on a system to "
1520
"run (without root rights) separate private instances while still using the "
1521
"system-installed libraries."
1522
msgstr ""
1523
1524
#: serverguide/C/web-servers.xml:1237(para)
1525
msgid ""
1526
"It is possible to run the system-wide instance and the private instances in "
1527
"parallel, as long as they do not use the same TCP ports."
1528
msgstr ""
1529
1530
#: serverguide/C/web-servers.xml:1241(title)
1531
msgid "Installing private instance support"
1532
msgstr ""
1533
1534
#: serverguide/C/web-servers.xml:1242(para)
1535
msgid ""
1536
"You can install everything necessary to run private instances by entering "
1537
"the following command in the terminal prompt:"
1538
msgstr ""
1539
1540
#: serverguide/C/web-servers.xml:1245(command)
1541
msgid "sudo apt install tomcat7-user"
1542
msgstr "sudo apt install tomcat7-user"
1543
1544
#: serverguide/C/web-servers.xml:1249(title)
1545
msgid "Creating a private instance"
1546
msgstr ""
1547
1548
#: serverguide/C/web-servers.xml:1250(para)
1549
msgid ""
1550
"You can create a private instance directory by entering the following "
1551
"command in the terminal prompt:"
1552
msgstr ""
1553
1554
#: serverguide/C/web-servers.xml:1253(command)
1555
msgid "tomcat7-instance-create my-instance"
1556
msgstr ""
1557
1558
#: serverguide/C/web-servers.xml:1255(para)
1559
msgid ""
1560
"This will create a new <filename>my-instance</filename> directory with all "
1561
"the necessary subdirectories and scripts. You can for example install your "
1562
"common libraries in the <filename>lib/</filename> subdirectory and deploy "
1563
"your webapps in the <filename>webapps/</filename> subdirectory. No webapps "
1564
"are deployed by default."
1565
msgstr ""
1566
1567
#: serverguide/C/web-servers.xml:1263(title)
1568
msgid "Configuring your private instance"
1569
msgstr ""
1570
1571
#: serverguide/C/web-servers.xml:1264(para)
1572
msgid ""
1573
"You will find the classic Tomcat configuration files for your private "
1574
"instance in the <filename>conf/</filename> subdirectory. You should for "
1575
"example certainly edit the <filename>conf/server.xml</filename> file to "
1576
"change the default ports used by your private Tomcat instance to avoid "
1577
"conflict with other instances that might be running."
1578
msgstr ""
1579
1580
#: serverguide/C/web-servers.xml:1272(title)
1581
msgid "Starting/stopping your private instance"
1582
msgstr ""
1583
1584
#: serverguide/C/web-servers.xml:1273(para)
1585
msgid ""
1586
"You can start your private instance by entering the following command in the "
1587
"terminal prompt (supposing your instance is located in the <filename>my-"
1588
"instance</filename> directory):"
1589
msgstr ""
1590
1591
#: serverguide/C/web-servers.xml:1277(command)
1592
msgid "my-instance/bin/startup.sh"
1593
msgstr "my-instance/bin/startup.sh"
1594
1595
#: serverguide/C/web-servers.xml:1279(para)
1596
msgid ""
1597
"You should check the <filename>logs/</filename> subdirectory for any error. "
1598
"If you have a <emphasis>java.net.BindException: Address already in "
1599
"use<null>:8080</emphasis> error, it means that the port you're using "
1600
"is already taken and that you should change it."
1601
msgstr ""
1602
1603
#: serverguide/C/web-servers.xml:1284(para)
1604
msgid ""
1605
"You can stop your instance by entering the following command in the terminal "
1606
"prompt (supposing your instance is located in the <filename>my-"
1607
"instance</filename> directory):"
1608
msgstr ""
1609
1610
#: serverguide/C/web-servers.xml:1288(command)
1611
msgid "my-instance/bin/shutdown.sh"
1612
msgstr "my-instance/bin/shutdown.sh"
1613
1614
#: serverguide/C/web-servers.xml:1297(para)
1615
msgid ""
1616
"See the <ulink url=\"http://tomcat.apache.org/\">Apache Tomcat</ulink> "
1617
"website for more information."
1618
msgstr ""
1619
1620
#: serverguide/C/web-servers.xml:1302(para)
1621
msgid ""
1622
"<ulink url=\"http://shop.oreilly.com/product/9780596003180.do\">Tomcat: The "
1623
"Definitive Guide</ulink> is a good resource for building web applications "
1624
"with Tomcat."
1625
msgstr ""
1626
1627
#: serverguide/C/web-servers.xml:1308(para)
1628
msgid ""
1629
"For additional books see the <ulink "
1630
"url=\"http://wiki.apache.org/tomcat/Tomcat/Books\">Tomcat Books</ulink> list "
1631
"page."
1632
msgstr ""
1633
1634
#: serverguide/C/vpn.xml:11(title)
1635
msgid "VPN"
1636
msgstr "VPN"
1637
1638
#: serverguide/C/vpn.xml:13(para)
1639
msgid ""
1640
"OpenVPN is a Virtual Private Networking (VPN) solution provided in the "
1641
"Ubuntu Repositories. It is flexible, reliable and secure. It belongs to the "
1642
"family of SSL/TLS VPN stacks (different from IPSec VPNs). This chapter will "
1643
"cover installing and configuring <application>OpenVPN</application> to "
1644
"create a VPN."
1645
msgstr ""
1646
1647
#: serverguide/C/vpn.xml:19(title)
1648
msgid "OpenVPN"
1649
msgstr "OpenVPN"
1650
1651
#: serverguide/C/vpn.xml:21(para)
1652
msgid ""
1653
"If you want more than just pre-shared keys "
1654
"<application>OpenVPN</application> makes it easy to setup and use a Public "
1655
"Key Infrastructure (PKI) to use SSL/TLS certificates for authentication and "
1656
"key exchange between the VPN server and clients. "
1657
"<application>OpenVPN</application> can be used in a routed or bridged VPN "
1658
"mode and can be configured to use either UDP or TCP. The port number can be "
1659
"configured as well, but port 1194 is the official one. And it is only using "
1660
"that single port for all communication. VPN client implementations are "
1661
"available for almost anything including all Linux distributions, OS X, "
1662
"Windows and OpenWRT based WLAN routers."
1663
msgstr ""
1664
1665
#: serverguide/C/vpn.xml:29(title)
1666
msgid "Server Installation"
1667
msgstr ""
1668
1669
#: serverguide/C/vpn.xml:31(para)
1670
msgid "To install <application>openvpn</application> in a terminal enter:"
1671
msgstr ""
1672
1673
#: serverguide/C/vpn.xml:35(command)
1674
msgid "sudo apt install openvpn easy-rsa"
1675
msgstr "sudo apt install openvpn easy-rsa"
1676
1677
#: serverguide/C/vpn.xml:40(title)
1678
msgid "Public Key Infrastructure Setup"
1679
msgstr ""
1680
1681
#: serverguide/C/vpn.xml:42(para)
1682
msgid ""
1683
"The first step in building an OpenVPN configuration is to establish a PKI "
1684
"(public key infrastructure). The PKI consists of:"
1685
msgstr ""
1686
1687
#: serverguide/C/vpn.xml:47(para)
1688
msgid ""
1689
"a separate certificate (also known as a public key) and private key for the "
1690
"server and each client, and"
1691
msgstr ""
1692
1693
#: serverguide/C/vpn.xml:50(para)
1694
msgid ""
1695
"a master Certificate Authority (CA) certificate and key which is used to "
1696
"sign each of the server and client certificates."
1697
msgstr ""
1698
1699
#: serverguide/C/vpn.xml:55(para)
1700
msgid ""
1701
"OpenVPN supports bidirectional authentication based on certificates, meaning "
1702
"that the client must authenticate the server certificate and the server must "
1703
"authenticate the client certificate before mutual trust is established."
1704
msgstr ""
1705
1706
#: serverguide/C/vpn.xml:59(para)
1707
msgid ""
1708
"Both server and client will authenticate the other by first verifying that "
1709
"the presented certificate was signed by the master certificate authority "
1710
"(CA), and then by testing information in the now-authenticated certificate "
1711
"header, such as the certificate common name or certificate type (client or "
1712
"server)."
1713
msgstr ""
1714
1715
#: serverguide/C/vpn.xml:64(title)
1716
msgid "Certificate Authority Setup"
1717
msgstr ""
1718
1719
#: serverguide/C/vpn.xml:66(para)
1720
msgid ""
1721
"To setup your own Certificate Authority (CA) and generating certificates and "
1722
"keys for an OpenVPN server and multiple clients first copy the "
1723
"<filename>easy-rsa</filename> directory to "
1724
"<filename>/etc/openvpn</filename>. This will ensure that any changes to the "
1725
"scripts will not be lost when the package is updated. From a terminal change "
1726
"to user root and:"
1727
msgstr ""
1728
1729
#: serverguide/C/vpn.xml:74(command)
1730
msgid "mkdir /etc/openvpn/easy-rsa/"
1731
msgstr "mkdir /etc/openvpn/easy-rsa/"
1732
1733
#: serverguide/C/vpn.xml:75(command)
1734
msgid "cp -r /usr/share/easy-rsa/* /etc/openvpn/easy-rsa/"
1735
msgstr "cp -r /usr/share/easy-rsa/* /etc/openvpn/easy-rsa/"
1736
1737
#: serverguide/C/vpn.xml:78(para)
1738
msgid ""
1739
"Next, edit <filename>/etc/openvpn/easy-rsa/vars</filename> adjusting the "
1740
"following to your environment:"
1741
msgstr ""
1742
1743
#: serverguide/C/vpn.xml:82(programlisting)
1744
#, no-wrap
1745
msgid ""
1746
"\n"
1747
"export KEY_COUNTRY=\"US\"\n"
1748
"export KEY_PROVINCE=\"NC\"\n"
1749
"export KEY_CITY=\"Winston-Salem\"\n"
1750
"export KEY_ORG=\"Example Company\"\n"
1751
"export KEY_EMAIL=\"steve@example.com\"\n"
1752
"export KEY_CN=MyVPN\n"
1753
"export KEY_ALTNAMES=AltMyVPN\n"
1754
"export KEY_NAME=MyVPN\n"
1755
"export KEY_OU=MyVPN\n"
1756
"\n"
1757
"\n"
1758
msgstr ""
1759
1760
#: serverguide/C/vpn.xml:96(para)
1761
msgid ""
1762
"Enter the following to generate the master Certificate Authority (CA) "
1763
"certificate and key:"
1764
msgstr ""
1765
1766
#: serverguide/C/vpn.xml:101(command) serverguide/C/vpn.xml:149(command)
1767
msgid "cd /etc/openvpn/easy-rsa/"
1768
msgstr "cd /etc/openvpn/easy-rsa/"
1769
1770
#: serverguide/C/vpn.xml:102(command) serverguide/C/vpn.xml:150(command)
1771
msgid "source vars"
1772
msgstr "source vars"
1773
1774
#: serverguide/C/vpn.xml:103(command)
1775
msgid "./clean-all"
1776
msgstr "./clean-all"
1777
1778
#: serverguide/C/vpn.xml:104(command)
1779
msgid "./build-ca"
1780
msgstr "./build-ca"
1781
1782
#: serverguide/C/vpn.xml:109(title)
1783
msgid "Server Certificates"
1784
msgstr ""
1785
1786
#: serverguide/C/vpn.xml:111(para)
1787
msgid "Next, we will generate a certificate and private key for the server:"
1788
msgstr ""
1789
1790
#: serverguide/C/vpn.xml:116(command)
1791
msgid "./build-key-server myservername"
1792
msgstr "./build-key-server myservername"
1793
1794
#: serverguide/C/vpn.xml:119(para)
1795
msgid ""
1796
"As in the previous step, most parameters can be defaulted. Two other queries "
1797
"require positive responses, \"Sign the certificate? [y/n]\" and \"1 out of 1 "
1798
"certificate requests certified, commit? [y/n]\"."
1799
msgstr ""
1800
1801
#: serverguide/C/vpn.xml:123(para)
1802
msgid "Diffie Hellman parameters must be generated for the OpenVPN server:"
1803
msgstr ""
1804
1805
#: serverguide/C/vpn.xml:128(command)
1806
msgid "./build-dh"
1807
msgstr "./build-dh"
1808
1809
#: serverguide/C/vpn.xml:131(para)
1810
msgid ""
1811
"All certificates and keys have been generated in the subdirectory keys/. "
1812
"Common practice is to copy them to /etc/openvpn/:"
1813
msgstr ""
1814
1815
#: serverguide/C/vpn.xml:135(command)
1816
msgid "cd keys/"
1817
msgstr "cd keys/"
1818
1819
#: serverguide/C/vpn.xml:136(command)
1820
msgid "cp myservername.crt myservername.key ca.crt dh2048.pem /etc/openvpn/"
1821
msgstr ""
1822
1823
#: serverguide/C/vpn.xml:141(title)
1824
msgid "Client Certificates"
1825
msgstr ""
1826
1827
#: serverguide/C/vpn.xml:143(para)
1828
msgid ""
1829
"The VPN client will also need a certificate to authenticate itself to the "
1830
"server. Usually you create a different certificate for each client. To "
1831
"create the certificate, enter the following in a terminal while being user "
1832
"root:"
1833
msgstr ""
1834
1835
#: serverguide/C/vpn.xml:151(command)
1836
msgid "./build-key client1"
1837
msgstr "./build-key client1"
1838
1839
#: serverguide/C/vpn.xml:154(para)
1840
msgid "Copy the following files to the client using a secure method:"
1841
msgstr ""
1842
1843
#: serverguide/C/vpn.xml:159(para)
1844
msgid "/etc/openvpn/ca.crt"
1845
msgstr "/etc/openvpn/ca.crt"
1846
1847
#: serverguide/C/vpn.xml:160(para)
1848
msgid "/etc/openvpn/easy-rsa/keys/client1.crt"
1849
msgstr "/etc/openvpn/easy-rsa/keys/client1.crt"
1850
1851
#: serverguide/C/vpn.xml:161(para)
1852
msgid "/etc/openvpn/easy-rsa/keys/client1.key"
1853
msgstr "/etc/openvpn/easy-rsa/keys/client1.key"
1854
1855
#: serverguide/C/vpn.xml:164(para)
1856
msgid ""
1857
"As the client certificates and keys are only required on the client machine, "
1858
"you should remove them from the server."
1859
msgstr ""
1860
1861
#: serverguide/C/vpn.xml:172(title)
1862
msgid "Simple Server Configuration"
1863
msgstr ""
1864
1865
#: serverguide/C/vpn.xml:174(para)
1866
msgid ""
1867
"Along with your <application>OpenVPN</application> installation you got "
1868
"these sample config files (and many more if if you check):"
1869
msgstr ""
1870
1871
#: serverguide/C/vpn.xml:178(programlisting)
1872
#, no-wrap
1873
msgid ""
1874
"\n"
1875
"root@server:/# ls -l /usr/share/doc/openvpn/examples/sample-config-files/\n"
1876
"total 68\n"
1877
"-rw-r--r-- 1 root root 3427 2011-07-04 15:09 client.conf\n"
1878
"-rw-r--r-- 1 root root 4141 2011-07-04 15:09 server.conf.gz\n"
1879
msgstr ""
1880
"\n"
1881
"root@server:/# ls -l /usr/share/doc/openvpn/examples/sample-config-files/\n"
1882
"total 68\n"
1883
"-rw-r--r-- 1 root root 3427 2011-07-04 15:09 client.conf\n"
1884
"-rw-r--r-- 1 root root 4141 2011-07-04 15:09 server.conf.gz\n"
1885
1886
#: serverguide/C/vpn.xml:185(para)
1887
msgid ""
1888
"Start with copying and unpacking server.conf.gz to /etc/openvpn/server.conf."
1889
msgstr ""
1890
1891
#: serverguide/C/vpn.xml:189(command)
1892
msgid ""
1893
"sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz "
1894
"/etc/openvpn/"
1895
msgstr ""
1896
"sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz "
1897
"/etc/openvpn/"
1898
1899
#: serverguide/C/vpn.xml:190(command)
1900
msgid "sudo gzip -d /etc/openvpn/server.conf.gz"
1901
msgstr "sudo gzip -d /etc/openvpn/server.conf.gz"
1902
1903
#: serverguide/C/vpn.xml:193(para)
1904
msgid ""
1905
"Edit <filename>/etc/openvpn/server.conf</filename> to make sure the "
1906
"following lines are pointing to the certificates and keys you created in the "
1907
"section above."
1908
msgstr ""
1909
1910
#: serverguide/C/vpn.xml:196(programlisting)
1911
#, no-wrap
1912
msgid ""
1913
"\n"
1914
"ca ca.crt\n"
1915
"cert myservername.crt\n"
1916
"key myservername.key\n"
1917
"dh dh2048.pem\n"
1918
msgstr ""
1919
1920
#: serverguide/C/vpn.xml:203(para)
1921
msgid ""
1922
"Edit <filename>/etc/sysctl.conf</filename> and uncomment the following line "
1923
"to enable IP forwarding."
1924
msgstr ""
1925
1926
#: serverguide/C/vpn.xml:204(programlisting)
1927
#, no-wrap
1928
msgid ""
1929
"\n"
1930
"#net.ipv4.ip_forward=1\n"
1931
msgstr ""
1932
"\n"
1933
"#net.ipv4.ip_forward=1\n"
1934
1935
#: serverguide/C/vpn.xml:207(para)
1936
msgid "Then reload sysctl."
1937
msgstr ""
1938
1939
#: serverguide/C/vpn.xml:209(command)
1940
msgid "sudo sysctl -p /etc/sysctl.conf"
1941
msgstr "sudo sysctl -p /etc/sysctl.conf"
1942
1943
#: serverguide/C/vpn.xml:212(para)
1944
msgid ""
1945
"That is the minimum you have to configure to get a working OpenVPN server. "
1946
"You can use all the default settings in the sample server.conf file. Now "
1947
"start the server. You will find logging and error messages in your via "
1948
"journal. Dependin on what you look for:"
1949
msgstr ""
1950
1951
#: serverguide/C/vpn.xml:218(command)
1952
msgid "sudo journalctl -xe"
1953
msgstr "sudo journalctl -xe"
1954
1955
#: serverguide/C/vpn.xml:220(para)
1956
msgid ""
1957
"If you started a templatized service openvpn@server you can filter for this "
1958
"particular message source with:"
1959
msgstr ""
1960
1961
#: serverguide/C/vpn.xml:224(command)
1962
msgid "sudo journalctl --identifier ovpn-server"
1963
msgstr "sudo journalctl --identifier ovpn-server"
1964
1965
#: serverguide/C/vpn.xml:227(para)
1966
msgid ""
1967
"Be aware that the \"systemctl start openvpn\" is not starting your openvpn "
1968
"you just defined. Openvpn uses templatized systemd jobs, "
1969
"openvpn@CONFIGFILENAME. So if for example your configuration file is "
1970
"\"server.conf\" your service is called openvpn@server. You can run all kind "
1971
"of service and systemctl commands like start/stop/enable/disable/preset "
1972
"against a templatized service like openvpn@server."
1973
msgstr ""
1974
1975
#: serverguide/C/vpn.xml:234(programlisting)
1976
#, no-wrap
1977
msgid ""
1978
"\n"
1979
"ubuntu@testopenvpn-server:~$ sudo systemctl start openvpn@server\n"
1980
"\n"
1981
"ubuntu@testopenvpn-server:~$ sudo systemctl status openvpn@server\n"
1982
". openvpn@server.service - OpenVPN connection to server\n"
1983
"Loaded: loaded (/lib/systemd/system/openvpn@.service; enabled; vendor "
1984
"preset: enabled)\n"
1985
" Active: active (running) since Tue 2016-04-12 08:51:14 UTC; 1s ago\n"
1986
" Docs: man:openvpn(8)\n"
1987
" https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage\n"
1988
" https://community.openvpn.net/openvpn/wiki/HOWTO\n"
1989
" Process: 1573 ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status "
1990
"/run/openvpn/%i.status 10 --cd /etc/openvpn --script-security 2 --config "
1991
"/etc/openvpn/%i.conf --writep\n"
1992
" Main PID: 1575 (openvpn)\n"
1993
" Tasks: 1 (limit: 512)\n"
1994
" CGroup: /system.slice/system-openvpn.slice/openvpn@server.service\n"
1995
" |-1575 /usr/sbin/openvpn --daemon ovpn-server --status "
1996
"/run/openvpn/server.status 10 --cd /etc/openvpn --script-security 2 --config "
1997
"/etc/openvpn/server.conf --wr\n"
1998
"\n"
1999
"Apr 12 08:51:14 testopenvpn-server ovpn-server[1575]: /sbin/ip route add "
2000
"10.8.0.0/24 via 10.8.0.2\n"
2001
"Apr 12 08:51:14 testopenvpn-server ovpn-server[1575]: UDPv4 link local "
2002
"(bound): [undef]\n"
2003
"Apr 12 08:51:14 testopenvpn-server ovpn-server[1575]: UDPv4 link remote: "
2004
"[undef]\n"
2005
"Apr 12 08:51:14 testopenvpn-server ovpn-server[1575]: MULTI: multi_init "
2006
"called, r=256 v=256\n"
2007
"Apr 12 08:51:14 testopenvpn-server ovpn-server[1575]: IFCONFIG POOL: "
2008
"base=10.8.0.4 size=62, ipv6=0\n"
2009
"Apr 12 08:51:14 testopenvpn-server ovpn-server[1575]: ifconfig_pool_read(), "
2010
"in='client1,10.8.0.4', TODO: IPv6\n"
2011
"Apr 12 08:51:14 testopenvpn-server ovpn-server[1575]: succeeded -> "
2012
"ifconfig_pool_set()\n"
2013
"Apr 12 08:51:14 testopenvpn-server ovpn-server[1575]: IFCONFIG POOL LIST\n"
2014
"Apr 12 08:51:14 testopenvpn-server ovpn-server[1575]: client1,10.8.0.4\n"
2015
"Apr 12 08:51:14 testopenvpn-server ovpn-server[1575]: Initialization "
2016
"Sequence Completed\n"
2017
msgstr ""
2018
2019
#: serverguide/C/vpn.xml:262(para)
2020
msgid ""
2021
"You can enable/disable various openvpn services on one system, but you could "
2022
"also let Ubuntu do the heavy lifting. There is config for AUTOSTART in "
2023
"/etc/default/openvpn. Allowed values are \"all\", \"none\" or space "
2024
"separated list of names of the VPNs. If empty, \"all\" is assumed. The VPN "
2025
"name refers to the VPN configutation file name. i.e. \"home\" would be "
2026
"/etc/openvpn/home.conf If you're running systemd, changing this variable "
2027
"will require running \"systemctl daemon-reload\" followed by a restart of "
2028
"the openvpn service (if you removed entries you may have to stop those "
2029
"manually) After \"systemctl daemon-reload\" a restart of the \"generic\" "
2030
"openvon will restart all dependent services that the generator in "
2031
"/lib/systemd/system-generators/openvpn-generator created for your conf files "
2032
"when you called daemon-reload."
2033
msgstr ""
2034
2035
#: serverguide/C/vpn.xml:281(para)
2036
msgid ""
2037
"That is the minimum you have to configure to get a working OpenVPN server. "
2038
"You can use all the default settings in the sample server.conf file. Now "
2039
"start the server. You will find logging and error messages in your journal."
2040
msgstr ""
2041
2042
#: serverguide/C/vpn.xml:286(para)
2043
msgid "Now check if OpenVPN created a tun0 interface:"
2044
msgstr ""
2045
2046
#: serverguide/C/vpn.xml:290(programlisting)
2047
#, no-wrap
2048
msgid ""
2049
"\n"
2050
"root@server:/etc/openvpn# ifconfig tun0\n"
2051
"tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-"
2052
"00-00-00\n"
2053
" inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255\n"
2054
" UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1\n"
2055
"[...]\n"
2056
msgstr ""
2057
"\n"
2058
"root@server:/etc/openvpn# ifconfig tun0\n"
2059
"tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-"
2060
"00-00-00\n"
2061
" inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255\n"
2062
" UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1\n"
2063
"[...]\n"
2064
2065
#: serverguide/C/vpn.xml:300(title)
2066
msgid "Simple Client Configuration"
2067
msgstr ""
2068
2069
#: serverguide/C/vpn.xml:302(para)
2070
msgid ""
2071
"There are various different <application>OpenVPN</application> client "
2072
"implementations with and without GUIs. You can read more about clients in a "
2073
"later section. For now we use the <application>OpenVPN</application> client "
2074
"for Ubuntu which is the same executable as the server. So you have to "
2075
"install the openvpn package again on the client machine:"
2076
msgstr ""
2077
2078
#: serverguide/C/vpn.xml:309(command) serverguide/C/vpn.xml:698(command)
2079
msgid "sudo apt install openvpn"
2080
msgstr "sudo apt install openvpn"
2081
2082
#: serverguide/C/vpn.xml:312(para)
2083
msgid "This time copy the client.conf sample config file to /etc/openvpn/."
2084
msgstr ""
2085
2086
#: serverguide/C/vpn.xml:316(command)
2087
msgid ""
2088
"sudo cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf "
2089
"/etc/openvpn/"
2090
msgstr ""
2091
2092
#: serverguide/C/vpn.xml:319(para)
2093
msgid ""
2094
"Copy the client keys and the certificate of the CA you created in the "
2095
"section above to e.g. /etc/openvpn/ and edit "
2096
"<filename>/etc/openvpn/client.conf</filename> to make sure the following "
2097
"lines are pointing to those files. If you have the files in /etc/openvpn/ "
2098
"you can omit the path."
2099
msgstr ""
2100
2101
#: serverguide/C/vpn.xml:322(programlisting) serverguide/C/vpn.xml:342(programlisting)
2102
#, no-wrap
2103
msgid ""
2104
"\n"
2105
"ca ca.crt\n"
2106
"cert client1.crt\n"
2107
"key client1.key\n"
2108
msgstr ""
2109
"\n"
2110
"ca ca.crt\n"
2111
"cert client1.crt\n"
2112
"key client1.key\n"
2113
2114
#: serverguide/C/vpn.xml:328(para)
2115
msgid ""
2116
"And you have to at least specify the OpenVPN server name or address. Make "
2117
"sure the keyword client is in the config. That's what enables client mode."
2118
msgstr ""
2119
2120
#: serverguide/C/vpn.xml:334(programlisting)
2121
#, no-wrap
2122
msgid ""
2123
"\n"
2124
"client\n"
2125
"remote vpnserver.example.com 1194\n"
2126
msgstr ""
2127
"\n"
2128
"client\n"
2129
"remote vpnserver.example.com 1194\n"
2130
2131
#: serverguide/C/vpn.xml:339(para)
2132
msgid ""
2133
"Also, make sure you specify the keyfile names you copied from the server"
2134
msgstr ""
2135
2136
#: serverguide/C/vpn.xml:347(para)
2137
msgid "Now start the OpenVPN client:"
2138
msgstr ""
2139
2140
#: serverguide/C/vpn.xml:351(programlisting)
2141
#, no-wrap
2142
msgid ""
2143
"\n"
2144
"ubuntu@testopenvpn-client:~$ sudo systemctl start openvpn@client\n"
2145
"ubuntu@testopenvpn-client:~$ sudo systemctl status openvpn@client\n"
2146
". openvpn@client.service - OpenVPN connection to client\n"
2147
" Loaded: loaded (/lib/systemd/system/openvpn@.service; disabled; vendor "
2148
"preset: enabled)\n"
2149
" Active: active (running) since Tue 2016-04-12 08:50:50 UTC; 3s ago\n"
2150
" Docs: man:openvpn(8)\n"
2151
" https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage\n"
2152
" https://community.openvpn.net/openvpn/wiki/HOWTO\n"
2153
" Process: 1677 ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status "
2154
"/run/openvpn/%i.status 10 --cd /etc/openvpn --script-security 2 --config "
2155
"/etc/openvpn/%i.conf --writep\n"
2156
"Main PID: 1679 (openvpn)\n"
2157
" Tasks: 1 (limit: 512)\n"
2158
" CGroup: /system.slice/system-openvpn.slice/openvpn@client.service\n"
2159
" |-1679 /usr/sbin/openvpn --daemon ovpn-client --status "
2160
"/run/openvpn/client.status 10 --cd /etc/openvpn --script-security 2 --config "
2161
"/etc/openvpn/client.conf --wr\n"
2162
"\n"
2163
"Apr 12 08:50:52 testopenvpn-client ovpn-client[1679]: OPTIONS IMPORT: --"
2164
"ifconfig/up options modified\n"
2165
"Apr 12 08:50:52 testopenvpn-client ovpn-client[1679]: OPTIONS IMPORT: route "
2166
"options modified\n"
2167
"Apr 12 08:50:52 testopenvpn-client ovpn-client[1679]: ROUTE_GATEWAY "
2168
"192.168.122.1/255.255.255.0 IFACE=eth0 HWADDR=52:54:00:89:ca:89\n"
2169
"Apr 12 08:50:52 testopenvpn-client ovpn-client[1679]: TUN/TAP device tun0 "
2170
"opened\n"
2171
"Apr 12 08:50:52 testopenvpn-client ovpn-client[1679]: TUN/TAP TX queue "
2172
"length set to 100\n"
2173
"Apr 12 08:50:52 testopenvpn-client ovpn-client[1679]: do_ifconfig, tt-"
2174
">ipv6=0, tt->did_ifconfig_ipv6_setup=0\n"
2175
"Apr 12 08:50:52 testopenvpn-client ovpn-client[1679]: /sbin/ip link set dev "
2176
"tun0 up mtu 1500\n"
2177
"Apr 12 08:50:52 testopenvpn-client ovpn-client[1679]: /sbin/ip addr add dev "
2178
"tun0 local 10.8.0.6 peer 10.8.0.5\n"
2179
"Apr 12 08:50:52 testopenvpn-client ovpn-client[1679]: /sbin/ip route add "
2180
"10.8.0.1/32 via 10.8.0.5\n"
2181
"Apr 12 08:50:52 testopenvpn-client ovpn-client[1679]: Initialization "
2182
"Sequence Completed\n"
2183
msgstr ""
2184
2185
#: serverguide/C/vpn.xml:378(para)
2186
msgid "Check if it created a tun0 interface:"
2187
msgstr ""
2188
2189
#: serverguide/C/vpn.xml:382(programlisting)
2190
#, no-wrap
2191
msgid ""
2192
"\n"
2193
"root@client:/etc/openvpn# ifconfig tun0\n"
2194
"tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-"
2195
"00-00-00 \n"
2196
" inet addr:10.8.0.6 P-t-P:10.8.0.5 Mask:255.255.255.255\n"
2197
" UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1\n"
2198
msgstr ""
2199
2200
#: serverguide/C/vpn.xml:389(para)
2201
msgid "Check if you can ping the OpenVPN server:"
2202
msgstr ""
2203
2204
#: serverguide/C/vpn.xml:392(programlisting)
2205
#, no-wrap
2206
msgid ""
2207
"\n"
2208
"root@client:/etc/openvpn# ping 10.8.0.1\n"
2209
"PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.\n"
2210
"64 bytes from 10.8.0.1: icmp_req=1 ttl=64 time=0.920 ms\n"
2211
msgstr ""
2212
2213
#: serverguide/C/vpn.xml:399(para)
2214
msgid ""
2215
"The OpenVPN server always uses the first usable IP address in the client "
2216
"network and only that IP is pingable. E.g. if you configured a /24 for the "
2217
"client network mask, the .1 address will be used. The P-t-P address you see "
2218
"in the ifconfig output above is usually not answering ping requests."
2219
msgstr ""
2220
2221
#: serverguide/C/vpn.xml:404(para)
2222
msgid "Check out your routes:"
2223
msgstr ""
2224
2225
#: serverguide/C/vpn.xml:407(programlisting)
2226
#, no-wrap
2227
msgid ""
2228
"\n"
2229
"root@client:/etc/openvpn# netstat -rn\n"
2230
"Kernel IP routing table\n"
2231
"Destination Gateway Genmask Flags MSS Window irtt "
2232
"Iface\n"
2233
"10.8.0.5 0.0.0.0 255.255.255.255 UH 0 0 0 "
2234
"tun0\n"
2235
"10.8.0.1 10.8.0.5 255.255.255.255 UGH 0 0 0 "
2236
"tun0\n"
2237
"192.168.42.0 0.0.0.0 255.255.255.0 U 0 0 0 "
2238
"eth0\n"
2239
"0.0.0.0 192.168.42.1 0.0.0.0 UG 0 0 0 "
2240
"eth0\n"
2241
msgstr ""
2242
2243
#: serverguide/C/vpn.xml:419(title)
2244
msgid "First trouble shooting"
2245
msgstr ""
2246
2247
#: serverguide/C/vpn.xml:421(para)
2248
msgid "If the above didn't work for you, check this:"
2249
msgstr ""
2250
2251
#: serverguide/C/vpn.xml:426(para)
2252
msgid ""
2253
"Check your journal, e.g. journalctl --identifier ovpn-server (for "
2254
"server.conf)"
2255
msgstr ""
2256
2257
#: serverguide/C/vpn.xml:429(para)
2258
msgid ""
2259
"Check that you have specified the keyfile names correctly in client.conf and "
2260
"server.conf."
2261
msgstr ""
2262
2263
#: serverguide/C/vpn.xml:432(para)
2264
msgid ""
2265
"Can the client connect to the server machine? Maybe a firewall is blocking "
2266
"access? Check journal on server."
2267
msgstr ""
2268
2269
#: serverguide/C/vpn.xml:435(para)
2270
msgid ""
2271
"Client and server must use same protocol and port, e.g. UDP port 1194, see "
2272
"port and proto config option"
2273
msgstr ""
2274
2275
#: serverguide/C/vpn.xml:438(para)
2276
msgid ""
2277
"Client and server must use same config regarding compression, see comp-lzo "
2278
"config option"
2279
msgstr ""
2280
2281
#: serverguide/C/vpn.xml:441(para)
2282
msgid ""
2283
"Client and server must use same config regarding bridged vs routed mode, see "
2284
"server vs server-bridge config option"
2285
msgstr ""
2286
2287
#: serverguide/C/vpn.xml:448(title) serverguide/C/databases.xml:161(title)
2288
msgid "Advanced configuration"
2289
msgstr ""
2290
2291
#: serverguide/C/vpn.xml:451(title)
2292
msgid "Advanced routed VPN configuration on server"
2293
msgstr ""
2294
2295
#: serverguide/C/vpn.xml:453(para)
2296
msgid ""
2297
"The above is a very simple working VPN. The client can access services on "
2298
"the VPN server machine through an encrypted tunnel. If you want to reach "
2299
"more servers or anything in other networks, push some routes to the clients. "
2300
"E.g. if your company's network can be summarized to the network "
2301
"192.168.0.0/16, you could push this route to the clients. But you will also "
2302
"have to change the routing for the way back - your servers need to know a "
2303
"route to the VPN client-network."
2304
msgstr ""
2305
2306
#: serverguide/C/vpn.xml:457(para)
2307
msgid ""
2308
"Or you might push a default gateway to all the clients to send all their "
2309
"internet traffic to the VPN gateway first and from there via the company "
2310
"firewall into the internet. This section shows you some possible options."
2311
msgstr ""
2312
2313
#: serverguide/C/vpn.xml:461(para)
2314
msgid ""
2315
"Push routes to the client to allow it to reach other private subnets behind "
2316
"the server. Remember that these private subnets will also need to know to "
2317
"route the OpenVPN client address pool (10.8.0.0/24) back to the OpenVPN "
2318
"server."
2319
msgstr ""
2320
2321
#: serverguide/C/vpn.xml:470(programlisting)
2322
#, no-wrap
2323
msgid ""
2324
"\n"
2325
"push \"route 10.0.0.0 255.0.0.0\"\n"
2326
msgstr ""
2327
"\n"
2328
"push \"route 10.0.0.0 255.0.0.0\"\n"
2329
2330
#: serverguide/C/vpn.xml:474(para)
2331
msgid ""
2332
"If enabled, this directive will configure all clients to redirect their "
2333
"default network gateway through the VPN, causing all IP traffic such as web "
2334
"browsing and DNS lookups to go through the VPN (the OpenVPN server machine "
2335
"or your central firewall may need to NAT the TUN/TAP interface to the "
2336
"internet in order for this to work properly)."
2337
msgstr ""
2338
2339
#: serverguide/C/vpn.xml:483(programlisting)
2340
#, no-wrap
2341
msgid ""
2342
"\n"
2343
"push \"redirect-gateway def1 bypass-dhcp\"\n"
2344
msgstr ""
2345
2346
#: serverguide/C/vpn.xml:487(para)
2347
msgid ""
2348
"Configure server mode and supply a VPN subnet for OpenVPN to draw client "
2349
"addresses from. The server will take 10.8.0.1 for itself, the rest will be "
2350
"made available to clients. Each client will be able to reach the server on "
2351
"10.8.0.1. Comment this line out if you are ethernet bridging."
2352
msgstr ""
2353
2354
#: serverguide/C/vpn.xml:496(programlisting)
2355
#, no-wrap
2356
msgid ""
2357
"\n"
2358
"server 10.8.0.0 255.255.255.0\n"
2359
msgstr ""
2360
"\n"
2361
"server 10.8.0.0 255.255.255.0\n"
2362
2363
#: serverguide/C/vpn.xml:500(para)
2364
msgid ""
2365
"Maintain a record of client to virtual IP address associations in this file. "
2366
"If OpenVPN goes down or is restarted, reconnecting clients can be assigned "
2367
"the same virtual IP address from the pool that was previously assigned."
2368
msgstr ""
2369
2370
#: serverguide/C/vpn.xml:507(programlisting)
2371
#, no-wrap
2372
msgid ""
2373
"\n"
2374
"ifconfig-pool-persist ipp.txt\n"
2375
msgstr ""
2376
"\n"
2377
"ifconfig-pool-persist ipp.txt\n"
2378
2379
#: serverguide/C/vpn.xml:511(para)
2380
msgid "Push DNS servers to the client."
2381
msgstr ""
2382
2383
#: serverguide/C/vpn.xml:514(programlisting)
2384
#, no-wrap
2385
msgid ""
2386
"\n"
2387
"push \"dhcp-option DNS 10.0.0.2\"\n"
2388
"push \"dhcp-option DNS 10.1.0.2\"\n"
2389
msgstr ""
2390
"\n"
2391
"push \"dhcp-option DNS 10.0.0.2\"\n"
2392
"push \"dhcp-option DNS 10.1.0.2\"\n"
2393
2394
#: serverguide/C/vpn.xml:519(para)
2395
msgid "Allow client to client communication."
2396
msgstr ""
2397
2398
#: serverguide/C/vpn.xml:522(programlisting)
2399
#, no-wrap
2400
msgid ""
2401
"\n"
2402
"client-to-client\n"
2403
msgstr ""
2404
"\n"
2405
"client-to-client\n"
2406
2407
#: serverguide/C/vpn.xml:526(para)
2408
msgid "Enable compression on the VPN link."
2409
msgstr ""
2410
2411
#: serverguide/C/vpn.xml:529(programlisting)
2412
#, no-wrap
2413
msgid ""
2414
"\n"
2415
"comp-lzo\n"
2416
msgstr ""
2417
"\n"
2418
"comp-lzo\n"
2419
2420
#: serverguide/C/vpn.xml:533(para)
2421
msgid ""
2422
"The <emphasis>keepalive</emphasis> directive causes ping-like messages to be "
2423
"sent back and forth over the link so that each side knows when the other "
2424
"side has gone down. Ping every 1 second, assume that remote peer is down if "
2425
"no ping received during a 3 second time period."
2426
msgstr ""
2427
2428
#: serverguide/C/vpn.xml:542(programlisting)
2429
#, no-wrap
2430
msgid ""
2431
"\n"
2432
"keepalive 1 3\n"
2433
msgstr ""
2434
"\n"
2435
"keepalive 1 3\n"
2436
2437
#: serverguide/C/vpn.xml:546(para)
2438
msgid ""
2439
"It's a good idea to reduce the OpenVPN daemon's privileges after "
2440
"initialization."
2441
msgstr ""
2442
2443
#: serverguide/C/vpn.xml:549(programlisting)
2444
#, no-wrap
2445
msgid ""
2446
"\n"
2447
"user nobody\n"
2448
"group nogroup\n"
2449
msgstr ""
2450
"\n"
2451
"user nobody\n"
2452
"group nogroup\n"
2453
2454
#: serverguide/C/vpn.xml:554(para)
2455
msgid ""
2456
"OpenVPN 2.0 includes a feature that allows the OpenVPN server to securely "
2457
"obtain a username and password from a connecting client, and to use that "
2458
"information as a basis for authenticating the client. To use this "
2459
"authentication method, first add the auth-user-pass directive to the client "
2460
"configuration. It will direct the OpenVPN client to query the user for a "
2461
"username/password, passing it on to the server over the secure TLS channel."
2462
msgstr ""
2463
2464
#: serverguide/C/vpn.xml:558(programlisting)
2465
#, no-wrap
2466
msgid ""
2467
"\n"
2468
"# client config!\n"
2469
"auth-user-pass\n"
2470
msgstr ""
2471
"\n"
2472
"# client config!\n"
2473
"auth-user-pass\n"
2474
2475
#: serverguide/C/vpn.xml:563(para)
2476
msgid ""
2477
"This will tell the OpenVPN server to validate the username/password entered "
2478
"by clients using the login PAM module. Useful if you have centralized "
2479
"authentication with e.g. Kerberos."
2480
msgstr ""
2481
2482
#: serverguide/C/vpn.xml:568(programlisting)
2483
#, no-wrap
2484
msgid ""
2485
"\n"
2486
"plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so login\n"
2487
msgstr ""
2488
2489
#: serverguide/C/vpn.xml:572(para)
2490
msgid ""
2491
"Please read the OpenVPN <ulink url=\"http://openvpn.net/index.php/open-"
2492
"source/documentation/howto.html#security\">hardening security guide</ulink> "
2493
"for further security advice."
2494
msgstr ""
2495
2496
#: serverguide/C/vpn.xml:578(title)
2497
msgid "Advanced bridged VPN configuration on server"
2498
msgstr ""
2499
2500
#: serverguide/C/vpn.xml:580(para)
2501
msgid ""
2502
"<application>OpenVPN</application> can be setup for either a routed or a "
2503
"bridged VPN mode. Sometimes this is also referred to as OSI layer-2 versus "
2504
"layer-3 VPN. In a bridged VPN all layer-2 frames - e.g. all ethernet frames -"
2505
" are sent to the VPN partners and in a routed VPN only layer-3 packets are "
2506
"sent to VPN partners. In bridged mode all traffic including traffic which "
2507
"was traditionally LAN-local like local network broadcasts, DHCP requests, "
2508
"ARP requests etc. are sent to VPN partners whereas in routed mode this would "
2509
"be filtered."
2510
msgstr ""
2511
2512
#: serverguide/C/vpn.xml:586(title)
2513
msgid "Prepare interface config for bridging on server"
2514
msgstr ""
2515
2516
#: serverguide/C/vpn.xml:588(para)
2517
msgid "Make sure you have the bridge-utils package installed:"
2518
msgstr ""
2519
2520
#: serverguide/C/vpn.xml:592(command) serverguide/C/network-config.xml:542(command)
2521
msgid "sudo apt install bridge-utils"
2522
msgstr "sudo apt install bridge-utils"
2523
2524
#: serverguide/C/vpn.xml:595(para)
2525
msgid ""
2526
"Before you setup OpenVPN in bridged mode you need to change your interface "
2527
"configuration. Let's assume your server has an interface eth0 connected to "
2528
"the internet and an interface eth1 connected to the LAN you want to bridge. "
2529
"Your /etc/network/interfaces would like this:"
2530
msgstr ""
2531
2532
#: serverguide/C/vpn.xml:599(programlisting)
2533
#, no-wrap
2534
msgid ""
2535
"\n"
2536
"auto eth0\n"
2537
"iface eth0 inet static\n"
2538
" address 1.2.3.4\n"
2539
" netmask 255.255.255.248\n"
2540
" default 1.2.3.1\n"
2541
"\n"
2542
"auto eth1\n"
2543
"iface eth1 inet static\n"
2544
" address 10.0.0.4\n"
2545
" netmask 255.255.255.0\n"
2546
msgstr ""
2547
2548
#: serverguide/C/vpn.xml:612(para)
2549
msgid ""
2550
"This straight forward interface config needs to be changed into a bridged "
2551
"mode like where the config of interface eth1 moves to the new br0 interface. "
2552
"Plus we configure that br0 should bridge interface eth1. We also need to "
2553
"make sure that interface eth1 is always in promiscuous mode - this tells the "
2554
"interface to forward all ethernet frames to the IP stack."
2555
msgstr ""
2556
2557
#: serverguide/C/vpn.xml:616(programlisting)
2558
#, no-wrap
2559
msgid ""
2560
"\n"
2561
"auto eth0\n"
2562
"iface eth0 inet static\n"
2563
" address 1.2.3.4\n"
2564
" netmask 255.255.255.248\n"
2565
" default 1.2.3.1\n"
2566
"\n"
2567
"auto eth1\n"
2568
"iface eth1 inet manual\n"
2569
" up ip link set $IFACE up promisc on\n"
2570
"\n"
2571
"auto br0\n"
2572
"iface br0 inet static\n"
2573
" address 10.0.0.4\n"
2574
" netmask 255.255.255.0\n"
2575
" bridge_ports eth1\n"
2576
msgstr ""
2577
2578
#: serverguide/C/vpn.xml:634(para)
2579
msgid ""
2580
"At this point you need to bring up the bridge. Be prepared that this might "
2581
"not work as expected and that you will lose remote connectivity. Make sure "
2582
"you can solve problems having local access."
2583
msgstr ""
2584
2585
#: serverguide/C/vpn.xml:638(command)
2586
msgid "sudo ifdown eth1 && sudo ifup -a"
2587
msgstr "sudo ifdown eth1 && sudo ifup -a"
2588
2589
#: serverguide/C/vpn.xml:643(title)
2590
msgid "Prepare server config for bridging"
2591
msgstr ""
2592
2593
#: serverguide/C/vpn.xml:645(para)
2594
msgid ""
2595
"Edit <filename>/etc/openvpn/server.conf</filename> changing the following "
2596
"options to:"
2597
msgstr ""
2598
2599
#: serverguide/C/vpn.xml:649(programlisting)
2600
#, no-wrap
2601
msgid ""
2602
"\n"
2603
";dev tun\n"
2604
"dev tap\n"
2605
"up \"/etc/openvpn/up.sh br0 eth1\"\n"
2606
";server 10.8.0.0 255.255.255.0\n"
2607
"server-bridge 10.0.0.4 255.255.255.0 10.0.0.128 10.0.0.254\n"
2608
msgstr ""
2609
2610
#: serverguide/C/vpn.xml:657(para)
2611
msgid ""
2612
"Next, create a helper script to add the <emphasis>tap</emphasis> interface "
2613
"to the bridge and to ensure that eth1 is promiscuous mode. Create "
2614
"<filename>/etc/openvpn/up.sh</filename>:"
2615
msgstr ""
2616
2617
#: serverguide/C/vpn.xml:661(programlisting)
2618
#, no-wrap
2619
msgid ""
2620
"\n"
2621
"#!/bin/sh\n"
2622
"\n"
2623
"BR=$1\n"
2624
"ETHDEV=$2\n"
2625
"TAPDEV=$3\n"
2626
"\n"
2627
"/sbin/ip link set \"$TAPDEV\" up\n"
2628
"/sbin/ip link set \"$ETHDEV\" promisc on\n"
2629
"/sbin/brctl addif $BR $TAPDEV\n"
2630
msgstr ""
2631
2632
#: serverguide/C/vpn.xml:673(para)
2633
msgid "Then make it executable:"
2634
msgstr ""
2635
2636
#: serverguide/C/vpn.xml:678(command)
2637
msgid "sudo chmod 755 /etc/openvpn/up.sh"
2638
msgstr "sudo chmod 755 /etc/openvpn/up.sh"
2639
2640
#: serverguide/C/vpn.xml:681(para)
2641
msgid ""
2642
"After configuring the server, restart <application>openvpn</application> by "
2643
"entering:"
2644
msgstr ""
2645
2646
#: serverguide/C/vpn.xml:686(command)
2647
msgid "sudo systemctl restart openvpn@server"
2648
msgstr "sudo systemctl restart openvpn@server"
2649
2650
#: serverguide/C/vpn.xml:691(title)
2651
msgid "Client Configuration"
2652
msgstr ""
2653
2654
#: serverguide/C/vpn.xml:693(para)
2655
msgid "First, install <application>openvpn</application> on the client:"
2656
msgstr ""
2657
2658
#: serverguide/C/vpn.xml:701(para)
2659
msgid ""
2660
"Then with the server configured and the client certificates copied to the "
2661
"<filename>/etc/openvpn/</filename> directory, create a client configuration "
2662
"file by copying the example. In a terminal on the client machine enter:"
2663
msgstr ""
2664
2665
#: serverguide/C/vpn.xml:707(command)
2666
msgid ""
2667
"sudo cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf "
2668
"/etc/openvpn"
2669
msgstr ""
2670
2671
#: serverguide/C/vpn.xml:710(para)
2672
msgid ""
2673
"Now edit <filename>/etc/openvpn/client.conf</filename> changing the "
2674
"following options:"
2675
msgstr ""
2676
2677
#: serverguide/C/vpn.xml:714(programlisting)
2678
#, no-wrap
2679
msgid ""
2680
"\n"
2681
"dev tap\n"
2682
";dev tun\n"
2683
"ca ca.crt\n"
2684
"cert client1.crt\n"
2685
"key client1.key\n"
2686
msgstr ""
2687
"\n"
2688
"dev tap\n"
2689
";dev tun\n"
2690
"ca ca.crt\n"
2691
"cert client1.crt\n"
2692
"key client1.key\n"
2693
2694
#: serverguide/C/vpn.xml:722(para)
2695
msgid "Finally, restart <application>openvpn</application>:"
2696
msgstr ""
2697
2698
#: serverguide/C/vpn.xml:727(command)
2699
msgid "sudo systemctl restart openvpn@client"
2700
msgstr "sudo systemctl restart openvpn@client"
2701
2702
#: serverguide/C/vpn.xml:730(para)
2703
msgid "You should now be able to connect to the remote LAN through the VPN."
2704
msgstr ""
2705
2706
#: serverguide/C/vpn.xml:739(title)
2707
msgid "Client software implementations"
2708
msgstr ""
2709
2710
#: serverguide/C/vpn.xml:742(title)
2711
msgid "Linux Network-Manager GUI for OpenVPN"
2712
msgstr ""
2713
2714
#: serverguide/C/vpn.xml:744(para)
2715
msgid ""
2716
"Many Linux distributions including Ubuntu desktop variants come with Network "
2717
"Manager, a nice GUI to configure your network settings. It also can manage "
2718
"your VPN connections. Make sure you have package network-manager-openvpn "
2719
"installed. Here you see that the installation installs all other required "
2720
"packages as well:"
2721
msgstr ""
2722
2723
#: serverguide/C/vpn.xml:749(programlisting)
2724
#, no-wrap
2725
msgid ""
2726
"\n"
2727
"root@client:~# apt install network-manager-openvpn\n"
2728
"Reading package lists... Done\n"
2729
"Building dependency tree\n"
2730
"Reading state information... Done\n"
2731
"The following extra packages will be installed:\n"
2732
" liblzo2-2 libpkcs11-helper1 network-manager-openvpn-gnome openvpn\n"
2733
"Suggested packages:\n"
2734
" resolvconf\n"
2735
"The following NEW packages will be installed:\n"
2736
" liblzo2-2 libpkcs11-helper1 network-manager-openvpn\n"
2737
" network-manager-openvpn-gnome openvpn\n"
2738
"0 upgraded, 5 newly installed, 0 to remove and 631 not upgraded.\n"
2739
"Need to get 700 kB of archives.\n"
2740
"After this operation, 3,031 kB of additional disk space will be used.\n"
2741
"Do you want to continue [Y/n]?\n"
2742
msgstr ""
2743
2744
#: serverguide/C/vpn.xml:767(para)
2745
msgid ""
2746
"To inform network-manager about the new installed packages you will have to "
2747
"restart it:"
2748
msgstr ""
2749
2750
#: serverguide/C/vpn.xml:771(programlisting)
2751
#, no-wrap
2752
msgid ""
2753
"\n"
2754
"root@client:~# restart network-manager\n"
2755
"network-manager start/running, process 3078\n"
2756
msgstr ""
2757
2758
#: serverguide/C/vpn.xml:776(para)
2759
msgid ""
2760
"Open the Network Manager GUI, select the VPN tab and then the 'Add' button. "
2761
"Select OpenVPN as the VPN type in the opening requester and press 'Create'. "
2762
"In the next window add the OpenVPN's server name as the 'Gateway', set "
2763
"'Type' to 'Certificates (TLS)', point 'User Certificate' to your user "
2764
"certificate, 'CA Certificate' to your CA certificate and 'Private Key' to "
2765
"your private key file. Use the advanced button to enable compression (e.g. "
2766
"comp-lzo), dev tap, or other special settings you set on the server. Now try "
2767
"to establish your VPN."
2768
msgstr ""
2769
2770
#: serverguide/C/vpn.xml:788(title)
2771
msgid "OpenVPN with GUI for Mac OS X: Tunnelblick"
2772
msgstr ""
2773
2774
#: serverguide/C/vpn.xml:790(para)
2775
msgid ""
2776
"Tunnelblick is an excellent free, open source implementation of a GUI for "
2777
"OpenVPN for OS X. The project's homepage is at <ulink "
2778
"url=\"http://code.google.com/p/tunnelblick/\">http://code.google.com/p/tunnel"
2779
"blick/</ulink>. Download the latest OS X installer from there and install "
2780
"it. Then put your client.ovpn config file together with the certificates and "
2781
"keys in /Users/username/Library/Application "
2782
"Support/Tunnelblick/Configurations/ and lauch Tunnelblick from your "
2783
"Application folder."
2784
msgstr ""
2785
2786
#: serverguide/C/vpn.xml:796(programlisting)
2787
#, no-wrap
2788
msgid ""
2789
"\n"
2790
"# sample client.ovpn for Tunnelblick\n"
2791
"client\n"
2792
"remote blue.example.com\n"
2793
"port 1194\n"
2794
"proto udp\n"
2795
"dev tun\n"
2796
"dev-type tun\n"
2797
"ns-cert-type server\n"
2798
"reneg-sec 86400\n"
2799
"auth-user-pass\n"
2800
"auth-nocache\n"
2801
"auth-retry interact\n"
2802
"comp-lzo yes\n"
2803
"verb 3\n"
2804
"ca ca.crt\n"
2805
"cert client.crt\n"
2806
"key client.key\n"
2807
msgstr ""
2808
2809
#: serverguide/C/vpn.xml:818(title)
2810
msgid "OpenVPN with GUI for Win 7"
2811
msgstr ""
2812
2813
#: serverguide/C/vpn.xml:820(para)
2814
msgid ""
2815
"First download and install the latest <ulink "
2816
"url=\"http://www.openvpn.net/index.php/open-source/downloads.html\">OpenVPN "
2817
"Windows Installer</ulink>. OpenVPN 2.3.2 was the latest when this was "
2818
"written. As of this writing, the management GUI is included with the Windows "
2819
"binary installer."
2820
msgstr ""
2821
2822
#: serverguide/C/vpn.xml:825(para)
2823
msgid ""
2824
"You need to start the OpenVPN service. Goto Start > Computer > Manage "
2825
"> Services and Applications > Services. Find the OpenVPN service and "
2826
"start it. Set it's startup type to automatic. When you start the OpenVPN MI "
2827
"GUI the first time you need to run it as an administrator. You have to right "
2828
"click on it and you will see that option."
2829
msgstr ""
2830
2831
#: serverguide/C/vpn.xml:829(para)
2832
msgid ""
2833
"You will have to write your OpenVPN config in a textfile and place it in C:\\"
2834
"Program Files\\OpenVPN\\config\\client.ovpn along with the CA certificate. "
2835
"You could put the user certificate in the user's home directory like in the "
2836
"follwing example."
2837
msgstr ""
2838
2839
#: serverguide/C/vpn.xml:833(programlisting)
2840
#, no-wrap
2841
msgid ""
2842
"\n"
2843
"# C:\\Program Files\\OpenVPN\\config\\client.ovpn\n"
2844
"client\n"
2845
"remote server.example.com\n"
2846
"port 1194\n"
2847
"proto udp\n"
2848
"dev tun\n"
2849
"dev-type tun\n"
2850
"ns-cert-type server\n"
2851
"reneg-sec 86400\n"
2852
"auth-user-pass\n"
2853
"auth-retry interact\n"
2854
"comp-lzo yes\n"
2855
"verb 3\n"
2856
"ca ca.crt\n"
2857
"cert \"C:\\\\Users\\\\username\\\\My Documents\\\\openvpn\\\\client.crt\"\n"
2858
"key \"C:\\\\Users\\\\username\\\\My Documents\\\\openvpn\\\\client.key\"\n"
2859
"management 127.0.0.1 1194\n"
2860
"management-hold\n"
2861
"management-query-passwords\n"
2862
"auth-retry interact\n"
2863
"; Set the name of the Windows TAP network interface device here\n"
2864
"dev-node MyTAP\n"
2865
"\n"
2866
msgstr ""
2867
2868
#: serverguide/C/vpn.xml:858(para)
2869
msgid ""
2870
"Note: If you are not using user authentication and/or you want to run the "
2871
"service without user interaction, comment out the following options:"
2872
msgstr ""
2873
2874
#: serverguide/C/vpn.xml:861(programlisting)
2875
#, no-wrap
2876
msgid ""
2877
"\n"
2878
"auth-user-pass\n"
2879
"auth-retry interact\n"
2880
"management 127.0.0.1 1194\n"
2881
"management-hold\n"
2882
"management-query-passwords\n"
2883
msgstr ""
2884
2885
#: serverguide/C/vpn.xml:868(para)
2886
msgid "You may want to set the Windows service to \"automatic\"."
2887
msgstr ""
2888
2889
#: serverguide/C/vpn.xml:872(title)
2890
msgid "OpenVPN for OpenWRT"
2891
msgstr ""
2892
2893
#: serverguide/C/vpn.xml:874(para)
2894
msgid ""
2895
"OpenWRT is described as a Linux distribution for embedded devices like WLAN "
2896
"router. There are certain types of WLAN routers who can be flashed to run "
2897
"OpenWRT. Depending on the available memory on your OpenWRT router you can "
2898
"run software like OpenVPN and you could for example build a small "
2899
"inexpensive branch office router with VPN connectivity to the central "
2900
"office. More info on OpenVPN on OpenWRT is <ulink "
2901
"url=\"http://wiki.openwrt.org/doc/howto/vpn.overview\">here</ulink>. And "
2902
"here is the OpenWRT project's homepage: <ulink "
2903
"url=\"http://openwrt.org\">http://openwrt.org</ulink>"
2904
msgstr ""
2905
2906
#: serverguide/C/vpn.xml:883(para)
2907
msgid "Log into your OpenWRT router and install OpenVPN:"
2908
msgstr ""
2909
2910
#: serverguide/C/vpn.xml:888(command)
2911
msgid "opkg update"
2912
msgstr "opkg update"
2913
2914
#: serverguide/C/vpn.xml:889(command)
2915
msgid "opkg install openvpn"
2916
msgstr "opkg install openvpn"
2917
2918
#: serverguide/C/vpn.xml:892(para)
2919
msgid ""
2920
"Check out /etc/config/openvpn and put your client config in there. Copy "
2921
"certificates and keys to /etc/openvpn/"
2922
msgstr ""
2923
2924
#: serverguide/C/vpn.xml:897(programlisting)
2925
#, no-wrap
2926
msgid ""
2927
"\n"
2928
"config openvpn client1\n"
2929
" option enable 1\n"
2930
" option client 1\n"
2931
"# option dev tap\n"
2932
" option dev tun\n"
2933
" option proto udp\n"
2934
" option ca /etc/openvpn/ca.crt\n"
2935
" option cert /etc/openvpn/client.crt\n"
2936
" option key /etc/openvpn/client.key\n"
2937
" option comp_lzo 1\n"
2938
msgstr ""
2939
2940
#: serverguide/C/vpn.xml:910(para)
2941
msgid "Restart OpenVPN on OpenWRT router to pick up the config"
2942
msgstr ""
2943
2944
#: serverguide/C/vpn.xml:914(para)
2945
msgid ""
2946
"You will have to see if you need to adjust your router's routing and "
2947
"firewall rules."
2948
msgstr ""
2949
2950
#: serverguide/C/vpn.xml:924(para)
2951
msgid ""
2952
"See the <ulink url=\"http://openvpn.net/\">OpenVPN</ulink> website for "
2953
"additional information."
2954
msgstr ""
2955
2956
#: serverguide/C/vpn.xml:930(ulink)
2957
msgid "OpenVPN hardening security guide"
2958
msgstr ""
2959
2960
#: serverguide/C/vpn.xml:934(para)
2961
msgid ""
2962
"Also, Pakt's <ulink url=\"http://www.packtpub.com/openvpn/book\">OpenVPN: "
2963
"Building and Integrating Virtual Private Networks</ulink> is a good resource."
2964
msgstr ""
2965
2966
#: serverguide/C/virtualization.xml:11(title)
2967
msgid "Virtualization"
2968
msgstr ""
2969
2970
#: serverguide/C/virtualization.xml:13(para)
2971
msgid ""
2972
"Virtualization is being adopted in many different environments and "
2973
"situations. If you are a developer, virtualization can provide you with a "
2974
"contained environment where you can safely do almost any sort of development "
2975
"safe from messing up your main working environment. If you are a systems "
2976
"administrator, you can use virtualization to more easily separate your "
2977
"services and move them around based on demand."
2978
msgstr ""
2979
2980
#: serverguide/C/virtualization.xml:20(para)
2981
msgid ""
2982
"The default virtualization technology supported in Ubuntu is "
2983
"<application>KVM</application>. KVM requires virtualization extensions built "
2984
"into Intel and AMD hardware. <application>Xen</application> is also "
2985
"supported on Ubuntu. Xen can take advantage of virtualization extensions, "
2986
"when available, but can also be used on hardware without virtualization "
2987
"extensions. <application>Qemu</application> is another popular solution for "
2988
"hardware without virtualization extensions."
2989
msgstr ""
2990
2991
#: serverguide/C/virtualization.xml:29(title)
2992
msgid "libvirt"
2993
msgstr "libvirt"
2994
2995
#: serverguide/C/virtualization.xml:31(para)
2996
msgid ""
2997
"The <application>libvirt</application> library is used to interface with "
2998
"different virtualization technologies. Before getting started with "
2999
"<application>libvirt</application> it is best to make sure your hardware "
3000
"supports the necessary virtualization extensions for "
3001
"<application>KVM</application>. Enter the following from a terminal prompt:"
3002
msgstr ""
3003
3004
#: serverguide/C/virtualization.xml:39(command)
3005
msgid "kvm-ok"
3006
msgstr "kvm-ok"
3007
3008
#: serverguide/C/virtualization.xml:42(para)
3009
msgid ""
3010
"A message will be printed informing you if your CPU "
3011
"<emphasis>does</emphasis> or <emphasis>does not</emphasis> support hardware "
3012
"virtualization."
3013
msgstr ""
3014
3015
#: serverguide/C/virtualization.xml:47(para)
3016
msgid ""
3017
"On many computers with processors supporting hardware assisted "
3018
"virtualization, it is necessary to activate an option in the BIOS to enable "
3019
"it."
3020
msgstr ""
3021
3022
#: serverguide/C/virtualization.xml:53(title)
3023
msgid "Virtual Networking"
3024
msgstr ""
3025
3026
#: serverguide/C/virtualization.xml:55(para)
3027
msgid ""
3028
"There are a few different ways to allow a virtual machine access to the "
3029
"external network. The default virtual network configuration includes "
3030
"<emphasis>bridging</emphasis> and <emphasis>iptables</emphasis> rules "
3031
"implementing <emphasis>usermode</emphasis> networking, which uses the SLIRP "
3032
"protocol. Traffic is NATed through the host interface to the outside network."
3033
msgstr ""
3034
3035
#: serverguide/C/virtualization.xml:62(para)
3036
msgid ""
3037
"To enable external hosts to directly access services on virtual machines a "
3038
"different type of <emphasis>bridge</emphasis> than the default needs to be "
3039
"configured. This allows the virtual interfaces to connect to the outside "
3040
"network through the physical interface, making them appear as normal hosts "
3041
"to the rest of the network."
3042
msgstr ""
3043
3044
#: serverguide/C/virtualization.xml:72(para)
3045
msgid "To install the necessary packages, from a terminal prompt enter:"
3046
msgstr ""
3047
3048
#: serverguide/C/virtualization.xml:76(command)
3049
msgid "sudo apt install qemu-kvm libvirt-bin"
3050
msgstr ""
3051
3052
#: serverguide/C/virtualization.xml:79(para)
3053
msgid ""
3054
"After installing <application>libvirt-bin</application>, the user used to "
3055
"manage virtual machines will need to be added to the "
3056
"<emphasis>libvirtd</emphasis> group. Doing so will grant the user access to "
3057
"the advanced networking options."
3058
msgstr ""
3059
3060
#: serverguide/C/virtualization.xml:84(para)
3061
msgid "In a terminal enter:"
3062
msgstr ""
3063
3064
#: serverguide/C/virtualization.xml:87(command)
3065
msgid "sudo adduser $USER libvirtd"
3066
msgstr ""
3067
3068
#: serverguide/C/virtualization.xml:91(para)
3069
msgid ""
3070
"If the user chosen is the current user, you will need to log out and back in "
3071
"for the new group membership to take effect."
3072
msgstr ""
3073
3074
#: serverguide/C/virtualization.xml:95(para)
3075
msgid ""
3076
"In more recent releases (>= Yakkety) the group was renamed to "
3077
"<emphasis>libvirt</emphasis>. Upgraded systems get a new "
3078
"<emphasis>libvirt</emphasis> group with the same gid as the "
3079
"<emphasis>libvirtd</emphasis> group to match that."
3080
msgstr ""
3081
3082
#: serverguide/C/virtualization.xml:98(para)
3083
msgid ""
3084
"You are now ready to install a <emphasis>Guest</emphasis> operating system. "
3085
"Installing a virtual machine follows the same process as installing the "
3086
"operating system directly on the hardware. You either need a way to automate "
3087
"the installation, or a keyboard and monitor will need to be attached to the "
3088
"physical machine."
3089
msgstr ""
3090
3091
#: serverguide/C/virtualization.xml:104(para)
3092
msgid ""
3093
"In the case of virtual machines a Graphical User Interface (GUI) is "
3094
"analogous to using a physical keyboard and mouse. Instead of installing a "
3095
"GUI the <application>virt-viewer</application> application can be used to "
3096
"connect to a virtual machine's console using <application>VNC</application>. "
3097
"See <xref linkend=\"libvirt-virt-viewer\"/> for more information."
3098
msgstr ""
3099
3100
#: serverguide/C/virtualization.xml:111(para)
3101
msgid ""
3102
"There are several ways to automate the Ubuntu installation process, for "
3103
"example using preseeds, kickstart, etc. Refer to the <ulink "
3104
"url=\"https://help.ubuntu.com/16.04/installation-guide/\">Ubuntu "
3105
"Installation Guide</ulink> for details."
3106
msgstr ""
3107
3108
#: serverguide/C/virtualization.xml:116(para)
3109
msgid ""
3110
"Yet another way to install an Ubuntu virtual machine is to use "
3111
"<application>uvtool</application>. This application, available as of 14.04, "
3112
"allows you to set up specific VM options, execute custom post-install "
3113
"scripts, etc. For details see <xref linkend=\"cloud-images-and-uvtool\"/>."
3114
msgstr ""
3115
3116
#: serverguide/C/virtualization.xml:122(para)
3117
msgid ""
3118
"Libvirt can also be configured work with <application>Xen</application>. For "
3119
"details, see the Xen Ubuntu community page referenced below."
3120
msgstr ""
3121
3122
#: serverguide/C/virtualization.xml:128(title)
3123
msgid "virt-install"
3124
msgstr "virt-install"
3125
3126
#: serverguide/C/virtualization.xml:130(para)
3127
msgid ""
3128
"<application>virt-install</application> is part of the "
3129
"<application>virtinst</application> package. To install it, from a terminal "
3130
"prompt enter:"
3131
msgstr ""
3132
3133
#: serverguide/C/virtualization.xml:135(command)
3134
msgid "sudo apt install virtinst"
3135
msgstr "sudo apt install virtinst"
3136
3137
#: serverguide/C/virtualization.xml:138(para)
3138
msgid ""
3139
"There are several options available when using <application>virt-"
3140
"install</application>. For example:"
3141
msgstr ""
3142
3143
#: serverguide/C/virtualization.xml:142(command)
3144
msgid ""
3145
"sudo virt-install -n web_devel -r 512 \\ --disk "
3146
"path=/var/lib/libvirt/images/web_devel.img,bus=virtio,size=4 -c \\ ubuntu-"
3147
"16.04-server-i386.iso --network network=default,model=virtio \\ --graphics "
3148
"vnc,listen=0.0.0.0 --noautoconsole -v"
3149
msgstr ""
3150
3151
#: serverguide/C/virtualization.xml:150(para)
3152
msgid ""
3153
"<emphasis>-n web_devel:</emphasis> the name of the new virtual machine will "
3154
"be <emphasis>web_devel</emphasis> in this example."
3155
msgstr ""
3156
3157
#: serverguide/C/virtualization.xml:156(para)
3158
msgid ""
3159
"<emphasis>-r 512:</emphasis> specifies the amount of memory the virtual "
3160
"machine will use in megabytes."
3161
msgstr ""
3162
3163
#: serverguide/C/virtualization.xml:161(para)
3164
msgid ""
3165
"<emphasis>--disk "
3166
"path=/var/lib/libvirt/images/web_devel.img,size=4:</emphasis> indicates the "
3167
"path to the virtual disk which can be a file, partition, or logical volume. "
3168
"In this example a file named <filename>web_devel.img</filename> in the "
3169
"/var/lib/libvirt/images/ directory, with a size of 4 gigabytes, and using "
3170
"<emphasis>virtio</emphasis> for the disk bus."
3171
msgstr ""
3172
3173
#: serverguide/C/virtualization.xml:171(para)
3174
msgid ""
3175
"<emphasis>-c ubuntu-16.04-server-i386.iso:</emphasis> file to be used as a "
3176
"virtual CDROM. The file can be either an ISO file or the path to the host's "
3177
"CDROM device."
3178
msgstr ""
3179
3180
#: serverguide/C/virtualization.xml:177(para)
3181
msgid ""
3182
"<emphasis>--network</emphasis> provides details related to the VM's network "
3183
"interface. Here the <emphasis>default</emphasis> network is used, and the "
3184
"interface model is configured for <emphasis>virtio</emphasis>."
3185
msgstr ""
3186
3187
#: serverguide/C/virtualization.xml:184(para)
3188
msgid ""
3189
"<emphasis>--graphics vnc,listen=0.0.0.0:</emphasis> exports the guest's "
3190
"virtual console using VNC and on all host interfaces. Typically servers have "
3191
"no GUI, so another GUI based computer on the Local Area Network (LAN) can "
3192
"connect via VNC to complete the installation."
3193
msgstr ""
3194
3195
#: serverguide/C/virtualization.xml:192(para)
3196
msgid ""
3197
"<emphasis>--noautoconsole:</emphasis> will not automatically connect to the "
3198
"virtual machine's console."
3199
msgstr ""
3200
3201
#: serverguide/C/virtualization.xml:197(para)
3202
msgid "<emphasis>-v:</emphasis> creates a fully virtualized guest."
3203
msgstr ""
3204
3205
#: serverguide/C/virtualization.xml:202(para)
3206
msgid ""
3207
"After launching <application>virt-install</application> you can connect to "
3208
"the virtual machine's console either locally using a GUI (if your server has "
3209
"a GUI), or via a remote VNC client from a GUI-based computer."
3210
msgstr ""
3211
3212
#: serverguide/C/virtualization.xml:209(title)
3213
msgid "virt-clone"
3214
msgstr "virt-clone"
3215
3216
#: serverguide/C/virtualization.xml:211(para)
3217
msgid ""
3218
"The <application>virt-clone</application> application can be used to copy "
3219
"one virtual machine to another. For example:"
3220
msgstr ""
3221
3222
#: serverguide/C/virtualization.xml:215(command)
3223
msgid ""
3224
"sudo virt-clone -o web_devel -n database_devel -f /path/to/database_devel.img"
3225
msgstr ""
3226
3227
#: serverguide/C/virtualization.xml:220(para)
3228
msgid "<emphasis>-o:</emphasis> original virtual machine."
3229
msgstr ""
3230
3231
#: serverguide/C/virtualization.xml:224(para)
3232
msgid "<emphasis>-n:</emphasis> name of the new virtual machine."
3233
msgstr ""
3234
3235
#: serverguide/C/virtualization.xml:229(para)
3236
msgid ""
3237
"<emphasis>-f:</emphasis> path to the file, logical volume, or partition to "
3238
"be used by the new virtual machine."
3239
msgstr ""
3240
3241
#: serverguide/C/virtualization.xml:234(para)
3242
msgid ""
3243
"Also, use <emphasis>-d</emphasis> or <emphasis>--debug</emphasis> option to "
3244
"help troubleshoot problems with <application>virt-clone</application>."
3245
msgstr ""
3246
3247
#: serverguide/C/virtualization.xml:239(para)
3248
msgid ""
3249
"Replace <emphasis>web_devel</emphasis> and "
3250
"<emphasis>database_devel</emphasis> with appropriate virtual machine names."
3251
msgstr ""
3252
3253
#: serverguide/C/virtualization.xml:246(title)
3254
msgid "Virtual Machine Management"
3255
msgstr ""
3256
3257
#: serverguide/C/virtualization.xml:249(title)
3258
msgid "virsh"
3259
msgstr "virsh"
3260
3261
#: serverguide/C/virtualization.xml:251(para)
3262
msgid ""
3263
"There are several utilities available to manage virtual machines and "
3264
"<application>libvirt</application>. The <application>virsh</application> "
3265
"utility can be used from the command line. Some examples:"
3266
msgstr ""
3267
3268
#: serverguide/C/virtualization.xml:258(para)
3269
msgid "To list running virtual machines:"
3270
msgstr ""
3271
3272
#: serverguide/C/virtualization.xml:261(command)
3273
msgid "virsh list"
3274
msgstr "virsh list"
3275
3276
#: serverguide/C/virtualization.xml:266(para)
3277
msgid "To start a virtual machine:"
3278
msgstr ""
3279
3280
#: serverguide/C/virtualization.xml:269(command)
3281
msgid "virsh start web_devel"
3282
msgstr "virsh start web_devel"
3283
3284
#: serverguide/C/virtualization.xml:274(para)
3285
msgid "Similarly, to start a virtual machine at boot:"
3286
msgstr ""
3287
3288
#: serverguide/C/virtualization.xml:277(command)
3289
msgid "virsh autostart web_devel"
3290
msgstr "virsh autostart web_devel"
3291
3292
#: serverguide/C/virtualization.xml:282(para)
3293
msgid "Reboot a virtual machine with:"
3294
msgstr ""
3295
3296
#: serverguide/C/virtualization.xml:285(command)
3297
msgid "virsh reboot web_devel"
3298
msgstr "virsh reboot web_devel"
3299
3300
#: serverguide/C/virtualization.xml:290(para)
3301
msgid ""
3302
"The <emphasis>state</emphasis> of virtual machines can be saved to a file in "
3303
"order to be restored later. The following will save the virtual machine "
3304
"state into a file named according to the date:"
3305
msgstr ""
3306
3307
#: serverguide/C/virtualization.xml:296(command)
3308
msgid "virsh save web_devel web_devel-022708.state"
3309
msgstr "virsh save web_devel web_devel-022708.state"
3310
3311
#: serverguide/C/virtualization.xml:299(para)
3312
msgid "Once saved the virtual machine will no longer be running."
3313
msgstr ""
3314
3315
#: serverguide/C/virtualization.xml:304(para)
3316
msgid "A saved virtual machine can be restored using:"
3317
msgstr ""
3318
3319
#: serverguide/C/virtualization.xml:307(command)
3320
msgid "virsh restore web_devel-022708.state"
3321
msgstr "virsh restore web_devel-022708.state"
3322
3323
#: serverguide/C/virtualization.xml:312(para)
3324
msgid "To shutdown a virtual machine do:"
3325
msgstr ""
3326
3327
#: serverguide/C/virtualization.xml:315(command)
3328
msgid "virsh shutdown web_devel"
3329
msgstr "virsh shutdown web_devel"
3330
3331
#: serverguide/C/virtualization.xml:320(para)
3332
msgid "A CDROM device can be mounted in a virtual machine by entering:"
3333
msgstr ""
3334
3335
#: serverguide/C/virtualization.xml:324(command)
3336
msgid "virsh attach-disk web_devel /dev/cdrom /media/cdrom"
3337
msgstr "virsh attach-disk web_devel /dev/cdrom /media/cdrom"
3338
3339
#: serverguide/C/virtualization.xml:330(para)
3340
msgid ""
3341
"In the above examples replace <emphasis>web_devel</emphasis> with the "
3342
"appropriate virtual machine name, and <filename>web_devel-"
3343
"022708.state</filename> with a descriptive file name."
3344
msgstr ""
3345
3346
#: serverguide/C/virtualization.xml:334(para)
3347
msgid ""
3348
"If virsh (or other vir* tools) shall connect to something else than the "
3349
"default qemu-kvm/system hipervisor one can find alternatives for the "
3350
"<emphasis>connect</emphasis> option in <emphasis>man virsh</emphasis> or "
3351
"<ulink url=\"http://libvirt.org/uri.html\">libvirt doc</ulink>"
3352
msgstr ""
3353
3354
#: serverguide/C/virtualization.xml:341(title)
3355
msgid "migration"
3356
msgstr ""
3357
3358
#: serverguide/C/virtualization.xml:342(para)
3359
msgid ""
3360
"There are different types of migration available depending on the versions "
3361
"of libvirt and the hipervisor being used. In general those types are:"
3362
msgstr ""
3363
3364
#: serverguide/C/virtualization.xml:345(ulink)
3365
msgid "offline migration"
3366
msgstr ""
3367
3368
#: serverguide/C/virtualization.xml:346(ulink)
3369
msgid "live migration"
3370
msgstr ""
3371
3372
#: serverguide/C/virtualization.xml:347(ulink)
3373
msgid "postcopy migration"
3374
msgstr ""
3375
3376
#: serverguide/C/virtualization.xml:349(para)
3377
msgid ""
3378
"There are various options to those methods, but the entry point for all of "
3379
"them is <emphasis>virsh migrate</emphasis>. Read the integrated help for "
3380
"more detail."
3381
msgstr ""
3382
3383
#: serverguide/C/virtualization.xml:350(command)
3384
msgid "virsh migrate --help"
3385
msgstr "virsh migrate --help"
3386
3387
#: serverguide/C/virtualization.xml:351(para)
3388
msgid ""
3389
"Some useful documentation on constraints and considerations about live "
3390
"migration can be found at the <ulink "
3391
"url=\"https://wiki.ubuntu.com/QemuKVMMigration\">Ubuntu Wiki</ulink>"
3392
msgstr ""
3393
3394
#: serverguide/C/virtualization.xml:355(title)
3395
msgid "Device Passthrough / Hotplug"
3396
msgstr ""
3397
3398
#: serverguide/C/virtualization.xml:356(para)
3399
msgid ""
3400
"If instead of the here described hotplugging you want to always pass through "
3401
"a device add the xml content of the device to your static guest xml "
3402
"representation via e.g. <command>virsh edit <guestname></command>. In "
3403
"that case you don't need to use <emphasis>attach/detach</emphasis>. There "
3404
"are different kinds of passthrough. Types available to you depend on your "
3405
"Hardware and software setup."
3406
msgstr ""
3407
3408
#: serverguide/C/virtualization.xml:363(para)
3409
msgid "USB hotplug/passthrough"
3410
msgstr ""
3411
3412
#: serverguide/C/virtualization.xml:364(para)
3413
msgid "VF hotplug/Passthrough"
3414
msgstr ""
3415
3416
#: serverguide/C/virtualization.xml:366(para)
3417
msgid ""
3418
"But both kinds are handled in a very similar way and while there are various "
3419
"way to do it (e.g. also via qemu monitor) driving such a change via libvirt "
3420
"is recommended. That way libvirt can try to manage all sorts of special "
3421
"cases for you and also somewhat masks version differences."
3422
msgstr ""
3423
3424
#: serverguide/C/virtualization.xml:371(para)
3425
msgid ""
3426
"In general when driving hotplug via libvirt you create a xml snippet that "
3427
"describes the device just as you would do in a static <ulink "
3428
"url=\"https://libvirt.org/formatdomain.html\">guest description.</ulink> A "
3429
"usb device is usually identified by Vendor/Product id's: <screen><hostdev "
3430
"mode='subsystem' type='usb' managed='yes'>\n"
3431
" <source>\n"
3432
" <vendor id='0x0b6d'/>\n"
3433
" <product id='0x3880'/>\n"
3434
" </source>\n"
3435
"</hostdev></screen> Virtual functions are usually assigned via their "
3436
"PCI-ID (domain, bus, slot, function). <screen><hostdev mode='subsystem' "
3437
"type='pci' managed='yes'>\n"
3438
" <source>\n"
3439
" <address domain='0x0000' bus='0x04' slot='0x10' function='0x0'/>\n"
3440
" </source>\n"
3441
"</hostdev></screen>"
3442
msgstr ""
3443
3444
#: serverguide/C/virtualization.xml:389(para)
3445
msgid ""
3446
"To get the Virtual function in the first place is very device dependent and "
3447
"can therefore not be fully covered here. But in general it involves setting "
3448
"up an iommu, registering via <ulink "
3449
"url=\"https://www.kernel.org/doc/Documentation/vfio.txt\">VFIO</ulink> and "
3450
"sometimes requesting a number of VFs. Here an example on ppc64el to get 4 "
3451
"VFs on a device: <screen>\n"
3452
"$ sudo modprobe vfio-pci\n"
3453
"# identify device\n"
3454
"$ lspci -n -s 0005:01:01.3\n"
3455
"0005:01:01.3 0200: 10df:e228 (rev 10)\n"
3456
"# register and request VFs\n"
3457
"$ echo 10df e228 | sudo tee /sys/bus/pci/drivers/vfio-pci/new_id\n"
3458
"$ echo 4 | sudo tee /sys/bus/pci/devices/0005\\:01\\:00.0/sriov_numvfs\n"
3459
" </screen>"
3460
msgstr ""
3461
3462
#: serverguide/C/virtualization.xml:404(para)
3463
msgid ""
3464
"You then attach or detach the device via libvirt by relating the guest with "
3465
"the xml snippet. <screen><command>virsh attach-device <guestname> "
3466
"<device-xml></command>\n"
3467
"# Use the Device int the Guest\n"
3468
"<command>virsh detach-device <guestname> <device-"
3469
"xml></command></screen>"
3470
msgstr ""
3471
3472
#: serverguide/C/virtualization.xml:411(para)
3473
msgid ""
3474
"There are several associated known issues in regard to apparmor proetction "
3475
"protecting \"too much\". You might need to tweak exceptions in the apparmor "
3476
"profiles until the bugs <ulink "
3477
"url=\"https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1552241\">155224"
3478
"1</ulink> (for USB) and <ulink "
3479
"url=\"https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1679704\"/> "
3480
"(For VF assignment) are resolved. To check if you are affected watch dmesg "
3481
"while you use the USB/VF passthrough/hotplug feature and verify if you see "
3482
"<ulink "
3483
"url=\"http://wiki.apparmor.net/index.php/AppArmor_Failures#Messages_in_the_Lo"
3484
"g_files\">apparmor denies</ulink>."
3485
msgstr ""
3486
3487
#: serverguide/C/virtualization.xml:422(title)
3488
msgid "Access Qemu Monitor via libvirt"
3489
msgstr ""
3490
3491
#: serverguide/C/virtualization.xml:423(para)
3492
msgid ""
3493
"The <ulink url=\"https://en.wikibooks.org/wiki/QEMU/Monitor\">Qemu "
3494
"Monitor</ulink> is the way to interact with qemu/KVM while a guest is "
3495
"running. This interface has many and very powerful features for experienced "
3496
"users. When running under libvirt that monitor interface is bound by libvirt "
3497
"itself for management purposes, but a user can run qemu monitor commands via "
3498
"libvirt still. The general syntax is <command>virsh qemu-monitor-command "
3499
"[options] [guest] 'command'</command>"
3500
msgstr ""
3501
3502
#: serverguide/C/virtualization.xml:430(para)
3503
msgid ""
3504
"Libvirt covers most use cases needed, but if you every want/need to work "
3505
"around libvirt or want to tweak very special options you can e.g. add a "
3506
"device that way: <screen>virsh qemu-monitor-command --hmp zesty-test-log "
3507
"'drive_add 0 "
3508
"if=none,file=/var/lib/libvirt/images/test.img,format=raw,id=disk1'</screen>"
3509
msgstr ""
3510
3511
#: serverguide/C/virtualization.xml:434(para)
3512
msgid ""
3513
"But since the monitor is so powerful, you can do a lot especially for "
3514
"debugging purposes like showing the guest registers: <screen>virsh qemu-"
3515
"monitor-command --hmp y-ipns 'info registers'\n"
3516
"RAX=00ffffc000000000 RBX=ffff8f0f5d5c7e48 RCX=0000000000000000 "
3517
"RDX=ffffea00007571c0\n"
3518
"RSI=0000000000000000 RDI=ffff8f0fdd5c7e48 RBP=ffff8f0f5d5c7e18 "
3519
"RSP=ffff8f0f5d5c7df8\n"
3520
"[...]</screen>"
3521
msgstr ""
3522
3523
#: serverguide/C/virtualization.xml:444(title)
3524
msgid "Virtual Machine Manager"
3525
msgstr ""
3526
3527
#: serverguide/C/virtualization.xml:446(para)
3528
msgid ""
3529
"The <application>virt-manager</application> package contains a graphical "
3530
"utility to manage local and remote virtual machines. To install virt-manager "
3531
"enter:"
3532
msgstr ""
3533
3534
#: serverguide/C/virtualization.xml:451(command)
3535
msgid "sudo apt install virt-manager"
3536
msgstr "sudo apt install virt-manager"
3537
3538
#: serverguide/C/virtualization.xml:454(para)
3539
msgid ""
3540
"Since <application>virt-manager</application> requires a Graphical User "
3541
"Interface (GUI) environment it is recommended to be installed on a "
3542
"workstation or test machine instead of a production server. To connect to "
3543
"the local <application>libvirt</application> service enter:"
3544
msgstr ""
3545
3546
#: serverguide/C/virtualization.xml:461(command)
3547
msgid "virt-manager -c qemu:///system"
3548
msgstr "virt-manager -c qemu:///system"
3549
3550
#: serverguide/C/virtualization.xml:464(para)
3551
msgid ""
3552
"You can connect to the <application>libvirt</application> service running on "
3553
"another host by entering the following in a terminal prompt:"
3554
msgstr ""
3555
3556
#: serverguide/C/virtualization.xml:469(command)
3557
msgid "virt-manager -c qemu+ssh://virtnode1.mydomain.com/system"
3558
msgstr "virt-manager -c qemu+ssh://virtnode1.mydomain.com/system"
3559
3560
#: serverguide/C/virtualization.xml:473(para)
3561
msgid ""
3562
"The above example assumes that <application>SSH</application> connectivity "
3563
"between the management system and virtnode1.mydomain.com has already been "
3564
"configured, and uses SSH keys for authentication. SSH "
3565
"<emphasis>keys</emphasis> are needed because "
3566
"<application>libvirt</application> sends the password prompt to another "
3567
"process. For details on configuring <application>SSH</application> see <xref "
3568
"linkend=\"openssh-server\"/>"
3569
msgstr ""
3570
3571
#: serverguide/C/virtualization.xml:486(title)
3572
msgid "Virtual Machine Viewer"
3573
msgstr ""
3574
3575
#: serverguide/C/virtualization.xml:488(para)
3576
msgid ""
3577
"The <application>virt-viewer</application> application allows you to connect "
3578
"to a virtual machine's console. <application>virt-viewer</application> does "
3579
"require a Graphical User Interface (GUI) to interface with the virtual "
3580
"machine."
3581
msgstr ""
3582
3583
#: serverguide/C/virtualization.xml:493(para)
3584
msgid ""
3585
"To install <application>virt-viewer</application> from a terminal enter:"
3586
msgstr ""
3587
3588
#: serverguide/C/virtualization.xml:497(command)
3589
msgid "sudo apt install virt-viewer"
3590
msgstr "sudo apt install virt-viewer"
3591
3592
#: serverguide/C/virtualization.xml:500(para)
3593
msgid ""
3594
"Once a virtual machine is installed and running you can connect to the "
3595
"virtual machine's console by using:"
3596
msgstr ""
3597
3598
#: serverguide/C/virtualization.xml:504(command)
3599
msgid "virt-viewer web_devel"
3600
msgstr "virt-viewer web_devel"
3601
3602
#: serverguide/C/virtualization.xml:507(para)
3603
msgid ""
3604
"Similar to <application>virt-manager</application>, <application>virt-"
3605
"viewer</application> can connect to a remote host using "
3606
"<emphasis>SSH</emphasis> with key authentication, as well:"
3607
msgstr ""
3608
3609
#: serverguide/C/virtualization.xml:512(command)
3610
msgid "virt-viewer -c qemu+ssh://virtnode1.mydomain.com/system web_devel"
3611
msgstr "virt-viewer -c qemu+ssh://virtnode1.mydomain.com/system web_devel"
3612
3613
#: serverguide/C/virtualization.xml:515(para)
3614
msgid ""
3615
"Be sure to replace <emphasis role=\"italic\">web_devel</emphasis> with the "
3616
"appropriate virtual machine name."
3617
msgstr ""
3618
3619
#: serverguide/C/virtualization.xml:518(para)
3620
msgid ""
3621
"If configured to use a <emphasis>bridged</emphasis> network interface you "
3622
"can also setup <application>SSH</application> access to the virtual machine."
3623
msgstr ""
3624
3625
#: serverguide/C/virtualization.xml:524(title) serverguide/C/virtualization.xml:836(title) serverguide/C/virtualization.xml:907(title) serverguide/C/virtualization.xml:2842(title) serverguide/C/samba.xml:247(title) serverguide/C/samba.xml:345(title) serverguide/C/samba.xml:700(title) serverguide/C/samba.xml:1094(title) serverguide/C/samba.xml:1292(title) serverguide/C/reporting-bugs.xml:252(title) serverguide/C/remote-administration.xml:414(title) serverguide/C/other-apps.xml:151(title) serverguide/C/other-apps.xml:305(title) serverguide/C/other-apps.xml:399(title) serverguide/C/network-config.xml:588(title) serverguide/C/network-config.xml:843(title) serverguide/C/network-config.xml:1975(title) serverguide/C/network-auth.xml:2123(title) serverguide/C/network-auth.xml:2638(title) serverguide/C/network-auth.xml:3354(title) serverguide/C/network-auth.xml:3919(title) serverguide/C/network-auth.xml:4154(title) serverguide/C/installation.xml:880(title) serverguide/C/installation.xml:1166(title) serverguide/C/installation.xml:1677(title) serverguide/C/databases.xml:264(title) serverguide/C/databases.xml:419(title) serverguide/C/cgroups.xml:198(title) serverguide/C/backups.xml:870(title)
3626
msgid "Resources"
3627
msgstr "Sumber Daya"
3628
3629
#: serverguide/C/virtualization.xml:528(para)
3630
msgid ""
3631
"See the <ulink url=\"http://www.linux-kvm.org/\">KVM</ulink> home page for "
3632
"more details."
3633
msgstr ""
3634
3635
#: serverguide/C/virtualization.xml:533(para)
3636
msgid ""
3637
"For more information on <application>libvirt</application> see the <ulink "
3638
"url=\"http://libvirt.org/\">libvirt home page</ulink>"
3639
msgstr ""
3640
3641
#: serverguide/C/virtualization.xml:539(para)
3642
msgid ""
3643
"The <ulink url=\"http://virt-manager.org/\">Virtual Machine Manager</ulink> "
3644
"site has more information on <application>virt-manager</application> "
3645
"development."
3646
msgstr ""
3647
3648
#: serverguide/C/virtualization.xml:545(para)
3649
msgid ""
3650
"Also, stop by the <emphasis>#ubuntu-virt</emphasis> IRC channel on <ulink "
3651
"url=\"http://freenode.net/\">freenode</ulink> to discuss virtualization "
3652
"technology in Ubuntu."
3653
msgstr ""
3654
3655
#: serverguide/C/virtualization.xml:551(para)
3656
msgid ""
3657
"Another good resource is the <ulink "
3658
"url=\"https://help.ubuntu.com/community/KVM\">Ubuntu Wiki KVM</ulink> page."
3659
msgstr ""
3660
3661
#: serverguide/C/virtualization.xml:557(para)
3662
msgid ""
3663
"For information on Xen, including using Xen with libvirt, please see the "
3664
"<ulink url=\"https://help.ubuntu.com/community/Xen\">Ubuntu Wiki Xen</ulink> "
3665
"page."
3666
msgstr ""
3667
3668
#: serverguide/C/virtualization.xml:563(para)
3669
msgid ""
3670
"For basics how to assign VT-d devices to qemu/KVM, please see the <ulink "
3671
"url=\"http://www.linux-kvm.org/page/How_to_assign_devices_with_VT-"
3672
"d_in_KVM#Assigning_the_device\">linux-kvm</ulink> page."
3673
msgstr ""
3674
3675
#: serverguide/C/virtualization.xml:572(title)
3676
msgid "Qemu"
3677
msgstr "Qemu"
3678
3679
#: serverguide/C/virtualization.xml:573(para)
3680
msgid ""
3681
"<ulink url=\"http://wiki.qemu.org/Main_Page\">Qemu</ulink> is a machine "
3682
"emulator that can run operating systems and programs for one machine on a "
3683
"different machine. Mostly it is not used as emulator but as virtualizer in "
3684
"collaboration with KVM or XEN kernel components. In that case it utilizes "
3685
"the virtualization technology of the hardware to virtualize guests."
3686
msgstr ""
3687
3688
#: serverguide/C/virtualization.xml:577(para)
3689
msgid ""
3690
"While qemu has a <ulink url=\"http://wiki.qemu.org/download/qemu-"
3691
"doc.html#sec_005finvocation\">command line interface</ulink> and a <ulink "
3692
"url=\"http://wiki.qemu.org/download/qemu-"
3693
"doc.html#pcsys_005fmonitor\">monitor</ulink> to interact with running guests "
3694
"those is rarely used that way for other means than development purposes. "
3695
"<link linkend=\"libvirt\">Libvirt</link> provides an abstraction from "
3696
"specific versions and hypervisors and encapsulates some workarounds and best "
3697
"practices."
3698
msgstr ""
3699
3700
#: serverguide/C/virtualization.xml:582(title)
3701
msgid "Upgrading the machine type"
3702
msgstr ""
3703
3704
#: serverguide/C/virtualization.xml:583(para)
3705
msgid ""
3706
"This also is documented along some more constraints and considerations at "
3707
"the <ulink "
3708
"url=\"https://wiki.ubuntu.com/QemuKVMMigration#Upgrade_machine_type\">Ubuntu "
3709
"Wiki</ulink>"
3710
msgstr ""
3711
3712
#: serverguide/C/virtualization.xml:584(para)
3713
msgid ""
3714
"You might want to update your machine type of an existing defined guest to:"
3715
msgstr ""
3716
3717
#: serverguide/C/virtualization.xml:586(para)
3718
msgid "to pick up latest security fixes and features"
3719
msgstr ""
3720
3721
#: serverguide/C/virtualization.xml:587(para)
3722
msgid "continue using a guest created on a now unsupported release"
3723
msgstr ""
3724
3725
#: serverguide/C/virtualization.xml:589(para)
3726
msgid ""
3727
"In general it is recommended to update machine types when upgrading qemu/kvm "
3728
"to a new major version. But this can likely never be an automated task as "
3729
"this change is guest visible. The guest devices might change in appearance, "
3730
"new features will be announced to the guest and so on. Linux is usually very "
3731
"good at tolerating such changes, but it depends so much on the setup and "
3732
"workload of the guest that this has to be evaluated by the owner/admin of "
3733
"the system. Other operating systems where known to often have severe impacts "
3734
"by changing the hardware. Consider a machine type change similar to "
3735
"replacing all devices and firmware of a physical machine to the latest "
3736
"revision - all considerations that apply there apply to evaluating a machine "
3737
"type upgrade as well."
3738
msgstr ""
3739
3740
#: serverguide/C/virtualization.xml:590(para)
3741
msgid ""
3742
"As usual with major configuration changes it is wise to back up your guest "
3743
"definition and disk state to be able to do a rollback just in case. There is "
3744
"no integrated single command to update the machine type via virsh or similar "
3745
"tools. It is a normal part of your machine definition. And therefore updated "
3746
"the same way as most others."
3747
msgstr ""
3748
3749
#: serverguide/C/virtualization.xml:592(para)
3750
msgid "First shutdown your machine and wait until it has reached that state."
3751
msgstr ""
3752
3753
#: serverguide/C/virtualization.xml:593(screen)
3754
#, no-wrap
3755
msgid ""
3756
"\n"
3757
"virsh shutdown <yourmachine>\n"
3758
"# wait\n"
3759
"virsh list --inactive\n"
3760
"# should now list your machine as \"shut off\"\n"
3761
" "
3762
msgstr ""
3763
3764
#: serverguide/C/virtualization.xml:599(para)
3765
msgid ""
3766
"Then edit the machine definition and find the type in the type tag at the "
3767
"machine attribute."
3768
msgstr ""
3769
3770
#: serverguide/C/virtualization.xml:600(screen)
3771
#, no-wrap
3772
msgid ""
3773
"\n"
3774
"virsh edit <yourmachine>\n"
3775
"<type arch='x86_64' machine='pc-i440fx-xenial'>hvm</type>\n"
3776
" "
3777
msgstr ""
3778
3779
#: serverguide/C/virtualization.xml:604(para)
3780
msgid ""
3781
"Change this to the value you want. If you need to check what types are "
3782
"available via \"-M ?\" Note that while providing upstream types as "
3783
"convenience only Ubuntu types are supported. There you can also see what the "
3784
"current default would be. In general it is strongly recommended that you "
3785
"change to newer types if possible to exploit newer features, but also to "
3786
"benefit of bugfixes that only apply to the newer device virtualization."
3787
msgstr ""
3788
3789
#: serverguide/C/virtualization.xml:605(screen)
3790
#, no-wrap
3791
msgid ""
3792
"\n"
3793
"kvm -M ?\n"
3794
"# lists machine types, e.g.\n"
3795
"pc-i440fx-xenial Ubuntu 16.04 PC (i440FX + PIIX, 1996) (default)\n"
3796
"...\n"
3797
" "
3798
msgstr ""
3799
3800
#: serverguide/C/virtualization.xml:611(para)
3801
msgid ""
3802
"After this you can start your guest again. You can check the current machine "
3803
"type from guest and host depending on your needs."
3804
msgstr ""
3805
3806
#: serverguide/C/virtualization.xml:612(screen)
3807
#, no-wrap
3808
msgid ""
3809
"\n"
3810
"virsh start <yourmachine>\n"
3811
"# check from host, via dumping the active xml definition\n"
3812
"virsh dumpxml <yourmachine> | xmllint --xpath "
3813
"\"string(//domain/os/type/@machine)\" -\n"
3814
"# or from the guest via dmidecode\n"
3815
"sudo dmidecode | grep Product -A 1\n"
3816
" Product Name: Standard PC (i440FX + PIIX, 1996)\n"
3817
" Version: pc-i440fx-xenial\n"
3818
" "
3819
msgstr ""
3820
3821
#: serverguide/C/virtualization.xml:621(para)
3822
msgid ""
3823
"If you keep non-live definitions around like xml files remember to update "
3824
"those as well."
3825
msgstr ""
3826
3827
#: serverguide/C/virtualization.xml:626(title)
3828
msgid "Cloud images and uvtool"
3829
msgstr ""
3830
3831
#: serverguide/C/virtualization.xml:629(title) serverguide/C/security.xml:366(title) serverguide/C/samba.xml:23(title) serverguide/C/remote-administration.xml:18(title) serverguide/C/package-management.xml:18(title) serverguide/C/introduction.xml:11(title) serverguide/C/installation.xml:1374(title)
3832
msgid "Introduction"
3833
msgstr "Pengenalan"
3834
3835
#: serverguide/C/virtualization.xml:631(para)
3836
msgid ""
3837
"With Ubuntu being one of the most used operating systems on many cloud "
3838
"platforms, the availability of stable and secure cloud images has become "
3839
"very important. As of 12.04 the utilization of cloud images outside of a "
3840
"cloud infrastructure has been improved. It is now possible to use those "
3841
"images to create a virtual machine without the need of a complete "
3842
"installation."
3843
msgstr ""
3844
3845
#: serverguide/C/virtualization.xml:639(title)
3846
msgid "Creating virtual machines using uvtool"
3847
msgstr ""
3848
3849
#: serverguide/C/virtualization.xml:641(para)
3850
msgid ""
3851
"Starting with 14.04 LTS, a tool called uvtool greatly facilitates the task "
3852
"of generating virtual machines (VM) using the cloud images. "
3853
"<application>uvtool</application> provides a simple mechanism to synchronize "
3854
"cloud-images locally and use them to create new VMs in minutes."
3855
msgstr ""
3856
3857
#: serverguide/C/virtualization.xml:648(title)
3858
msgid "Uvtool packages"
3859
msgstr ""
3860
3861
#: serverguide/C/virtualization.xml:650(para)
3862
msgid ""
3863
"The following packages and their dependencies will be required in order to "
3864
"use uvtool:"
3865
msgstr ""
3866
3867
#: serverguide/C/virtualization.xml:657(para)
3868
msgid "uvtool"
3869
msgstr "uvtool"
3870
3871
#: serverguide/C/virtualization.xml:661(para)
3872
msgid "uvtool-libvirt"
3873
msgstr "uvtool-libvirt"
3874
3875
#: serverguide/C/virtualization.xml:666(para)
3876
msgid "To install <application>uvtool</application>, run:"
3877
msgstr ""
3878
3879
#: serverguide/C/virtualization.xml:667(programlisting)
3880
#, no-wrap
3881
msgid "$ apt -y install uvtool"
3882
msgstr "$ apt -y install uvtool"
3883
3884
#: serverguide/C/virtualization.xml:669(para)
3885
msgid "This will install uvtool's main commands:"
3886
msgstr ""
3887
3888
#: serverguide/C/virtualization.xml:671(application)
3889
msgid "uvt-simplestreams-libvirt"
3890
msgstr "uvt-simplestreams-libvirt"
3891
3892
#: serverguide/C/virtualization.xml:672(application)
3893
msgid "uvt-kvm"
3894
msgstr "uvt-kvm"
3895
3896
#: serverguide/C/virtualization.xml:677(title)
3897
msgid ""
3898
"Get the Ubuntu Cloud Image with <application>uvt-simplestreams-"
3899
"libvirt</application>"
3900
msgstr ""
3901
3902
#: serverguide/C/virtualization.xml:679(para)
3903
msgid ""
3904
"This is one of the major simplifications that "
3905
"<application>uvtool</application> brings. It is aware of where to find the "
3906
"cloud images so only one command is required to get a new cloud image. For "
3907
"instance, if you want to synchronize all cloud images for the amd64 "
3908
"architecture, the uvtool command would be:"
3909
msgstr ""
3910
3911
#: serverguide/C/virtualization.xml:684(programlisting)
3912
#, no-wrap
3913
msgid "$ uvt-simplestreams-libvirt sync arch=amd64"
3914
msgstr "$ uvt-simplestreams-libvirt sync arch=amd64"
3915
3916
#: serverguide/C/virtualization.xml:686(para)
3917
msgid ""
3918
"After an amount of time required to download all the images from the "
3919
"Internet, you will have a complete set of cloud images stored locally. To "
3920
"see what has been downloaded use the following command:"
3921
msgstr ""
3922
3923
#: serverguide/C/virtualization.xml:690(programlisting)
3924
#, no-wrap
3925
msgid ""
3926
"$ uvt-simplestreams-libvirt query\n"
3927
"release=oneiric arch=amd64 label=release (20130509)\n"
3928
"release=precise arch=amd64 label=release (20160315)\n"
3929
"release=quantal arch=amd64 label=release (20140409)\n"
3930
"release=raring arch=amd64 label=release (20140111)\n"
3931
"release=saucy arch=amd64 label=release (20140709)\n"
3932
"release=trusty arch=amd64 label=release (20160314)\n"
3933
"release=utopic arch=amd64 label=release (20150723)\n"
3934
"release=vivid arch=amd64 label=release (20160203)\n"
3935
"release=wily arch=amd64 label=release (20160315)\n"
3936
"release=xenial arch=amd64 label=beta1 (20160223.1)\n"
3937
"\n"
3938
msgstr ""
3939
3940
#: serverguide/C/virtualization.xml:704(para)
3941
msgid ""
3942
"In the case where you want to synchronize only one specific cloud-image, you "
3943
"need to use the release= and arch= filters to identify which image needs to "
3944
"be synchronized."
3945
msgstr ""
3946
3947
#: serverguide/C/virtualization.xml:707(programlisting)
3948
#, no-wrap
3949
msgid "$ uvt-simplestreams-libvirt sync release=xenial arch=amd64\n"
3950
msgstr "$ uvt-simplestreams-libvirt sync release=xenial arch=amd64\n"
3951
3952
#: serverguide/C/virtualization.xml:712(title)
3953
msgid "Create the VM using uvt-kvm"
3954
msgstr ""
3955
3956
#: serverguide/C/virtualization.xml:714(para)
3957
msgid ""
3958
"In order to connect to the virtual machine once it has been created, you "
3959
"must have a valid SSH key available for the Ubuntu user. If your environment "
3960
"does not have an SSH key, you can easily create one using the following "
3961
"command:"
3962
msgstr ""
3963
3964
#: serverguide/C/virtualization.xml:716(programlisting)
3965
#, no-wrap
3966
msgid ""
3967
"\n"
3968
"$ ssh-keygen\n"
3969
"Generating public/private rsa key pair.\n"
3970
"Enter file in which to save the key (/home/ubuntu/.ssh/id_rsa): \n"
3971
"Enter passphrase (empty for no passphrase): \n"
3972
"Enter same passphrase again: \n"
3973
"Your identification has been saved in /home/ubuntu/.ssh/id_rsa.\n"
3974
"Your public key has been saved in /home/ubuntu/.ssh/id_rsa.pub.\n"
3975
"The key fingerprint is:\n"
3976
"4d:ba:5d:57:c9:49:ef:b5:ab:71:14:56:6e:2b:ad:9b ubuntu@xenialS\n"
3977
"The key's randomart image is:\n"
3978
"+--[ RSA 2048]----+\n"
3979
"| ..|\n"
3980
"| o.=|\n"
3981
"| . **|\n"
3982
"| + o+=|\n"
3983
"| S . ...=.|\n"
3984
"| o . .+ .|\n"
3985
"| . . o o |\n"
3986
"| * |\n"
3987
"| E |\n"
3988
"+-----------------+\n"
3989
msgstr ""
3990
3991
#: serverguide/C/virtualization.xml:739(para)
3992
msgid ""
3993
"To create of a new virtual machine using uvtool, run the following in a "
3994
"terminal:"
3995
msgstr ""
3996
3997
#: serverguide/C/virtualization.xml:741(programlisting)
3998
#, no-wrap
3999
msgid "$ uvt-kvm create firsttest"
4000
msgstr "$ uvt-kvm create firsttest"
4001
4002
#: serverguide/C/virtualization.xml:743(para)
4003
msgid ""
4004
"This will create a VM named <emphasis role=\"bold\">firsttest</emphasis> "
4005
"using the current LTS cloud image available locally. If you want to specify "
4006
"a release to be used to create the VM, you need to use the <emphasis "
4007
"role=\"bold\">release=</emphasis> filter:"
4008
msgstr ""
4009
4010
#: serverguide/C/virtualization.xml:746(programlisting)
4011
#, no-wrap
4012
msgid "$ uvt-kvm create secondtest release=xenial"
4013
msgstr "$ uvt-kvm create secondtest release=xenial"
4014
4015
#: serverguide/C/virtualization.xml:748(para)
4016
msgid ""
4017
"<application>uvt-kvm wait</application> can be used to wait until the "
4018
"creation of the VM has completed:"
4019
msgstr ""
4020
4021
#: serverguide/C/virtualization.xml:751(programlisting)
4022
#, no-wrap
4023
msgid ""
4024
"$ uvt-kvm wait secondttest --insecure\n"
4025
"Warning: secure wait for boot-finished not yet implemented; use --insecure.\n"
4026
msgstr ""
4027
4028
#: serverguide/C/virtualization.xml:756(title)
4029
msgid "Connect to the running VM"
4030
msgstr ""
4031
4032
#: serverguide/C/virtualization.xml:757(para)
4033
msgid ""
4034
"Once the virtual machine creation is completed, you can connect to it using "
4035
"SSH:"
4036
msgstr ""
4037
4038
#: serverguide/C/virtualization.xml:760(programlisting)
4039
#, no-wrap
4040
msgid "$ uvt-kvm ssh secondtest --insecure"
4041
msgstr "$ uvt-kvm ssh secondtest --insecure"
4042
4043
#: serverguide/C/virtualization.xml:762(para)
4044
msgid ""
4045
"For the time being, the <emphasis role=\"bold\">--insecure</emphasis> is "
4046
"required, so use this mechanism to connect to your VM only if you completely "
4047
"trust your network infrastructure."
4048
msgstr ""
4049
4050
#: serverguide/C/virtualization.xml:764(para)
4051
msgid ""
4052
"You can also connect to your VM using a regular SSH session using the IP "
4053
"address of the VM. The address can be queried using the following command:"
4054
msgstr ""
4055
4056
#: serverguide/C/virtualization.xml:766(programlisting)
4057
#, no-wrap
4058
msgid ""
4059
"\n"
4060
"$ uvt-kvm ip secondtest\n"
4061
"192.168.122.199\n"
4062
"$ ssh -i ~/.ssh/id_rsa ubuntu@192.168.122.199\n"
4063
"The authenticity of host '192.168.122.199 (192.168.122.199)' can't be "
4064
"established.\n"
4065
"ECDSA key fingerprint is "
4066
"SHA256:8oxaztRWzTMtv8SC9LYyjuqBu79Z9JP8bUGh6G8R8cw.\n"
4067
"Are you sure you want to continue connecting (yes/no)? yes\n"
4068
"Warning: Permanently added '192.168.122.199' (ECDSA) to the list of known "
4069
"hosts.\n"
4070
"Welcome to Ubuntu Xenial Xerus (development branch) (GNU/Linux 4.4.0-X-"
4071
"generic ARCH)\n"
4072
"\n"
4073
" * Documentation: https://help.ubuntu.com/\n"
4074
"\n"
4075
" Get cloud support with Ubuntu Advantage Cloud Guest:\n"
4076
" http://www.ubuntu.com/business/services/cloud\n"
4077
"\n"
4078
"0 packages can be updated.\n"
4079
"0 updates are security updates.\n"
4080
"\n"
4081
"\n"
4082
"\n"
4083
"The programs included with the Ubuntu system are free software;\n"
4084
"the exact distribution terms for each program are described in the\n"
4085
"individual files in /usr/share/doc/*/copyright.\n"
4086
"\n"
4087
"Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by\n"
4088
"applicable law.\n"
4089
"\n"
4090
"To run a command as administrator (user \"root\"), use \"sudo "
4091
"<command>\".\n"
4092
"See \"man sudo_root\" for details.\n"
4093
"\n"
4094
"ubuntu@secondtest:~$ \n"
4095
"\n"
4096
msgstr ""
4097
4098
#: serverguide/C/virtualization.xml:801(title)
4099
msgid "Get the list of running VMs"
4100
msgstr ""
4101
4102
#: serverguide/C/virtualization.xml:802(para)
4103
msgid "You can get the list of VMs running on your system with this command:"
4104
msgstr ""
4105
4106
#: serverguide/C/virtualization.xml:804(programlisting)
4107
#, no-wrap
4108
msgid ""
4109
"$ uvt-kvm list\n"
4110
"secondtest\n"
4111
msgstr ""
4112
"$ uvt-kvm list\n"
4113
"secondtest\n"
4114
4115
#: serverguide/C/virtualization.xml:809(title)
4116
msgid "Destroy your VM"
4117
msgstr ""
4118
4119
#: serverguide/C/virtualization.xml:810(para)
4120
msgid "Once you are done with your VM, you can destroy it with:"
4121
msgstr ""
4122
4123
#: serverguide/C/virtualization.xml:812(programlisting)
4124
#, no-wrap
4125
msgid "$ uvt-kvm destroy secondtest"
4126
msgstr "$ uvt-kvm destroy secondtest"
4127
4128
#: serverguide/C/virtualization.xml:814(title)
4129
msgid "More uvt-kvm options"
4130
msgstr ""
4131
4132
#: serverguide/C/virtualization.xml:816(para)
4133
msgid ""
4134
"The following options can be used to change some of the characteristics of "
4135
"the VM that you are creating:"
4136
msgstr ""
4137
4138
#: serverguide/C/virtualization.xml:819(para)
4139
msgid "--memory : Amount of RAM in megabytes. Default: 512."
4140
msgstr ""
4141
4142
#: serverguide/C/virtualization.xml:820(para)
4143
msgid "--disk : Size of the OS disk in gigabytes. Default: 8."
4144
msgstr ""
4145
4146
#: serverguide/C/virtualization.xml:821(para)
4147
msgid "--cpu : Number of CPU cores. Default: 1."
4148
msgstr ""
4149
4150
#: serverguide/C/virtualization.xml:824(para)
4151
msgid ""
4152
"Some other parameters will have an impact on the cloud-init configuration:"
4153
msgstr ""
4154
4155
#: serverguide/C/virtualization.xml:826(para)
4156
msgid ""
4157
"--password password : Allow login to the VM using the Ubuntu account and "
4158
"this provided password."
4159
msgstr ""
4160
4161
#: serverguide/C/virtualization.xml:827(para)
4162
msgid ""
4163
"--run-script-once script_file : Run script_file as root on the VM the first "
4164
"time it is booted, but never again."
4165
msgstr ""
4166
4167
#: serverguide/C/virtualization.xml:828(para)
4168
msgid ""
4169
"--packages package_list : Install the comma-separated packages specified in "
4170
"package_list on first boot."
4171
msgstr ""
4172
4173
#: serverguide/C/virtualization.xml:831(para)
4174
msgid ""
4175
"A complete description of all available modifiers is available in the "
4176
"manpage of uvt-kvm."
4177
msgstr ""
4178
4179
#: serverguide/C/virtualization.xml:838(para)
4180
msgid ""
4181
"If you are interested in learning more, have questions or suggestions, "
4182
"please contact the Ubuntu Server Team at:"
4183
msgstr ""
4184
4185
#: serverguide/C/virtualization.xml:843(para)
4186
msgid "IRC: #ubuntu-server on freenode"
4187
msgstr ""
4188
4189
#: serverguide/C/virtualization.xml:847(para)
4190
msgid ""
4191
"Mailing list: <ulink url=\"https://lists.ubuntu.com/mailman/listinfo/ubuntu-"
4192
"server\">ubuntu-server at lists.ubuntu.com</ulink>"
4193
msgstr ""
4194
4195
#: serverguide/C/virtualization.xml:856(title)
4196
msgid "Ubuntu Cloud"
4197
msgstr ""
4198
4199
#: serverguide/C/virtualization.xml:858(para)
4200
msgid ""
4201
"<application>Cloud computing</application> is a computing model that allows "
4202
"vast pools of resources to be allocated on-demand. These resources such as "
4203
"storage, computing power, network and software are abstracted and delivered "
4204
"as a service over the Internet anywhere, anytime. These services are billed "
4205
"per time consumed similar to the ones used by public services such as "
4206
"electricity, water and telephony. <application>Ubuntu Cloud "
4207
"Infrastructure</application> uses OpenStack open source software to help "
4208
"build highly scalable, cloud computing for both public and private clouds."
4209
msgstr ""
4210
4211
#: serverguide/C/virtualization.xml:869(title)
4212
msgid "Installation and Configuration"
4213
msgstr ""
4214
4215
#: serverguide/C/virtualization.xml:871(para)
4216
msgid ""
4217
"Due to the current high rate of development of this complex technology we "
4218
"refer the reader to <ulink url=\"http://docs.openstack.org/havana/install-"
4219
"guide/install/apt/content/\"> upstream documentation</ulink> for all matters "
4220
"concerning installation and configuration."
4221
msgstr ""
4222
4223
#: serverguide/C/virtualization.xml:880(title) serverguide/C/network-config.xml:1728(title)
4224
msgid "Support and Troubleshooting"
4225
msgstr ""
4226
4227
#: serverguide/C/virtualization.xml:882(para)
4228
msgid "Community Support"
4229
msgstr ""
4230
4231
#: serverguide/C/virtualization.xml:886(ulink)
4232
msgid "OpenStack Mailing list"
4233
msgstr ""
4234
4235
#: serverguide/C/virtualization.xml:891(ulink)
4236
msgid "The OpenStack Wiki search"
4237
msgstr ""
4238
4239
#: serverguide/C/virtualization.xml:896(ulink)
4240
msgid "Launchpad bugs area"
4241
msgstr ""
4242
4243
#: serverguide/C/virtualization.xml:901(para)
4244
msgid "Join the IRC channel #openstack on freenode."
4245
msgstr ""
4246
4247
#: serverguide/C/virtualization.xml:912(ulink)
4248
msgid "Cloud Computing - Service models"
4249
msgstr ""
4250
4251
#: serverguide/C/virtualization.xml:918(ulink)
4252
msgid "OpenStack Compute"
4253
msgstr ""
4254
4255
#: serverguide/C/virtualization.xml:924(ulink)
4256
msgid "OpenStack Image Service"
4257
msgstr ""
4258
4259
#: serverguide/C/virtualization.xml:930(ulink)
4260
msgid "OpenStack Object Storage Administration Guide"
4261
msgstr ""
4262
4263
#: serverguide/C/virtualization.xml:936(ulink)
4264
msgid "Installing OpenStack Object Storage on Ubuntu"
4265
msgstr ""
4266
4267
#: serverguide/C/virtualization.xml:942(ulink)
4268
msgid "http://cloudglossary.com/"
4269
msgstr "http://cloudglossary.com/"
4270
4271
#: serverguide/C/virtualization.xml:952(title)
4272
msgid "LXD"
4273
msgstr "LXD"
4274
4275
#: serverguide/C/virtualization.xml:954(para)
4276
msgid ""
4277
"LXD (pronounced lex-dee) is the lightervisor, or lightweight container "
4278
"hypervisor. While this claim has been controversial, it has been <ulink "
4279
"url=\"http://blog.dustinkirkland.com/2015/09/container-summit-presentation-"
4280
"and-live.html\">quite well justified</ulink> based on the original academic "
4281
"paper. It also nicely distinguishes LXD from <ulink "
4282
"url=\"https://help.ubuntu.com/lts/serverguide/lxc.html\">LXC</ulink>."
4283
msgstr ""
4284
4285
#: serverguide/C/virtualization.xml:963(para)
4286
msgid ""
4287
"LXC (lex-see) is a program which creates and administers \"containers\" on a "
4288
"local system. It also provides an API to allow higher level managers, such "
4289
"as LXD, to administer containers. In a sense, one could compare LXC to QEMU, "
4290
"while comparing LXD to libvirt."
4291
msgstr ""
4292
4293
#: serverguide/C/virtualization.xml:970(para)
4294
msgid ""
4295
"The LXC API deals with a 'container'. The LXD API deals with 'remotes', "
4296
"which serve images and containers. This extends the LXC functionality over "
4297
"the network, and allows concise management of tasks like container migration "
4298
"and container image publishing."
4299
msgstr ""
4300
4301
#: serverguide/C/virtualization.xml:977(para)
4302
msgid ""
4303
"LXD uses LXC under the covers for some container management tasks. However, "
4304
"it keeps its own container configuration information and has its own "
4305
"conventions, so that it is best not to use classic LXC commands by hand with "
4306
"LXD containers. This document will focus on how to configure and administer "
4307
"LXD on Ubuntu systems."
4308
msgstr ""
4309
4310
#: serverguide/C/virtualization.xml:985(title)
4311
msgid "Online Resources"
4312
msgstr ""
4313
4314
#: serverguide/C/virtualization.xml:987(para)
4315
msgid ""
4316
"There is excellent documentation for <ulink "
4317
"url=\"http://github.com/lxc/lxd\">getting started with LXD</ulink> in the "
4318
"online LXD README. There is also an online server allowing you to <ulink "
4319
"url=\"http://linuxcontainers.org/lxd/try-it\">try out LXD remotely</ulink>. "
4320
"Stephane Graber also has an <ulink "
4321
"url=\"https://www.stgraber.org/2016/03/11/lxd-2-0-blog-post-series-"
4322
"012/\">excellent blog series</ulink> on LXD 2.0. Finally, there is great "
4323
"documentation on how to <ulink "
4324
"url=\"https://jujucharms.com/docs/devel/config-LXD\">drive lxd using "
4325
"juju</ulink>."
4326
msgstr ""
4327
4328
#: serverguide/C/virtualization.xml:994(para)
4329
msgid ""
4330
"This document will offer an Ubuntu Server-specific view of LXD, focusing on "
4331
"administration."
4332
msgstr ""
4333
4334
#: serverguide/C/virtualization.xml:1002(para)
4335
msgid ""
4336
"LXD is pre-installed on Ubuntu Server cloud images. On other systems, the "
4337
"lxd package can be installed using:"
4338
msgstr ""
4339
4340
#: serverguide/C/virtualization.xml:1008(command)
4341
msgid "sudo apt install lxd"
4342
msgstr "sudo apt install lxd"
4343
4344
#: serverguide/C/virtualization.xml:1013(para)
4345
msgid ""
4346
"This will install LXD as well as the recommended dependencies, including the "
4347
"LXC library and lxcfs."
4348
msgstr ""
4349
4350
#: serverguide/C/virtualization.xml:1019(title)
4351
msgid "Kernel preparation"
4352
msgstr ""
4353
4354
#: serverguide/C/virtualization.xml:1021(para)
4355
msgid ""
4356
"In general, Ubuntu 16.04 should have all the desired features enabled by "
4357
"default. One exception to this is that in order to enable swap accounting "
4358
"the boot argument <command>swapaccount=1</command> must be set. This can be "
4359
"done by appending it to the "
4360
"<command>GRUB_CMDLINE_LINUX_DEFAULT=</command>variable in /etc/default/grub, "
4361
"then running 'update-grub' as root and rebooting."
4362
msgstr ""
4363
4364
#: serverguide/C/virtualization.xml:1033(para)
4365
msgid ""
4366
"By default, LXD is installed listening on a local UNIX socket, which members "
4367
"of group LXD can talk to. It has no trust password setup. And it uses the "
4368
"filesystem at <filename>/var/lib/lxd</filename> to store containers. To "
4369
"configure LXD with different settings, use <command>lxd init</command>. This "
4370
"will allow you to choose:"
4371
msgstr ""
4372
4373
#: serverguide/C/virtualization.xml:1043(para)
4374
msgid ""
4375
"Directory or <ulink url=\"http://open-zfs.org\">ZFS</ulink> container "
4376
"backend. If you choose ZFS, you can choose which block devices to use, or "
4377
"the size of a file to use as backing store."
4378
msgstr ""
4379
4380
#: serverguide/C/virtualization.xml:1047(para)
4381
msgid "Availability over the network"
4382
msgstr ""
4383
4384
#: serverguide/C/virtualization.xml:1049(para)
4385
msgid ""
4386
"A 'trust password' used by remote clients to vouch for their client "
4387
"certificate"
4388
msgstr ""
4389
4390
#: serverguide/C/virtualization.xml:1053(para)
4391
msgid ""
4392
"You must run 'lxd init' as root. 'lxc' commands can be run as any user who "
4393
"is member of group lxd. If user joe is not a member of group 'lxd', you may "
4394
"run:"
4395
msgstr ""
4396
4397
#: serverguide/C/virtualization.xml:1060(command)
4398
msgid "adduser joe lxd"
4399
msgstr "adduser joe lxd"
4400
4401
#: serverguide/C/virtualization.xml:1065(para)
4402
msgid ""
4403
"as root to change it. The new membership will take effect on the next login, "
4404
"or after running 'newgrp lxd' from an existing login."
4405
msgstr ""
4406
4407
#: serverguide/C/virtualization.xml:1070(para)
4408
msgid ""
4409
"For more information on server, container, profile, and device "
4410
"configuration, please refer to the definitive configuration provided with "
4411
"the source code, which can be found <ulink "
4412
"url=\"https://github.com/lxc/lxd/blob/master/doc/configuration.md\">online</u"
4413
"link>"
4414
msgstr ""
4415
4416
#: serverguide/C/virtualization.xml:1078(title)
4417
msgid "Creating your first container"
4418
msgstr ""
4419
4420
#: serverguide/C/virtualization.xml:1080(para)
4421
msgid "This section will describe the simplest container tasks."
4422
msgstr ""
4423
4424
#: serverguide/C/virtualization.xml:1084(title)
4425
msgid "Creating a container"
4426
msgstr ""
4427
4428
#: serverguide/C/virtualization.xml:1086(para)
4429
msgid ""
4430
"Every new container is created based on either an image, an existing "
4431
"container, or a container snapshot. At install time, LXD is configured with "
4432
"the following image servers:"
4433
msgstr ""
4434
4435
#: serverguide/C/virtualization.xml:1094(para)
4436
msgid ""
4437
"<filename>ubuntu</filename>: this serves official Ubuntu server cloud image "
4438
"releases."
4439
msgstr ""
4440
4441
#: serverguide/C/virtualization.xml:1097(para)
4442
msgid ""
4443
"<filename>ubuntu-daily</filename>: this serves official Ubuntu server cloud "
4444
"images of the daily development releases."
4445
msgstr ""
4446
4447
#: serverguide/C/virtualization.xml:1101(para)
4448
msgid ""
4449
"<filename>images</filename>: this is a default-installed alias for "
4450
"images.linuxcontainers.org. This is serves classical lxc images built using "
4451
"the same images which the LXC 'download' template uses. This includes "
4452
"various distributions and minimal custom-made Ubuntu images. This is not the "
4453
"recommended server for Ubuntu images."
4454
msgstr ""
4455
4456
#: serverguide/C/virtualization.xml:1109(para)
4457
msgid "The command to create and start a container is"
4458
msgstr ""
4459
4460
#: serverguide/C/virtualization.xml:1114(command)
4461
msgid "lxc launch remote:image containername"
4462
msgstr ""
4463
4464
#: serverguide/C/virtualization.xml:1119(para)
4465
msgid ""
4466
"Images are identified by their hash, but are also aliased. The 'ubuntu' "
4467
"server knows many aliases such as '16.04' and 'xenial'. A list of all images "
4468
"available from the Ubuntu Server can be seen using:"
4469
msgstr ""
4470
4471
#: serverguide/C/virtualization.xml:1126(command) serverguide/C/virtualization.xml:1650(command)
4472
msgid "lxc image list ubuntu:"
4473
msgstr ""
4474
4475
#: serverguide/C/virtualization.xml:1131(para)
4476
msgid ""
4477
"To see more information about a particular image, including all the aliases "
4478
"it is known by, you can use:"
4479
msgstr ""
4480
4481
#: serverguide/C/virtualization.xml:1137(command)
4482
msgid "lxc image info ubuntu:xenial"
4483
msgstr ""
4484
4485
#: serverguide/C/virtualization.xml:1142(para)
4486
msgid ""
4487
"You can generally refer to an Ubuntu image using the release name ('xenial') "
4488
"or the release number (16.04). In addition, 'lts' is an alias for the latest "
4489
"supported LTS release. To choose a different architecture, you can specify "
4490
"the desired architecture:"
4491
msgstr ""
4492
4493
#: serverguide/C/virtualization.xml:1150(command)
4494
msgid "lxc image info ubuntu:lts/arm64"
4495
msgstr ""
4496
4497
#: serverguide/C/virtualization.xml:1155(para)
4498
msgid "Now, let's start our first container:"
4499
msgstr ""
4500
4501
#: serverguide/C/virtualization.xml:1160(command)
4502
msgid "lxc launch ubuntu:xenial x1"
4503
msgstr ""
4504
4505
#: serverguide/C/virtualization.xml:1165(para)
4506
msgid ""
4507
"This will download the official current Xenial cloud image for your current "
4508
"architecture, then create a container using that image, and finally start "
4509
"it. Once the command returns, you can see it using:"
4510
msgstr ""
4511
4512
#: serverguide/C/virtualization.xml:1172(command)
4513
msgid "lxc list lxc info x1"
4514
msgstr "lxc list lxc info x1"
4515
4516
#: serverguide/C/virtualization.xml:1178(para)
4517
msgid "and open a shell in it using:"
4518
msgstr ""
4519
4520
#: serverguide/C/virtualization.xml:1183(command)
4521
msgid "lxc exec x1 bash"
4522
msgstr "lxc exec x1 bash"
4523
4524
#: serverguide/C/virtualization.xml:1188(para)
4525
msgid ""
4526
"The try-it page gives a full synopsis of the commands you can use to "
4527
"administer containers."
4528
msgstr ""
4529
4530
#: serverguide/C/virtualization.xml:1193(para)
4531
msgid ""
4532
"Now that the 'xenial' image has been downloaded, it will be kept in sync "
4533
"until no new containers have been created based on it for (by default) 10 "
4534
"days. After that, it will be deleted."
4535
msgstr ""
4536
4537
#: serverguide/C/virtualization.xml:1201(title)
4538
msgid "LXD Server Configuration"
4539
msgstr ""
4540
4541
#: serverguide/C/virtualization.xml:1203(para)
4542
msgid ""
4543
"By default, LXD is socket activated and configured to listen only on a local "
4544
"UNIX socket. While LXD may not be running when you first look at the process "
4545
"listing, any LXC command will start it up. For instance:"
4546
msgstr ""
4547
4548
#: serverguide/C/virtualization.xml:1210(command)
4549
msgid "lxc list"
4550
msgstr "lxc list"
4551
4552
#: serverguide/C/virtualization.xml:1215(para)
4553
msgid ""
4554
"This will create your client certificate and contact the LXD server for a "
4555
"list of containers. To make the server accessible over the network you can "
4556
"set the http port using:"
4557
msgstr ""
4558
4559
#: serverguide/C/virtualization.xml:1222(command)
4560
msgid "lxc config set core.https_address :8443"
4561
msgstr ""
4562
4563
#: serverguide/C/virtualization.xml:1227(para)
4564
msgid "This will tell LXD to listen to port 8843 on all addresses."
4565
msgstr ""
4566
4567
#: serverguide/C/virtualization.xml:1231(title)
4568
msgid "Authentication"
4569
msgstr ""
4570
4571
#: serverguide/C/virtualization.xml:1233(para)
4572
msgid ""
4573
"By default, LXD will allow all members of group 'lxd' (which by default "
4574
"includes all members of group admin) to talk to it over the UNIX socket. "
4575
"Communication over the network is authorized using server and client "
4576
"certificates."
4577
msgstr ""
4578
4579
#: serverguide/C/virtualization.xml:1239(para)
4580
msgid ""
4581
"Before client c1 wishes to use remote r1, r1 must be registered using:"
4582
msgstr ""
4583
4584
#: serverguide/C/virtualization.xml:1244(command)
4585
msgid "lxc remote add r1 r1.example.com:8443"
4586
msgstr ""
4587
4588
#: serverguide/C/virtualization.xml:1249(para)
4589
msgid ""
4590
"The fingerprint of r1's certificate will be shown, to allow the user at c1 "
4591
"to reject a false certificate. The server in turn will verify that c1 may be "
4592
"trusted in one of two ways. The first is to register it in advance from any "
4593
"already-registered client, using:"
4594
msgstr ""
4595
4596
#: serverguide/C/virtualization.xml:1257(command)
4597
msgid "lxc config trust add r1 certfile.crt"
4598
msgstr ""
4599
4600
#: serverguide/C/virtualization.xml:1262(para)
4601
msgid ""
4602
"Now when the client adds r1 as a known remote, it will not need to provide a "
4603
"password as it is already trusted by the server."
4604
msgstr ""
4605
4606
#: serverguide/C/virtualization.xml:1267(para)
4607
msgid ""
4608
"The other is to configure a 'trust password' with r1, either at initial "
4609
"configuration using 'lxd init', or after the fact using"
4610
msgstr ""
4611
4612
#: serverguide/C/virtualization.xml:1273(command)
4613
msgid "lxc config set core.trust_password PASSWORD"
4614
msgstr ""
4615
4616
#: serverguide/C/virtualization.xml:1278(para)
4617
msgid ""
4618
"The password can then be provided when the client registers r1 as a known "
4619
"remote."
4620
msgstr ""
4621
4622
#: serverguide/C/virtualization.xml:1285(title)
4623
msgid "Backing store"
4624
msgstr ""
4625
4626
#: serverguide/C/virtualization.xml:1287(para)
4627
msgid ""
4628
"LXD supports several backing stores. The recommended backing store is ZFS, "
4629
"however this is not available on all platforms. Supported backing stores "
4630
"include:"
4631
msgstr ""
4632
4633
#: serverguide/C/virtualization.xml:1295(para)
4634
msgid ""
4635
"ext4: this is the default, and easiest to use. With an ext4 backing store, "
4636
"containers and images are simply stored as directories on the host "
4637
"filesystem. Launching new containers requires copying a whole filesystem, "
4638
"and 10 containers will take up 10 times as much space as one container."
4639
msgstr ""
4640
4641
#: serverguide/C/virtualization.xml:1304(para)
4642
msgid ""
4643
"ZFS: if ZFS is supported on your architecture (amd64, arm64, or ppc64le), "
4644
"you can set LXD up to use it using 'lxd init'. If you already have a ZFS "
4645
"pool configured, you can tell LXD to use it by setting the zfs_pool_name "
4646
"configuration key:"
4647
msgstr ""
4648
4649
#: serverguide/C/virtualization.xml:1312(command)
4650
msgid "lxc config set storage.zfs_pool_name lxd"
4651
msgstr "lxc config set storage.zfs_pool_name lxd"
4652
4653
#: serverguide/C/virtualization.xml:1317(para)
4654
msgid ""
4655
"With ZFS, launching a new container is fast because the filesystem starts as "
4656
"a copy on write clone of the images' filesystem. Note that unless the "
4657
"container is privileged (see below) LXD will need to change ownership of all "
4658
"files before the container can start, however this is fast and change very "
4659
"little of the actual filesystem data."
4660
msgstr ""
4661
4662
#: serverguide/C/virtualization.xml:1327(para)
4663
msgid ""
4664
"Btrfs: btrfs can be used with many of the same advantages as ZFS. To use "
4665
"BTRFS as a LXD backing store, simply mount a Btrfs filesystem under "
4666
"<filename>/var/lib/lxd</filename>. LXD will detect this and exploit the "
4667
"Btrfs subvolume feature whenever launching a new container or snapshotting a "
4668
"container."
4669
msgstr ""
4670
4671
#: serverguide/C/virtualization.xml:1337(para)
4672
msgid ""
4673
"LVM: To use a LVM volume group called 'lxd', you may tell LXD to use that "
4674
"for containers and images using the command"
4675
msgstr ""
4676
4677
#: serverguide/C/virtualization.xml:1343(command)
4678
msgid "lxc config set storage.lvm_vg_name lxd"
4679
msgstr "lxc config set storage.lvm_vg_name lxd"
4680
4681
#: serverguide/C/virtualization.xml:1348(para)
4682
msgid ""
4683
"When launching a new container, its rootfs will start as a lv clone. It is "
4684
"immediately mounted so that the file uids can be shifted, then unmounted. "
4685
"Container snapshots also are created as lv snapshots."
4686
msgstr ""
4687
4688
#: serverguide/C/virtualization.xml:1358(title)
4689
msgid "Container configuration"
4690
msgstr ""
4691
4692
#: serverguide/C/virtualization.xml:1360(para)
4693
msgid ""
4694
"Containers are configured according to a set of profiles, described in the "
4695
"next section, and a set of container-specific configuration. Profiles are "
4696
"applied first, so that container specific configuration can override profile "
4697
"configuration."
4698
msgstr ""
4699
4700
#: serverguide/C/virtualization.xml:1367(para)
4701
msgid ""
4702
"Container configuration includes properties like the architecture, limits on "
4703
"resources such as CPU and RAM, security details including apparmor "
4704
"restriction overrides, and devices to apply to the container."
4705
msgstr ""
4706
4707
#: serverguide/C/virtualization.xml:1373(para)
4708
msgid ""
4709
"Devices can be of several types, including UNIX character, UNIX block, "
4710
"network interface, or 'disk'. In order to insert a host mount into a "
4711
"container, a 'disk' device type would be used. For instance, to mount /opt "
4712
"in container c1 at /opt, you could use:"
4713
msgstr ""
4714
4715
#: serverguide/C/virtualization.xml:1381(command)
4716
msgid "lxc config device add c1 opt disk source=/opt path=opt"
4717
msgstr ""
4718
4719
#: serverguide/C/virtualization.xml:1386(para)
4720
msgid "See:"
4721
msgstr ""
4722
4723
#: serverguide/C/virtualization.xml:1391(command)
4724
msgid "lxc help config"
4725
msgstr "lxc help config"
4726
4727
#: serverguide/C/virtualization.xml:1396(para)
4728
msgid ""
4729
"for more information about editing container configurations. You may also "
4730
"use:"
4731
msgstr ""
4732
4733
#: serverguide/C/virtualization.xml:1402(command)
4734
msgid "lxc config edit c1"
4735
msgstr "lxc config edit c1"
4736
4737
#: serverguide/C/virtualization.xml:1407(para)
4738
msgid ""
4739
"to edit the whole of c1's configuration in your specified $EDITOR. Comments "
4740
"at the top of the configuration will show examples of correct syntax to help "
4741
"administrators hit the ground running. If the edited configuration is not "
4742
"valid when the $EDITOR is exited, then $EDITOR will be restarted."
4743
msgstr ""
4744
4745
#: serverguide/C/virtualization.xml:1417(title) serverguide/C/security.xml:1065(title)
4746
msgid "Profiles"
4747
msgstr ""
4748
4749
#: serverguide/C/virtualization.xml:1419(para)
4750
msgid ""
4751
"Profiles are named collections of configurations which may be applied to "
4752
"more than one container. For instance, all containers created with 'lxc "
4753
"launch', by default, include the 'default' profile, which provides a network "
4754
"interface 'eth0'."
4755
msgstr ""
4756
4757
#: serverguide/C/virtualization.xml:1426(para)
4758
msgid ""
4759
"To mask a device which would be inherited from a profile but which should "
4760
"not be in the final container, define a device by the same name but of type "
4761
"'none':"
4762
msgstr ""
4763
4764
#: serverguide/C/virtualization.xml:1433(command)
4765
msgid "lxc config device add c1 eth1 none"
4766
msgstr "lxc config device add c1 eth1 none"
4767
4768
#: serverguide/C/virtualization.xml:1439(title) serverguide/C/virtualization.xml:2031(title)
4769
msgid "Nesting"
4770
msgstr ""
4771
4772
#: serverguide/C/virtualization.xml:1441(para)
4773
msgid ""
4774
"Containers all share the same host kernel. This means that there is always "
4775
"an inherent trade-off between features exposed to the container and host "
4776
"security from malicious containers. Containers by default are therefore "
4777
"restricted from features needed to nest child containers. In order to run "
4778
"lxc or lxd containers under a lxd container, the 'security.nesting' feature "
4779
"must be set to true:"
4780
msgstr ""
4781
4782
#: serverguide/C/virtualization.xml:1451(command)
4783
msgid "lxc config set container1 security.nesting true"
4784
msgstr "lxc config set container1 security.nesting true"
4785
4786
#: serverguide/C/virtualization.xml:1456(para)
4787
msgid "Once this is done, container1 will be able to start sub-containers."
4788
msgstr ""
4789
4790
#: serverguide/C/virtualization.xml:1460(para)
4791
msgid ""
4792
"In order to run unprivileged (the default in LXD) containers nested under an "
4793
"unprivileged container, you will need to ensure a wide enough UID mapping. "
4794
"Please see the 'UID mapping' section below."
4795
msgstr ""
4796
4797
#: serverguide/C/virtualization.xml:1466(title)
4798
msgid "Docker"
4799
msgstr ""
4800
4801
#: serverguide/C/virtualization.xml:1468(para)
4802
msgid ""
4803
"In order to facilitate running docker containers inside a LXD container, a "
4804
"'docker' profile is provided. To launch a new container with the docker "
4805
"profile, you can run:"
4806
msgstr ""
4807
4808
#: serverguide/C/virtualization.xml:1475(command)
4809
msgid "lxc launch xenial container1 -p default -p docker"
4810
msgstr "lxc launch xenial container1 -p default -p docker"
4811
4812
#: serverguide/C/virtualization.xml:1480(para)
4813
msgid ""
4814
"Note that currently the docker package in Ubuntu 16.04 is patched to "
4815
"facilitate running in a container. This support is expected to land upstream "
4816
"soon."
4817
msgstr ""
4818
4819
#: serverguide/C/virtualization.xml:1486(para)
4820
msgid ""
4821
"Note that 'cgroup namespace' support is also required. This is available in "
4822
"the 16.04 kernel as well as in the 4.6 upstream source."
4823
msgstr ""
4824
4825
#: serverguide/C/virtualization.xml:1495(title)
4826
msgid "Limits"
4827
msgstr ""
4828
4829
#: serverguide/C/virtualization.xml:1497(para)
4830
msgid ""
4831
"LXD supports flexible constraints on the resources which containers can "
4832
"consume. The limits come in the following categories:"
4833
msgstr ""
4834
4835
#: serverguide/C/virtualization.xml:1504(para)
4836
msgid "CPU: limit cpu available to the container in several ways."
4837
msgstr ""
4838
4839
#: serverguide/C/virtualization.xml:1507(para)
4840
msgid "Disk: configure the priority of I/O requests under load"
4841
msgstr ""
4842
4843
#: serverguide/C/virtualization.xml:1510(para)
4844
msgid "RAM: configure memory and swap availability"
4845
msgstr ""
4846
4847
#: serverguide/C/virtualization.xml:1513(para)
4848
msgid "Network: configure the network priority under load"
4849
msgstr ""
4850
4851
#: serverguide/C/virtualization.xml:1516(para)
4852
msgid "Processes: limit the number of concurrent processes in the container."
4853
msgstr ""
4854
4855
#: serverguide/C/virtualization.xml:1520(para)
4856
msgid ""
4857
"For a full list of limits known to LXD, see <ulink "
4858
"url=\"https://github.com/lxc/lxd/blob/master/doc/configuration.md\"> the "
4859
"configuration documentation</ulink>."
4860
msgstr ""
4861
4862
#: serverguide/C/virtualization.xml:1528(title)
4863
msgid "UID mappings and Privileged containers"
4864
msgstr ""
4865
4866
#: serverguide/C/virtualization.xml:1530(para)
4867
msgid ""
4868
"By default, LXD creates unprivileged containers. This means that root in the "
4869
"container is a non-root UID on the host. It is privileged against the "
4870
"resources owned by the container, but unprivileged with respect to the host, "
4871
"making root in a container roughly equivalent to an unprivileged user on the "
4872
"host. (The main exception is the increased attack surface exposed through "
4873
"the system call interface)"
4874
msgstr ""
4875
4876
#: serverguide/C/virtualization.xml:1539(para)
4877
msgid ""
4878
"Briefly, in an unprivileged container, 65536 UIDs are 'shifted' into the "
4879
"container. For instance, UID 0 in the container may be 100000 on the host, "
4880
"UID 1 in the container is 100001, etc, up to 165535. The starting value for "
4881
"UIDs and GIDs, respectively, is determined by the 'root' entry the "
4882
"<filename>/etc/subuid</filename> and <filename>/etc/subgid</filename> files. "
4883
"(See the <ulink "
4884
"url=\"http://manpages.ubuntu.com/manpages/xenial/en/man5/subuid.5.html\"> "
4885
"subuid(5) manual page</ulink>."
4886
msgstr ""
4887
4888
#: serverguide/C/virtualization.xml:1549(para)
4889
msgid ""
4890
"It is possible to request a container to run without a UID mapping by "
4891
"setting the security.privileged flag to true:"
4892
msgstr ""
4893
4894
#: serverguide/C/virtualization.xml:1555(command)
4895
msgid "lxc config set c1 security.privileged true"
4896
msgstr "lxc config set c1 security.privileged true"
4897
4898
#: serverguide/C/virtualization.xml:1560(para)
4899
msgid ""
4900
"Note however that in this case the root user in the container is the root "
4901
"user on the host."
4902
msgstr ""
4903
4904
#: serverguide/C/virtualization.xml:1567(title) serverguide/C/virtualization.xml:2306(title)
4905
msgid "Apparmor"
4906
msgstr "Apparmor"
4907
4908
#: serverguide/C/virtualization.xml:1569(para)
4909
msgid ""
4910
"LXD confines containers by default with an apparmor profile which protects "
4911
"containers from each other and the host from containers. For instance this "
4912
"will prevent root in one container from signaling root in another container, "
4913
"even though they have the same uid mapping. It also prevents writing to "
4914
"dangerous, un-namespaced files such as many sysctls and <filename> "
4915
"/proc/sysrq-trigger</filename>."
4916
msgstr ""
4917
4918
#: serverguide/C/virtualization.xml:1578(para)
4919
msgid ""
4920
"If the apparmor policy for a container needs to be modified for a container "
4921
"c1, specific apparmor policy lines can be added in the 'raw.apparmor' "
4922
"configuration key."
4923
msgstr ""
4924
4925
#: serverguide/C/virtualization.xml:1586(title)
4926
msgid "Seccomp"
4927
msgstr "Seccomp"
4928
4929
#: serverguide/C/virtualization.xml:1588(para)
4930
msgid ""
4931
"All containers are confined by a default seccomp policy. This policy "
4932
"prevents some dangerous actions such as forced umounts, kernel module "
4933
"loading and unloading, kexec, and the open_by_handle_at system call. The "
4934
"seccomp configuration cannot be modified, however a completely different "
4935
"seccomp policy - or none - can be requested using raw.lxc (see below)."
4936
msgstr ""
4937
4938
#: serverguide/C/virtualization.xml:1598(title)
4939
msgid "Raw LXC configuration"
4940
msgstr ""
4941
4942
#: serverguide/C/virtualization.xml:1600(para)
4943
msgid ""
4944
"LXD configures containers for the best balance of host safety and container "
4945
"usability. Whenever possible it is highly recommended to use the defaults, "
4946
"and use the LXD configuration keys to request LXD to modify as needed. "
4947
"Sometimes, however, it may be necessary to talk to the underlying lxc driver "
4948
"itself. This can be done by specifying LXC configuration items in the "
4949
"'raw.lxc' LXD configuration key. These must be valid items as documented in "
4950
"<ulink "
4951
"url=\"http://manpages.ubuntu.com/manpages/xenial/en/man5/lxc.container.conf.5"
4952
".html\"> the lxc.container.conf(5) manual page</ulink>."
4953
msgstr ""
4954
4955
#: serverguide/C/virtualization.xml:1619(title)
4956
msgid "Images and containers"
4957
msgstr ""
4958
4959
#: serverguide/C/virtualization.xml:1621(para)
4960
msgid ""
4961
"LXD is image based. When you create your first container, you will generally "
4962
"do so using an existing image. LXD comes pre-configured with three default "
4963
"image remotes:"
4964
msgstr ""
4965
4966
#: serverguide/C/virtualization.xml:1629(para)
4967
msgid ""
4968
"ubuntu: This is a <ulink "
4969
"url=\"https://launchpad.net/simplestreams\">simplestreams-based</ulink> "
4970
"remote serving released ubuntu cloud images."
4971
msgstr ""
4972
4973
#: serverguide/C/virtualization.xml:1634(para)
4974
msgid ""
4975
"ubuntu-daily: This is another simplestreams based remote which serves "
4976
"'daily' ubuntu cloud images. These provide quicker but potentially less "
4977
"stable images."
4978
msgstr ""
4979
4980
#: serverguide/C/virtualization.xml:1640(para)
4981
msgid ""
4982
"images: This is a remote publishing best-effort container images for many "
4983
"distributions, created using community-provided build scripts."
4984
msgstr ""
4985
4986
#: serverguide/C/virtualization.xml:1645(para)
4987
msgid "To view the images available on one of these servers, you can use:"
4988
msgstr ""
4989
4990
#: serverguide/C/virtualization.xml:1655(para)
4991
msgid ""
4992
"Most of the images are known by several aliases for easier reference. To see "
4993
"the full list of aliases, you can use"
4994
msgstr ""
4995
4996
#: serverguide/C/virtualization.xml:1661(command)
4997
msgid "lxc image alias list images:"
4998
msgstr "lxc image alias list images:"
4999
5000
#: serverguide/C/virtualization.xml:1666(para)
5001
msgid ""
5002
"Any alias or image fingerprint can be used to specify how to create the new "
5003
"container. For instance, to create an amd64 Ubuntu 14.04 container, some "
5004
"options are:"
5005
msgstr ""
5006
5007
#: serverguide/C/virtualization.xml:1673(command)
5008
msgid ""
5009
"lxc launch ubuntu:14.04 trusty1 lxc launch ubuntu:trusty trusty1 lxc launch "
5010
"ubuntu:trusty/amd64 trusty1 lxc launch ubuntu:lts trusty1"
5011
msgstr ""
5012
"lxc launch ubuntu:14.04 trusty1 lxc launch ubuntu:trusty trusty1 lxc launch "
5013
"ubuntu:trusty/amd64 trusty1 lxc launch ubuntu:lts trusty1"
5014
5015
#: serverguide/C/virtualization.xml:1681(para)
5016
msgid "The 'lts' alias always refers to the latest released LTS image."
5017
msgstr ""
5018
5019
#: serverguide/C/virtualization.xml:1685(title) serverguide/C/virtualization.xml:2514(title)
5020
msgid "Snapshots"
5021
msgstr ""
5022
5023
#: serverguide/C/virtualization.xml:1687(para)
5024
msgid ""
5025
"Containers can be renamed and live-migrated using the 'lxc move' command:"
5026
msgstr ""
5027
5028
#: serverguide/C/virtualization.xml:1692(command)
5029
msgid "lxc move c1 final-beta"
5030
msgstr "lxc move c1 final-beta"
5031
5032
#: serverguide/C/virtualization.xml:1697(para)
5033
msgid "They can also be snapshotted:"
5034
msgstr ""
5035
5036
#: serverguide/C/virtualization.xml:1702(command)
5037
msgid "lxc snapshot c1 YYYY-MM-DD"
5038
msgstr "lxc snapshot c1 YYYY-MM-DD"
5039
5040
#: serverguide/C/virtualization.xml:1707(para)
5041
msgid "Later changes to c1 can then be reverted by restoring the snapshot:"
5042
msgstr ""
5043
5044
#: serverguide/C/virtualization.xml:1712(command)
5045
msgid "lxc restore u1 YYYY-MM-DD"
5046
msgstr "lxc restore u1 YYYY-MM-DD"
5047
5048
#: serverguide/C/virtualization.xml:1717(para)
5049
msgid ""
5050
"New containers can also be created by copying a container or snapshot:"
5051
msgstr ""
5052
5053
#: serverguide/C/virtualization.xml:1722(command)
5054
msgid "lxc copy u1/YYYY-MM-DD testcontainer"
5055
msgstr "lxc copy u1/YYYY-MM-DD testcontainer"
5056
5057
#: serverguide/C/virtualization.xml:1729(title)
5058
msgid "Publishing images"
5059
msgstr ""
5060
5061
#: serverguide/C/virtualization.xml:1731(para)
5062
msgid ""
5063
"When a container or container snapshot is ready for consumption by others, "
5064
"it can be published as a new image using;"
5065
msgstr ""
5066
5067
#: serverguide/C/virtualization.xml:1737(command)
5068
msgid "lxc publish u1/YYYY-MM-DD --alias foo-2.0"
5069
msgstr "lxc publish u1/YYYY-MM-DD --alias foo-2.0"
5070
5071
#: serverguide/C/virtualization.xml:1742(para)
5072
msgid ""
5073
"The published image will be private by default, meaning that LXD will not "
5074
"allow clients without a trusted certificate to see them. If the image is "
5075
"safe for public viewing (i.e. contains no private information), then the "
5076
"'public' flag can be set, either at publish time using"
5077
msgstr ""
5078
5079
#: serverguide/C/virtualization.xml:1750(command)
5080
msgid "lxc publish u1/YYYY-MM-DD --alias foo-2.0 public=true"
5081
msgstr "lxc publish u1/YYYY-MM-DD --alias foo-2.0 public=true"
5082
5083
#: serverguide/C/virtualization.xml:1755(para)
5084
msgid "or after the fact using"
5085
msgstr ""
5086
5087
#: serverguide/C/virtualization.xml:1760(command)
5088
msgid "lxc image edit foo-2.0"
5089
msgstr "lxc image edit foo-2.0"
5090
5091
#: serverguide/C/virtualization.xml:1765(para)
5092
msgid "and changing the value of the public field."
5093
msgstr ""
5094
5095
#: serverguide/C/virtualization.xml:1771(title)
5096
msgid "Image export and import"
5097
msgstr ""
5098
5099
#: serverguide/C/virtualization.xml:1773(para)
5100
msgid "Image can be exported as, and imported from, tarballs:"
5101
msgstr ""
5102
5103
#: serverguide/C/virtualization.xml:1778(command)
5104
msgid ""
5105
"lxc image export foo-2.0 foo-2.0.tar.gz lxc image import foo-2.0.tar.gz --"
5106
"alias foo-2.0 --public"
5107
msgstr ""
5108
"lxc image export foo-2.0 foo-2.0.tar.gz lxc image import foo-2.0.tar.gz --"
5109
"alias foo-2.0 --public"
5110
5111
#: serverguide/C/virtualization.xml:1787(title) serverguide/C/virtualization.xml:2667(title) serverguide/C/mail.xml:390(title) serverguide/C/mail.xml:1698(title) serverguide/C/dns.xml:375(title)
5112
msgid "Troubleshooting"
5113
msgstr ""
5114
5115
#: serverguide/C/virtualization.xml:1789(para)
5116
msgid ""
5117
"To view debug information about LXD itself, on a systemd based host use"
5118
msgstr ""
5119
5120
#: serverguide/C/virtualization.xml:1794(command)
5121
msgid "journalctl -u LXD"
5122
msgstr "journalctl -u LXD"
5123
5124
#: serverguide/C/virtualization.xml:1799(para)
5125
msgid ""
5126
"On an Upstart-based system, you can find the log in "
5127
"<filename>/var/log/upstart/lxd.log</filename>. To make LXD provide much more "
5128
"information about requests it is serving, add '--debug' to LXD's arguments. "
5129
"In systemd, append '--debug' to the 'ExecStart=' line in "
5130
"<filename>/lib/systemd/system/lxd.service</filename>. In Upstart, append it "
5131
"to the <command>exec /usr/bin/lxd</command> line in "
5132
"<filename>/etc/init/lxd.conf</filename>."
5133
msgstr ""
5134
5135
#: serverguide/C/virtualization.xml:1809(para)
5136
msgid "Container logfiles for container c1 may be seen using:"
5137
msgstr ""
5138
5139
#: serverguide/C/virtualization.xml:1814(command)
5140
msgid "lxc info c1 --show-log"
5141
msgstr "lxc info c1 --show-log"
5142
5143
#: serverguide/C/virtualization.xml:1819(para)
5144
msgid ""
5145
"The configuration file which was used may be found under <filename> "
5146
"/var/log/lxd/c1/lxc.conf</filename> while apparmor profiles can be found in "
5147
"<filename> /var/lib/lxd/security/apparmor/profiles/c1</filename> and seccomp "
5148
"profiles in <filename> /var/lib/lxd/security/seccomp/c1</filename>."
5149
msgstr ""
5150
5151
#: serverguide/C/virtualization.xml:1829(title)
5152
msgid "LXC"
5153
msgstr "LXC"
5154
5155
#: serverguide/C/virtualization.xml:1831(para)
5156
msgid ""
5157
"Containers are a lightweight virtualization technology. They are more akin "
5158
"to an enhanced chroot than to full virtualization like Qemu or VMware, both "
5159
"because they do not emulate hardware and because containers share the same "
5160
"operating system as the host. Containers are similar to Solaris zones or BSD "
5161
"jails. Linux-vserver and OpenVZ are two pre-existing, independently "
5162
"developed implementations of containers-like functionality for Linux. In "
5163
"fact, containers came about as a result of the work to upstream the vserver "
5164
"and OpenVZ functionality."
5165
msgstr ""
5166
5167
#: serverguide/C/virtualization.xml:1841(para)
5168
msgid ""
5169
"There are two user-space implementations of containers, each exploiting the "
5170
"same kernel features. Libvirt allows the use of containers through the LXC "
5171
"driver by connecting to 'lxc:///'. This can be very convenient as it "
5172
"supports the same usage as its other drivers. The other implementation, "
5173
"called simply 'LXC', is not compatible with libvirt, but is more flexible "
5174
"with more userspace tools. It is possible to switch between the two, though "
5175
"there are peculiarities which can cause confusion."
5176
msgstr ""
5177
5178
#: serverguide/C/virtualization.xml:1850(para)
5179
msgid ""
5180
"In this document we will mainly describe the <application>lxc</application> "
5181
"package. Use of libvirt-lxc is not generally recommended due to a lack of "
5182
"Apparmor protection for libvirt-lxc containers."
5183
msgstr ""
5184
5185
#: serverguide/C/virtualization.xml:1855(para)
5186
msgid "In this document, a container name will be shown as CN, C1, or C2."
5187
msgstr ""
5188
5189
#: serverguide/C/virtualization.xml:1861(para)
5190
msgid "The <application>lxc</application> package can be installed using"
5191
msgstr ""
5192
5193
#: serverguide/C/virtualization.xml:1865(command)
5194
msgid "sudo apt install lxc"
5195
msgstr "sudo apt install lxc"
5196
5197
#: serverguide/C/virtualization.xml:1870(para)
5198
msgid ""
5199
"This will pull in the required and recommended dependencies, as well as set "
5200
"up a network bridge for containers to use. If you wish to use unprivileged "
5201
"containers, you will need to ensure that users have sufficient allocated "
5202
"subuids and subgids, and will likely want to allow users to connect "
5203
"containers to a bridge (see <xref linkend=\"lxc-unpriv\"/>)."
5204
msgstr ""
5205
5206
#: serverguide/C/virtualization.xml:1880(title) serverguide/C/vcs.xml:111(title)
5207
msgid "Basic usage"
5208
msgstr ""
5209
5210
#: serverguide/C/virtualization.xml:1881(para)
5211
msgid ""
5212
"LXC can be used in two distinct ways - privileged, by running the lxc "
5213
"commands as the root user; or unprivileged, by running the lxc commands as a "
5214
"non-root user. (The starting of unprivileged containers by the root user is "
5215
"possible, but not described here.) Unprivileged containers are more limited, "
5216
"for instance being unable to create device nodes or mount block-backed "
5217
"filesystems. However they are less dangerous to the host, as the root userid "
5218
"in the container is mapped to a non-root userid on the host."
5219
msgstr ""
5220
5221
#: serverguide/C/virtualization.xml:1893(title)
5222
msgid "Basic privileged usage"
5223
msgstr ""
5224
5225
#: serverguide/C/virtualization.xml:1894(para)
5226
msgid "To create a privileged container, you can simply do:"
5227
msgstr ""
5228
5229
#: serverguide/C/virtualization.xml:1898(command)
5230
msgid "sudo lxc-create --template download --name u1"
5231
msgstr "sudo lxc-create --template download --name u1"
5232
5233
#: serverguide/C/virtualization.xml:1902(command)
5234
msgid "sudo lxc-create -t download -n u1"
5235
msgstr "sudo lxc-create -t download -n u1"
5236
5237
#: serverguide/C/virtualization.xml:1897(screen)
5238
#, no-wrap
5239
msgid ""
5240
"\n"
5241
"<placeholder-1/>\n"
5242
"or, abbreviated\n"
5243
"<placeholder-2/>\n"
5244
msgstr ""
5245
5246
#: serverguide/C/virtualization.xml:1906(para)
5247
msgid ""
5248
"This will interactively ask for a container root filesystem type to download "
5249
"- in particular the distribution, release, and architecture. To create the "
5250
"container non-interactively, you can specify these values on the command "
5251
"line:"
5252
msgstr ""
5253
5254
#: serverguide/C/virtualization.xml:1913(command)
5255
msgid ""
5256
"sudo lxc-create -t download -n u1 -- --dist ubuntu --release xenial --arch "
5257
"amd64"
5258
msgstr ""
5259
"sudo lxc-create -t download -n u1 -- --dist ubuntu --release xenial --arch "
5260
"amd64"
5261
5262
#: serverguide/C/virtualization.xml:1917(command)
5263
msgid "sudo lxc-create -t download -n u1 -- -d ubuntu -r xenial -a amd64"
5264
msgstr "sudo lxc-create -t download -n u1 -- -d ubuntu -r xenial -a amd64"
5265
5266
#: serverguide/C/virtualization.xml:1912(screen)
5267
#, no-wrap
5268
msgid ""
5269
"\n"
5270
"<placeholder-1/>\n"
5271
"or\n"
5272
"<placeholder-2/>\n"
5273
msgstr ""
5274
5275
#: serverguide/C/virtualization.xml:1922(para)
5276
msgid ""
5277
"You can now use <command>lxc-ls</command> to list containers, <command>lxc-"
5278
"info</command> to obtain detailed container information, <command>lxc-"
5279
"start</command> to start and <command>lxc-stop</command> to stop the "
5280
"container. <command>lxc-attach</command> and <command>lxc-console</command> "
5281
"allow you to enter a container, if ssh is not an option. <command>lxc-"
5282
"destroy</command> removes the container, including its rootfs. See the "
5283
"manual pages for more information on each command. An example session might "
5284
"look like:"
5285
msgstr ""
5286
5287
#: serverguide/C/virtualization.xml:1933(command)
5288
msgid ""
5289
"sudo lxc-ls --fancy sudo lxc-start --name u1 --daemon sudo lxc-info --name "
5290
"u1 sudo lxc-stop --name u1 sudo lxc-destroy --name u1"
5291
msgstr ""
5292
"sudo lxc-ls --fancy sudo lxc-start --name u1 --daemon sudo lxc-info --name "
5293
"u1 sudo lxc-stop --name u1 sudo lxc-destroy --name u1"
5294
5295
#: serverguide/C/virtualization.xml:1945(title)
5296
msgid "User namespaces"
5297
msgstr ""
5298
5299
#: serverguide/C/virtualization.xml:1946(para)
5300
msgid ""
5301
"Unprivileged containers allow users to create and administer containers "
5302
"without having any root privilege. The feature underpinning this is called "
5303
"user namespaces. User namespaces are hierarchical, with privileged tasks in "
5304
"a parent namespace being able to map its ids into child namespaces. By "
5305
"default every task on the host runs in the initial user namespace, where the "
5306
"full range of ids is mapped onto the full range. This can be seen by looking "
5307
"at /proc/self/uid_map and /proc/self/gid_map, which both will show \"0 0 "
5308
"4294967295\" when read from the initial user namespace. As of Ubuntu 14.04, "
5309
"when new users are created they are by default offered a range of userids. "
5310
"The list of assigned ids can be seen in the files "
5311
"<filename>/etc/subuid</filename> and <filename>/etc/subgid</filename> See "
5312
"their respective manpages for more information. Subuids and subgids are by "
5313
"convention started at id 100000 to avoid conflicting with system users."
5314
msgstr ""
5315
5316
#: serverguide/C/virtualization.xml:1964(para)
5317
msgid ""
5318
"If a user was created on an earlier release, it can be granted a range of "
5319
"ids using <command>usermod</command>, as follows:"
5320
msgstr ""
5321
5322
#: serverguide/C/virtualization.xml:1969(command)
5323
msgid "sudo usermod -v 100000-200000 -w 100000-200000 user1"
5324
msgstr "sudo usermod -v 100000-200000 -w 100000-200000 user1"
5325
5326
#: serverguide/C/virtualization.xml:1974(para)
5327
msgid ""
5328
"The programs <command>newuidmap</command> and <command> newgidmap</command> "
5329
"are setuid-root programs in the <filename>uidmap</filename> package, which "
5330
"are used internally by lxc to map subuids and subgids from the host into the "
5331
"unprivileged container. They ensure that the user only maps ids which are "
5332
"authorized by the host configuration."
5333
msgstr ""
5334
5335
#: serverguide/C/virtualization.xml:1985(title)
5336
msgid "Basic unprivileged usage"
5337
msgstr ""
5338
5339
#: serverguide/C/virtualization.xml:1989(para)
5340
msgid ""
5341
"To create unprivileged containers, a few first steps are needed. You will "
5342
"need to create a default container configuration file, specifying your "
5343
"desired id mappings and network setup, as well as configure the host to "
5344
"allow the unprivileged user to hook into the host network. The example below "
5345
"assumes that your mapped user and group id ranges are 100000-165536. Check "
5346
"your actual user and group id ranges and modify the example accordingly:"
5347
msgstr ""
5348
5349
#: serverguide/C/virtualization.xml:1999(command)
5350
msgid "grep $USER /etc/subuid grep $USER /etc/subgid"
5351
msgstr "grep $USER /etc/subuid grep $USER /etc/subgid"
5352
5353
#: serverguide/C/virtualization.xml:2005(command)
5354
msgid ""
5355
"mkdir -p ~/.config/lxc echo \"lxc.id_map = u 0 100000 65536\" > "
5356
"~/.config/lxc/default.conf echo \"lxc.id_map = g 0 100000 65536\" >> "
5357
"~/.config/lxc/default.conf echo \"lxc.network.type = veth\" >> "
5358
"~/.config/lxc/default.conf echo \"lxc.network.link = lxcbr0\" >> "
5359
"~/.config/lxc/default.conf echo \"$USER veth lxcbr0 2\" | sudo tee -a "
5360
"/etc/lxc/lxc-usernet"
5361
msgstr ""
5362
"mkdir -p ~/.config/lxc echo \"lxc.id_map = u 0 100000 65536\" > "
5363
"~/.config/lxc/default.conf echo \"lxc.id_map = g 0 100000 65536\" >> "
5364
"~/.config/lxc/default.conf echo \"lxc.network.type = veth\" >> "
5365
"~/.config/lxc/default.conf echo \"lxc.network.link = lxcbr0\" >> "
5366
"~/.config/lxc/default.conf echo \"$USER veth lxcbr0 2\" | sudo tee -a "
5367
"/etc/lxc/lxc-usernet"
5368
5369
#: serverguide/C/virtualization.xml:2015(para)
5370
msgid ""
5371
"After this, you can create unprivileged containers the same way as "
5372
"privileged ones, simply without using sudo."
5373
msgstr ""
5374
5375
#: serverguide/C/virtualization.xml:2020(command)
5376
msgid ""
5377
"lxc-create -t download -n u1 -- -d ubuntu -r xenial -a amd64 lxc-start -n u1 "
5378
"-d lxc-attach -n u1 lxc-stop -n u1 lxc-destroy -n u1"
5379
msgstr ""
5380
"lxc-create -t download -n u1 -- -d ubuntu -r xenial -a amd64 lxc-start -n u1 "
5381
"-d lxc-attach -n u1 lxc-stop -n u1 lxc-destroy -n u1"
5382
5383
#: serverguide/C/virtualization.xml:2032(para)
5384
msgid ""
5385
"In order to run containers inside containers - referred to as nested "
5386
"containers - two lines must be present in the parent container configuration "
5387
"file: <screen>\n"
5388
"lxc.mount.auto = cgroup\n"
5389
"lxc.aa_profile = lxc-container-default-with-nesting\n"
5390
"</screen> The first will cause the cgroup manager socket to be bound into "
5391
"the container, so that lxc inside the container is able to administer "
5392
"cgroups for its nested containers. The second causes the container to run in "
5393
"a looser Apparmor policy which allows the container to do the mounting "
5394
"required for starting containers. Note that this policy, when used with a "
5395
"privileged container, is much less safe than the regular policy or an "
5396
"unprivileged container. See <xref linkend=\"lxc-apparmor\"/> for more "
5397
"information."
5398
msgstr ""
5399
5400
#: serverguide/C/virtualization.xml:2054(title)
5401
msgid "Global configuration"
5402
msgstr ""
5403
5404
#: serverguide/C/virtualization.xml:2061(para)
5405
msgid ""
5406
"<filename>lxc.conf</filename> may optionally specify alternate values for "
5407
"several lxc settings, including the lxcpath, the default configuration, "
5408
"cgroups to use, a cgroup creation pattern, and storage backend settings for "
5409
"lvm and zfs."
5410
msgstr ""
5411
5412
#: serverguide/C/virtualization.xml:2067(para)
5413
msgid ""
5414
"<filename>default.conf</filename> specifies configuration which every newly "
5415
"created container should contain. This usually contains at least a network "
5416
"section, and, for unprivileged users, an id mapping section"
5417
msgstr ""
5418
5419
#: serverguide/C/virtualization.xml:2073(para)
5420
msgid ""
5421
"<filename>lxc-usernet.conf</filename> specifies how unprivileged users may "
5422
"connect their containers to the host-owned network."
5423
msgstr ""
5424
5425
#: serverguide/C/virtualization.xml:2055(para)
5426
msgid ""
5427
"The following configuration files are consulted by LXC. For privileged use, "
5428
"they are found under <filename>/etc/lxc</filename>, while for unprivileged "
5429
"use they are under <filename>~/.config/lxc</filename>. <placeholder-1/>"
5430
msgstr ""
5431
5432
#: serverguide/C/virtualization.xml:2078(para)
5433
msgid ""
5434
"<filename>lxc.conf</filename> and <filename>default.conf</filename> are both "
5435
"under <filename>/etc/lxc</filename> and "
5436
"<filename>$HOME/.config/lxc</filename>, while <filename>lxc-"
5437
"usernet.conf</filename> is only host-wide."
5438
msgstr ""
5439
5440
#: serverguide/C/virtualization.xml:2083(para)
5441
msgid ""
5442
"By default, containers are located under /var/lib/lxc for the root user, and "
5443
"$HOME/.local/share/lxc otherwise. The location can be specified for all lxc "
5444
"commands using the \"-P|--lxcpath\" argument."
5445
msgstr ""
5446
5447
#: serverguide/C/virtualization.xml:2092(title) serverguide/C/network-config.xml:11(title)
5448
msgid "Networking"
5449
msgstr "Jaringan"
5450
5451
#: serverguide/C/virtualization.xml:2093(para)
5452
msgid ""
5453
"By default LXC creates a private network namespace for each container, which "
5454
"includes a layer 2 networking stack. Containers usually connect to the "
5455
"outside world by either having a physical NIC or a veth tunnel endpoint "
5456
"passed into the container. LXC creates a NATed bridge, lxcbr0, at host "
5457
"startup. Containers created using the default configuration will have one "
5458
"veth NIC with the remote end plugged into the lxcbr0 bridge. A NIC can only "
5459
"exist in one namespace at a time, so a physical NIC passed into the "
5460
"container is not usable on the host."
5461
msgstr ""
5462
5463
#: serverguide/C/virtualization.xml:2101(para)
5464
msgid ""
5465
"It is possible to create a container without a private network namespace. In "
5466
"this case, the container will have access to the host networking like any "
5467
"other application. Note that this is particularly dangerous if the container "
5468
"is running a distribution with upstart, like Ubuntu, since programs which "
5469
"talk to init, like <command>shutdown</command>, will talk over the abstract "
5470
"Unix domain socket to the host's upstart, and shut down the host."
5471
msgstr ""
5472
5473
#: serverguide/C/virtualization.xml:2107(para)
5474
msgid ""
5475
"To give containers on lxcbr0 a persistent ip address based on domain name, "
5476
"you can write entries to <filename>/etc/lxc/dnsmasq.conf</filename> like: "
5477
"<screen>\n"
5478
"dhcp-host=lxcmail,10.0.3.100\n"
5479
"dhcp-host=ttrss,10.0.3.101\n"
5480
"</screen>"
5481
msgstr ""
5482
5483
#: serverguide/C/virtualization.xml:2115(para)
5484
msgid ""
5485
"If it is desirable for the container to be publicly accessible, there are a "
5486
"few ways to go about it. One is to use <command>iptables</command> to "
5487
"forward host ports to the container, for instance <screen>\n"
5488
" iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 587 -j DNAT \\\n"
5489
" \t--to-destination 10.0.3.100:587\n"
5490
" </screen> Another is to bridge the host's network interfaces (see the "
5491
"Ubuntu Server Guide's Network Configuration chapter, <xref "
5492
"linkend=\"bridging\"/>). Then, specify the host's bridge in the container "
5493
"configuration file in place of lxcbr0, for instance <screen>\n"
5494
"lxc.network.type = veth\n"
5495
"lxc.network.link = br0\n"
5496
"</screen> Finally, you can ask LXC to use macvlan for the container's NIC. "
5497
"Note that this has limitations and depending on configuration may not allow "
5498
"the container to talk to the host itself. Therefore the other two options "
5499
"are preferred and more commonly used."
5500
msgstr ""
5501
5502
#: serverguide/C/virtualization.xml:2136(para)
5503
msgid ""
5504
"There are several ways to determine the ip address for a container. First, "
5505
"you can use <command>lxc-ls --fancy</command> which will print the ip "
5506
"addresses for all running containers, or <command>lxc-info -i -H -n "
5507
"C1</command> which will print C1's ip address. If dnsmasq is installed on "
5508
"the host, you can also add an entry to "
5509
"<filename>/etc/dnsmasq.conf</filename> as follows <screen>\n"
5510
"server=/lxc/10.0.3.1\n"
5511
"</screen> after which dnsmasq will resolve C1.lxc locally, so that you can "
5512
"do: <screen>\n"
5513
"ping C1\n"
5514
"ssh C1\n"
5515
"</screen>"
5516
msgstr ""
5517
5518
#: serverguide/C/virtualization.xml:2151(para)
5519
msgid ""
5520
"For more information, see the lxc.conf manpage as well as the example "
5521
"network configurations under "
5522
"<filename>/usr/share/doc/lxc/examples/</filename>."
5523
msgstr ""
5524
5525
#: serverguide/C/virtualization.xml:2157(title)
5526
msgid "LXC startup"
5527
msgstr ""
5528
5529
#: serverguide/C/virtualization.xml:2159(para)
5530
msgid ""
5531
"LXC does not have a long-running daemon. However it does have three upstart "
5532
"jobs."
5533
msgstr ""
5534
5535
#: serverguide/C/virtualization.xml:2165(para)
5536
msgid ""
5537
"<filename>/etc/init/lxc-net.conf:</filename> is an optional job which only "
5538
"runs if <filename> /etc/default/lxc-net</filename> specifies USE_LXC_BRIDGE "
5539
"(true by default). It sets up a NATed bridge for containers to use."
5540
msgstr ""
5541
5542
#: serverguide/C/virtualization.xml:2173(para)
5543
msgid ""
5544
"<filename>/etc/init/lxc.conf</filename> loads the lxc apparmor profiles and "
5545
"optionally starts any autostart containers. The autostart containers will be "
5546
"ignored if LXC_AUTO (true by default) is set to true in "
5547
"<filename>/etc/default/lxc</filename>. See the lxc-autostart manual page for "
5548
"more information on autostarted containers."
5549
msgstr ""
5550
5551
#: serverguide/C/virtualization.xml:2183(para)
5552
msgid ""
5553
"<filename>/etc/init/lxc-instance.conf</filename> is used by "
5554
"<filename>/etc/init/lxc.conf</filename> to autostart a container."
5555
msgstr ""
5556
5557
#: serverguide/C/virtualization.xml:2192(title)
5558
msgid "Backing Stores"
5559
msgstr ""
5560
5561
#: serverguide/C/virtualization.xml:2193(para)
5562
msgid ""
5563
"LXC supports several backing stores for container root filesystems. The "
5564
"default is a simple directory backing store, because it requires no prior "
5565
"host customization, so long as the underlying filesystem is large enough. It "
5566
"also requires no root privilege to create the backing store, so that it is "
5567
"seamless for unprivileged use. The rootfs for a privileged directory backed "
5568
"container is located (by default) under "
5569
"<filename>/var/lib/lxc/C1/rootfs</filename>, while the rootfs for an "
5570
"unprivileged container is under "
5571
"<filename>~/.local/share/lxc/C1/rootfs</filename>. If a custom lxcpath is "
5572
"specified in lxc.system.com, then the container rootfs will be under "
5573
"<filename>$lxcpath/C1/rootfs</filename>."
5574
msgstr ""
5575
5576
#: serverguide/C/virtualization.xml:2207(para)
5577
msgid ""
5578
"A snapshot clone C2 of a directory backed container C1 becomes an overlayfs "
5579
"backed container, with a rootfs called "
5580
"<filename>overlayfs:/var/lib/lxc/C1/rootfs:/var/lib/lxc/C2/delta0</filename>."
5581
" Other backing store types include loop, btrfs, LVM and zfs."
5582
msgstr ""
5583
5584
#: serverguide/C/virtualization.xml:2215(para)
5585
msgid ""
5586
"A btrfs backed container mostly looks like a directory backed container, "
5587
"with its root filesystem in the same location. However, the root filesystem "
5588
"comprises a subvolume, so that a snapshot clone is created using a subvolume "
5589
"snapshot."
5590
msgstr ""
5591
5592
#: serverguide/C/virtualization.xml:2222(para)
5593
msgid ""
5594
"The root filesystem for an LVM backed container can be any separate LV. The "
5595
"default VG name can be specified in lxc.conf. The filesystem type and size "
5596
"are configurable per-container using lxc-create."
5597
msgstr ""
5598
5599
#: serverguide/C/virtualization.xml:2228(para)
5600
msgid ""
5601
"The rootfs for a zfs backed container is a separate zfs filesystem, mounted "
5602
"under the traditional <filename>/var/lib/lxc/C1/rootfs</filename> location. "
5603
"The zfsroot can be specified at lxc-create, and a default can be specified "
5604
"in lxc.system.conf."
5605
msgstr ""
5606
5607
#: serverguide/C/virtualization.xml:2235(para)
5608
msgid ""
5609
"More information on creating containers with the various backing stores can "
5610
"be found in the lxc-create manual page."
5611
msgstr ""
5612
5613
#: serverguide/C/virtualization.xml:2242(title)
5614
msgid "Templates"
5615
msgstr ""
5616
5617
#: serverguide/C/virtualization.xml:2243(para)
5618
msgid ""
5619
"Creating a container generally involves creating a root filesystem for the "
5620
"container. <command>lxc-create</command> delegates this work to "
5621
"<emphasis>templates</emphasis>, which are generally per-distribution. The "
5622
"lxc templates shipped with lxc can be found under "
5623
"<filename>/usr/share/lxc/templates</filename>, and include templates to "
5624
"create Ubuntu, Debian, Fedora, Oracle, centos, and gentoo containers among "
5625
"others."
5626
msgstr ""
5627
5628
#: serverguide/C/virtualization.xml:2252(para)
5629
msgid ""
5630
"Creating distribution images in most cases requires the ability to create "
5631
"device nodes, often requires tools which are not available in other "
5632
"distributions, and usually is quite time-consuming. Therefore lxc comes with "
5633
"a special <emphasis>download</emphasis> template, which downloads pre-built "
5634
"container images from a central lxc server. The most important use case is "
5635
"to allow simple creation of unprivileged containers by non-root users, who "
5636
"could not for instance easily run the <command>debootstrap</command> command."
5637
msgstr ""
5638
5639
#: serverguide/C/virtualization.xml:2262(para)
5640
msgid ""
5641
"When running <command>lxc-create</command>, all options which come after "
5642
"<emphasis>--</emphasis> are passed to the template. In the following "
5643
"command, <emphasis>--name</emphasis>, <emphasis>--template</emphasis> and "
5644
"<emphasis>--bdev</emphasis> are passed to <command>lxc-create</command>, "
5645
"while <emphasis>--release</emphasis> is passed to the template: <screen>\n"
5646
"<command>\n"
5647
"lxc-create --template ubuntu --name c1 --bdev loop -- --release xenial\n"
5648
"</command>\n"
5649
"</screen>"
5650
msgstr ""
5651
5652
#: serverguide/C/virtualization.xml:2274(para)
5653
msgid ""
5654
"You can obtain help for the options supported by any particular container by "
5655
"passing <emphasis>--help</emphasis> and the template name to <command>lxc-"
5656
"create</command>. For instance, for help with the download template,"
5657
msgstr ""
5658
5659
#: serverguide/C/virtualization.xml:2281(command)
5660
msgid "lxc-create --template download --help"
5661
msgstr "lxc-create --template download --help"
5662
5663
#: serverguide/C/virtualization.xml:2287(title)
5664
msgid "Autostart"
5665
msgstr ""
5666
5667
#: serverguide/C/virtualization.xml:2288(para)
5668
msgid ""
5669
"LXC supports marking containers to be started at system boot. Prior to "
5670
"Ubuntu 14.04, this was done using symbolic links under the directory "
5671
"<filename>/etc/lxc/auto</filename>. Starting with Ubuntu 14.04, it is done "
5672
"through the container configuration files. An entry <screen>\n"
5673
"<command>\n"
5674
"lxc.start.auto = 1\n"
5675
"lxc.start.delay = 5\n"
5676
"</command>\n"
5677
"</screen> would mean that the container should be started at boot, and the "
5678
"system should wait 5 seconds before starting the next container. LXC also "
5679
"supports ordering and grouping of containers, as well as reboot and shutdown "
5680
"by autostart groups. See the manual pages for lxc-autostart and "
5681
"lxc.container.conf for more information."
5682
msgstr ""
5683
5684
#: serverguide/C/virtualization.xml:2308(para)
5685
msgid ""
5686
"LXC ships with a default Apparmor profile intended to protect the host from "
5687
"accidental misuses of privilege inside the container. For instance, the "
5688
"container will not be able to write to <filename>/proc/sysrq-"
5689
"trigger</filename> or to most <filename>/sys</filename> files."
5690
msgstr ""
5691
5692
#: serverguide/C/virtualization.xml:2314(para)
5693
msgid ""
5694
"The <filename>usr.bin.lxc-start</filename> profile is entered by running "
5695
"<command>lxc-start</command>. This profile mainly prevents <command>lxc-"
5696
"start</command> from mounting new filesystems outside of the container's "
5697
"root filesystem. Before executing the container's <command>init</command>, "
5698
"<command>LXC</command> requests a switch to the container's profile. By "
5699
"default, this profile is the <filename>lxc-container-default</filename> "
5700
"policy which is defined in <filename>/etc/apparmor.d/lxc/lxc-"
5701
"default</filename>. This profile prevents the container from accessing many "
5702
"dangerous paths, and from mounting most filesystems."
5703
msgstr ""
5704
5705
#: serverguide/C/virtualization.xml:2325(para)
5706
msgid ""
5707
"Programs in a container cannot be further confined - for instance, MySQL "
5708
"runs under the container profile (protecting the host) but will not be able "
5709
"to enter the MySQL profile (to protect the container)."
5710
msgstr ""
5711
5712
#: serverguide/C/virtualization.xml:2330(para)
5713
msgid ""
5714
"<command>lxc-execute</command> does not enter an Apparmor profile, but the "
5715
"container it spawns will be confined."
5716
msgstr ""
5717
5718
#: serverguide/C/virtualization.xml:2333(title)
5719
msgid "Customizing container policies"
5720
msgstr ""
5721
5722
#: serverguide/C/virtualization.xml:2334(para)
5723
msgid ""
5724
"If you find that <command>lxc-start</command> is failing due to a legitimate "
5725
"access which is being denied by its Apparmor policy, you can disable the lxc-"
5726
"start profile by doing:"
5727
msgstr ""
5728
5729
#: serverguide/C/virtualization.xml:2338(screen)
5730
#, no-wrap
5731
msgid ""
5732
"\n"
5733
"sudo apparmor_parser -R /etc/apparmor.d/usr.bin.lxc-start\n"
5734
"sudo ln -s /etc/apparmor.d/usr.bin.lxc-start /etc/apparmor.d/disabled/\n"
5735
msgstr ""
5736
5737
#: serverguide/C/virtualization.xml:2343(para)
5738
msgid ""
5739
"This will make <command>lxc-start</command> run unconfined, but continue to "
5740
"confine the container itself. If you also wish to disable confinement of the "
5741
"container, then in addition to disabling the <filename>usr.bin.lxc-"
5742
"start</filename> profile, you must add:"
5743
msgstr ""
5744
5745
#: serverguide/C/virtualization.xml:2348(screen)
5746
#, no-wrap
5747
msgid ""
5748
"\n"
5749
"lxc.aa_profile = unconfined\n"
5750
msgstr ""
5751
"\n"
5752
"lxc.aa_profile = unconfined\n"
5753
5754
#: serverguide/C/virtualization.xml:2352(para)
5755
msgid "to the container's configuration file."
5756
msgstr ""
5757
5758
#: serverguide/C/virtualization.xml:2354(para)
5759
msgid ""
5760
"LXC ships with a few alternate policies for containers. If you wish to run "
5761
"containers inside containers (nesting), then you can use the lxc-container-"
5762
"default-with-nesting profile by adding the following line to the container "
5763
"configuration file <screen>\n"
5764
"lxc.aa_profile = lxc-container-default-with-nesting\n"
5765
"\t</screen> If you wish to use libvirt inside containers, then you will need "
5766
"to edit that policy (which is defined in <filename>/etc/apparmor.d/lxc/lxc-"
5767
"default-with-nesting</filename>) by uncommenting the following line: "
5768
"<screen>\n"
5769
"mount fstype=cgroup -> /sys/fs/cgroup/**,\n"
5770
"\t</screen> and re-load the policy."
5771
msgstr ""
5772
5773
#: serverguide/C/virtualization.xml:2371(para)
5774
msgid ""
5775
"Note that the nesting policy with privileged containers is far less safe "
5776
"than the default policy, as it allows containers to re-mount "
5777
"<filename>/sys</filename> and <filename>/proc</filename> in nonstandard "
5778
"locations, bypassing apparmor protections. Unprivileged containers do not "
5779
"have this drawback since the container root cannot write to root-owned "
5780
"<filename>proc</filename> and <filename>sys</filename> files."
5781
msgstr ""
5782
5783
#: serverguide/C/virtualization.xml:2379(para)
5784
msgid ""
5785
"Another profile shipped with lxc allows containers to mount block filesystem "
5786
"types like ext4. This can be useful in some cases like maas provisioning, "
5787
"but is deemed generally unsafe since the superblock handlers in the kernel "
5788
"have not been audited for safe handling of untrusted input."
5789
msgstr ""
5790
5791
#: serverguide/C/virtualization.xml:2385(para)
5792
msgid ""
5793
"If you need to run a container in a custom profile, you can create a new "
5794
"profile under <filename>/etc/apparmor.d/lxc/</filename>. Its name must start "
5795
"with <filename>lxc-</filename> in order for <command>lxc-start</command> to "
5796
"be allowed to transition to that profile. The <filename>lxc-"
5797
"default</filename> profile includes the re-usable abstractions file "
5798
"<filename>/etc/apparmor.d/abstractions/lxc/container-base</filename>. An "
5799
"easy way to start a new profile therefore is to do the same, then add extra "
5800
"permissions at the bottom of your policy."
5801
msgstr ""
5802
5803
#: serverguide/C/virtualization.xml:2396(para)
5804
msgid "After creating the policy, load it using:"
5805
msgstr ""
5806
5807
#: serverguide/C/virtualization.xml:2398(screen)
5808
#, no-wrap
5809
msgid ""
5810
"\n"
5811
"sudo apparmor_parser -r /etc/apparmor.d/lxc-containers\n"
5812
msgstr ""
5813
"\n"
5814
"sudo apparmor_parser -r /etc/apparmor.d/lxc-containers\n"
5815
5816
#: serverguide/C/virtualization.xml:2402(para)
5817
msgid ""
5818
"The profile will automatically be loaded after a reboot, because it is "
5819
"sourced by the file <filename>/etc/apparmor.d/lxc-containers</filename>. "
5820
"Finally, to make container <filename>CN</filename> use this new "
5821
"<filename>lxc-CN-profile</filename>, add the following line to its "
5822
"configuration file:"
5823
msgstr ""
5824
5825
#: serverguide/C/virtualization.xml:2409(screen)
5826
#, no-wrap
5827
msgid ""
5828
"\n"
5829
"lxc.aa_profile = lxc-CN-profile\n"
5830
msgstr ""
5831
"\n"
5832
"lxc.aa_profile = lxc-CN-profile\n"
5833
5834
#: serverguide/C/virtualization.xml:2417(title) serverguide/C/cgroups.xml:11(title)
5835
msgid "Control Groups"
5836
msgstr ""
5837
5838
#: serverguide/C/virtualization.xml:2419(para)
5839
msgid ""
5840
"Control groups (cgroups) are a kernel feature providing hierarchical task "
5841
"grouping and per-cgroup resource accounting and limits. They are used in "
5842
"containers to limit block and character device access and to freeze "
5843
"(suspend) containers. They can be further used to limit memory use and block "
5844
"i/o, guarantee minimum cpu shares, and to lock containers to specific cpus."
5845
msgstr ""
5846
5847
#: serverguide/C/virtualization.xml:2427(para)
5848
msgid ""
5849
"By default, a privileged container CN will be assigned to a cgroup called "
5850
"<filename>/lxc/CN</filename>. In the case of name conflicts (which can occur "
5851
"when using custom lxcpaths) a suffix \"-n\", where n is an integer starting "
5852
"at 0, will be appended to the cgroup name."
5853
msgstr ""
5854
5855
#: serverguide/C/virtualization.xml:2433(para)
5856
msgid ""
5857
"By default, a privileged container CN will be assigned to a cgroup called "
5858
"<filename>CN</filename> under the cgroup of the task which started the "
5859
"container, for instance <filename>/usr/1000.user/1.session/CN</filename>. "
5860
"The container root will be given group ownership of the directory (but not "
5861
"all files) so that it is allowed to create new child cgroups."
5862
msgstr ""
5863
5864
#: serverguide/C/virtualization.xml:2440(para)
5865
msgid ""
5866
"As of Ubuntu 14.04, LXC uses the cgroup manager (cgmanager) to administer "
5867
"cgroups. The cgroup manager receives D-Bus requests over the Unix socket "
5868
"<filename>/sys/fs/cgroup/cgmanager/sock</filename>. To facilitate safe "
5869
"nested containers, the line <screen>\n"
5870
"<command>\n"
5871
"lxc.mount.auto = cgroup\n"
5872
"</command>\n"
5873
"</screen> can be added to the container configuration causing the "
5874
"<filename>/sys/fs/cgroup/cgmanager</filename> directory to be bind-mounted "
5875
"into the container. The container in turn should start the cgroup management "
5876
"proxy (done by default if the cgmanager package is installed in the "
5877
"container) which will move the <filename>/sys/fs/cgroup/cgmanager</filename> "
5878
"directory to <filename>/sys/fs/cgroup/cgmanager.lower</filename>, then start "
5879
"listening for requests to proxy on its own socket "
5880
"<filename>/sys/fs/cgroup/cgmanager/sock</filename>. The host cgmanager will "
5881
"ensure that nested containers cannot escape their assigned cgroups or make "
5882
"requests for which they are not authorized."
5883
msgstr ""
5884
5885
#: serverguide/C/virtualization.xml:2464(title)
5886
msgid "Cloning"
5887
msgstr ""
5888
5889
#: serverguide/C/virtualization.xml:2466(para)
5890
msgid ""
5891
"For rapid provisioning, you may wish to customize a canonical container "
5892
"according to your needs and then make multiple copies of it. This can be "
5893
"done with the <command>lxc-clone</command> program."
5894
msgstr ""
5895
5896
#: serverguide/C/virtualization.xml:2470(para)
5897
msgid ""
5898
"Clones are either snapshots or copies of another container. A copy is a new "
5899
"container copied from the original, and takes as much space on the host as "
5900
"the original. A snapshot exploits the underlying backing store's "
5901
"snapshotting ability to make a copy-on-write container referencing the "
5902
"first. Snapshots can be created from btrfs, LVM, zfs, and directory backed "
5903
"containers. Each backing store has its own peculiarities - for instance, LVM "
5904
"containers which are not thinpool-provisioned cannot support snapshots of "
5905
"snapshots; zfs containers with snapshots cannot be removed until all "
5906
"snapshots are released; LVM containers must be more carefully planned as the "
5907
"underlying filesystem may not support growing; btrfs does not suffer any of "
5908
"these shortcomings, but suffers from reduced fsync performance causing dpkg "
5909
"and apt to be slower."
5910
msgstr ""
5911
5912
#: serverguide/C/virtualization.xml:2484(para)
5913
msgid ""
5914
"Snapshots of directory-packed containers are created using the overlay "
5915
"filesystem. For instance, a privileged directory-backed container C1 will "
5916
"have its root filesystem under <filename>/var/lib/lxc/C1/rootfs</filename>. "
5917
"A snapshot clone of C1 called C2 will be started with C1's rootfs mounted "
5918
"readonly under <filename>/var/lib/lxc/C2/delta0</filename>. Importantly, in "
5919
"this case C1 should not be allowed to run or be removed while C2 is running. "
5920
"It is advised instead to consider C1 a <emphasis> canonical</emphasis> base "
5921
"container, and to only use its snapshots."
5922
msgstr ""
5923
5924
#: serverguide/C/virtualization.xml:2496(para)
5925
msgid "Given an existing container called C1, a copy can be created using:"
5926
msgstr ""
5927
5928
#: serverguide/C/virtualization.xml:2500(command)
5929
msgid "sudo lxc-clone -o C1 -n C2"
5930
msgstr "sudo lxc-clone -o C1 -n C2"
5931
5932
#: serverguide/C/virtualization.xml:2505(para)
5933
msgid "A snapshot can be created using:"
5934
msgstr ""
5935
5936
#: serverguide/C/virtualization.xml:2507(command)
5937
msgid "sudo lxc-clone -s -o C1 -n C2"
5938
msgstr "sudo lxc-clone -s -o C1 -n C2"
5939
5940
#: serverguide/C/virtualization.xml:2511(para)
5941
msgid "See the lxc-clone manpage for more information."
5942
msgstr ""
5943
5944
#: serverguide/C/virtualization.xml:2515(para)
5945
msgid ""
5946
"To more easily support the use of snapshot clones for iterative container "
5947
"development, LXC supports <emphasis>snapshots</emphasis>. When working on a "
5948
"container C1, before making a potentially dangerous or hard-to-revert "
5949
"change, you can create a snapshot <screen>\n"
5950
"<command>\n"
5951
"sudo lxc-snapshot -n C1\n"
5952
"</command>\n"
5953
"</screen> which is a snapshot-clone called 'snap0' under /var/lib/lxcsnaps "
5954
"or $HOME/.local/share/lxcsnaps. The next snapshot will be called 'snap1', "
5955
"etc. Existing snapshots can be listed using <command>lxc-snapshot -L -n "
5956
"C1</command>, and a snapshot can be restored - erasing the current C1 "
5957
"container - using <command>lxc-snapshot -r snap1 -n C1</command>. After the "
5958
"restore command, the snap1 snapshot continues to exist, and the previous C1 "
5959
"is erased and replaced with the snap1 snapshot."
5960
msgstr ""
5961
5962
#: serverguide/C/virtualization.xml:2534(para)
5963
msgid ""
5964
"Snapshots are supported for btrfs, lvm, zfs, and overlayfs containers. If "
5965
"lxc-snapshot is called on a directory-backed container, an error will be "
5966
"logged and the snapshot will be created as a copy-clone. The reason for this "
5967
"is that if the user creates an overlayfs snapshot of a directory-backed "
5968
"container and then makes changes to the directory-backed container, then the "
5969
"original container changes will be partially reflected in the snapshot. If "
5970
"snapshots of a directory backed container C1 are desired, then an overlayfs "
5971
"clone of C1 should be created, C1 should not be touched again, and the "
5972
"overlayfs clone can be edited and snapshotted at will, as such <screen>\n"
5973
"<command>\n"
5974
"lxc-clone -s -o C1 -n C2\n"
5975
"lxc-start -n C2 -d # make some changes\n"
5976
"lxc-stop -n C2\n"
5977
"lxc-snapshot -n C2\n"
5978
"lxc-start -n C2 # etc\n"
5979
"</command>\n"
5980
"</screen>"
5981
msgstr ""
5982
5983
#: serverguide/C/virtualization.xml:2558(title)
5984
msgid "Ephemeral Containers"
5985
msgstr ""
5986
5987
#: serverguide/C/virtualization.xml:2559(para)
5988
msgid ""
5989
"While snapshots are useful for longer-term incremental development of "
5990
"images, ephemeral containers utilize snapshots for quick, single-use "
5991
"throwaway containers. Given a base container C1, you can start an ephemeral "
5992
"container using <screen>\n"
5993
"<command>\n"
5994
"lxc-start-ephemeral -o C1\n"
5995
"</command>\n"
5996
"</screen> The container begins as a snapshot of C1. Instructions for logging "
5997
"into the container will be printed to the console. After shutdown, the "
5998
"ephemeral container will be destroyed. See the lxc-start-ephemeral manual "
5999
"page for more options."
6000
msgstr ""
6001
6002
#: serverguide/C/virtualization.xml:2577(title)
6003
msgid "Lifecycle management hooks"
6004
msgstr ""
6005
6006
#: serverguide/C/virtualization.xml:2579(para)
6007
msgid ""
6008
"Beginning with Ubuntu 12.10, it is possible to define hooks to be executed "
6009
"at specific points in a container's lifetime:"
6010
msgstr ""
6011
6012
#: serverguide/C/virtualization.xml:2584(para)
6013
msgid ""
6014
"Pre-start hooks are run in the host's namespace before the container ttys, "
6015
"consoles, or mounts are up. If any mounts are done in this hook, they should "
6016
"be cleaned up in the post-stop hook."
6017
msgstr ""
6018
6019
#: serverguide/C/virtualization.xml:2591(para)
6020
msgid ""
6021
"Pre-mount hooks are run in the container's namespaces, but before the root "
6022
"filesystem has been mounted. Mounts done in this hook will be automatically "
6023
"cleaned up when the container shuts down."
6024
msgstr ""
6025
6026
#: serverguide/C/virtualization.xml:2598(para)
6027
msgid ""
6028
"Mount hooks are run after the container filesystems have been mounted, but "
6029
"before the container has called <command>pivot_root</command> to change its "
6030
"root filesystem."
6031
msgstr ""
6032
6033
#: serverguide/C/virtualization.xml:2605(para)
6034
msgid ""
6035
"Start hooks are run immediately before executing the container's init. Since "
6036
"these are executed after pivoting into the container's filesystem, the "
6037
"command to be executed must be copied into the container's filesystem."
6038
msgstr ""
6039
6040
#: serverguide/C/virtualization.xml:2612(para)
6041
msgid "Post-stop hooks are executed after the container has been shut down."
6042
msgstr ""
6043
6044
#: serverguide/C/virtualization.xml:2617(para)
6045
msgid ""
6046
"If any hook returns an error, the container's run will be aborted. Any "
6047
"<emphasis>post-stop</emphasis> hook will still be executed. Any output "
6048
"generated by the script will be logged at the debug priority."
6049
msgstr ""
6050
6051
#: serverguide/C/virtualization.xml:2622(para)
6052
msgid ""
6053
"Please see the lxc.container.conf manual page for the configuration file "
6054
"format with which to specify hooks. Some sample hooks are shipped with the "
6055
"lxc package to serve as an example of how to write and use such hooks."
6056
msgstr ""
6057
6058
#: serverguide/C/virtualization.xml:2629(title)
6059
msgid "Consoles"
6060
msgstr ""
6061
6062
#: serverguide/C/virtualization.xml:2631(para)
6063
msgid ""
6064
"Containers have a configurable number of consoles. One always exists on the "
6065
"container's <filename>/dev/console</filename>. This is shown on the terminal "
6066
"from which you ran <command>lxc-start</command>, unless the <emphasis>-"
6067
"d</emphasis> option is specified. The output on "
6068
"<filename>/dev/console</filename> can be redirected to a file using the "
6069
"<emphasis>-c console-file</emphasis> option to <command>lxc-start</command>. "
6070
"The number of extra consoles is specified by the <command>lxc.tty</command> "
6071
"variable, and is usually set to 4. Those consoles are shown on "
6072
"<filename>/dev/ttyN</filename> (for 1 <= N <= 4). To log into console "
6073
"3 from the host, use:"
6074
msgstr ""
6075
6076
#: serverguide/C/virtualization.xml:2644(command)
6077
msgid "sudo lxc-console -n container -t 3"
6078
msgstr "sudo lxc-console -n container -t 3"
6079
6080
#: serverguide/C/virtualization.xml:2649(para)
6081
msgid ""
6082
"or if the <emphasis>-t N</emphasis> option is not specified, an unused "
6083
"console will be automatically chosen. To exit the console, use the escape "
6084
"sequence Ctrl-a q. Note that the escape sequence does not work in the "
6085
"console resulting from <command>lxc-start</command> without the <emphasis>-"
6086
"d</emphasis> option."
6087
msgstr ""
6088
6089
#: serverguide/C/virtualization.xml:2655(para)
6090
msgid ""
6091
"Each container console is actually a Unix98 pty in the host's (not the "
6092
"guest's) pty mount, bind-mounted over the guest's "
6093
"<filename>/dev/ttyN</filename> and <filename>/dev/console</filename>. "
6094
"Therefore, if the guest unmounts those or otherwise tries to access the "
6095
"actual character device <command>4:N</command>, it will not be serving getty "
6096
"to the LXC consoles. (With the default settings, the container will not be "
6097
"able to access that character device and getty will therefore fail.) This "
6098
"can easily happen when a boot script blindly mounts a new "
6099
"<filename>/dev</filename>."
6100
msgstr ""
6101
6102
#: serverguide/C/virtualization.xml:2669(title) serverguide/C/network-auth.xml:793(title) serverguide/C/dns.xml:517(title)
6103
msgid "Logging"
6104
msgstr ""
6105
6106
#: serverguide/C/virtualization.xml:2670(para)
6107
msgid ""
6108
"If something goes wrong when starting a container, the first step should be "
6109
"to get full logging from LXC: <screen>\n"
6110
"<command>\n"
6111
"sudo lxc-start -n C1 -l trace -o debug.out\n"
6112
"</command>\n"
6113
"</screen> This will cause lxc to log at the most verbose level, "
6114
"<filename>trace</filename>, and to output log information to a file called "
6115
"'debug.out'. If the file <filename>debug.out</filename> already exists, the "
6116
"new log information will be appended."
6117
msgstr ""
6118
6119
#: serverguide/C/virtualization.xml:2685(title)
6120
msgid "Monitoring container status"
6121
msgstr ""
6122
6123
#: serverguide/C/virtualization.xml:2687(para)
6124
msgid ""
6125
"Two commands are available to monitor container state changes. <command>lxc-"
6126
"monitor</command> monitors one or more containers for any state changes. It "
6127
"takes a container name as usual with the <emphasis>-n</emphasis> option, but "
6128
"in this case the container name can be a posix regular expression to allow "
6129
"monitoring desirable sets of containers. <command>lxc-monitor</command> "
6130
"continues running as it prints container changes. <command>lxc-"
6131
"wait</command> waits for a specific state change and then exits. For "
6132
"instance,"
6133
msgstr ""
6134
6135
#: serverguide/C/virtualization.xml:2697(command)
6136
msgid "sudo lxc-monitor -n cont[0-5]*"
6137
msgstr "sudo lxc-monitor -n cont[0-5]*"
6138
6139
#: serverguide/C/virtualization.xml:2702(para)
6140
msgid ""
6141
"would print all state changes to any containers matching the listed regular "
6142
"expression, whereas"
6143
msgstr ""
6144
6145
#: serverguide/C/virtualization.xml:2706(command)
6146
msgid "sudo lxc-wait -n cont1 -s 'STOPPED|FROZEN'"
6147
msgstr "sudo lxc-wait -n cont1 -s 'STOPPED|FROZEN'"
6148
6149
#: serverguide/C/virtualization.xml:2711(para)
6150
msgid ""
6151
"will wait until container cont1 enters state STOPPED or state FROZEN and "
6152
"then exit."
6153
msgstr ""
6154
6155
#: serverguide/C/virtualization.xml:2716(title)
6156
msgid "Attach"
6157
msgstr ""
6158
6159
#: serverguide/C/virtualization.xml:2717(para)
6160
msgid ""
6161
"As of Ubuntu 14.04, it is possible to attach to a container's namespaces. "
6162
"The simplest case is to simply do <screen>\n"
6163
"<command>\n"
6164
"sudo lxc-attach -n C1\n"
6165
"</command>\n"
6166
"</screen> which will start a shell attached to C1's namespaces, or, "
6167
"effectively inside the container. The attach functionality is very flexible, "
6168
"allowing attaching to a subset of the container's namespaces and security "
6169
"context. See the manual page for more information."
6170
msgstr ""
6171
6172
#: serverguide/C/virtualization.xml:2733(title)
6173
msgid "Container init verbosity"
6174
msgstr ""
6175
6176
#: serverguide/C/virtualization.xml:2734(para)
6177
msgid ""
6178
"If LXC completes the container startup, but the container init fails to "
6179
"complete (for instance, no login prompt is shown), it can be useful to "
6180
"request additional verbosity from the init process. For an upstart "
6181
"container, this might be: <screen>\n"
6182
"<command>\n"
6183
"sudo lxc-start -n C1 /sbin/init loglevel=debug\n"
6184
"</command>\n"
6185
"</screen> You can also start an entirely different program in place of init, "
6186
"for instance <screen>\n"
6187
"<command>\n"
6188
"sudo lxc-start -n C1 /bin/bash\n"
6189
"sudo lxc-start -n C1 /bin/sleep 100\n"
6190
"sudo lxc-start -n C1 /bin/cat /proc/1/status\n"
6191
"</command>\n"
6192
"</screen>"
6193
msgstr ""
6194
6195
#: serverguide/C/virtualization.xml:2758(title)
6196
msgid "LXC API"
6197
msgstr ""
6198
6199
#: serverguide/C/virtualization.xml:2760(para)
6200
msgid ""
6201
"Most of the LXC functionality can now be accessed through an API exported by "
6202
"<filename>liblxc</filename> for which bindings are available in several "
6203
"languages, including Python, lua, ruby, and go."
6204
msgstr ""
6205
6206
#: serverguide/C/virtualization.xml:2764(para)
6207
msgid ""
6208
"Below is an example using the python bindings (which are available in the "
6209
"<application>python3-lxc</application> package) which creates and starts a "
6210
"container, then waits until it has been shut down:"
6211
msgstr ""
6212
6213
#: serverguide/C/virtualization.xml:2770(programlisting)
6214
#, no-wrap
6215
msgid ""
6216
"\n"
6217
"# sudo python3\n"
6218
"Python 3.2.3 (default, Aug 28 2012, 08:26:03)\n"
6219
"[GCC 4.7.1 20120814 (prerelease)] on linux2\n"
6220
"Type \"help\", \"copyright\", \"credits\" or \"license\" for more "
6221
"information.\n"
6222
">>> import lxc\n"
6223
"__main__:1: Warning: The python-lxc API isn't yet stable and may change at "
6224
"any p\n"
6225
"oint in the future.\n"
6226
">>> c=lxc.Container(\"C1\")\n"
6227
">>> c.create(\"ubuntu\")\n"
6228
"True\n"
6229
">>> c.start()\n"
6230
"True\n"
6231
">>> c.wait(\"STOPPED\")\n"
6232
"True\n"
6233
msgstr ""
6234
6235
#: serverguide/C/virtualization.xml:2790(title) serverguide/C/security.xml:11(title)
6236
msgid "Security"
6237
msgstr "Keamanan"
6238
6239
#: serverguide/C/virtualization.xml:2792(para)
6240
msgid ""
6241
"A namespace maps ids to resources. By not providing a container any id with "
6242
"which to reference a resource, the resource can be protected. This is the "
6243
"basis of some of the security afforded to container users. For instance, IPC "
6244
"namespaces are completely isolated. Other namespaces, however, have various "
6245
"<emphasis role=\"italic\">leaks</emphasis> which allow privilege to be "
6246
"inappropriately exerted from a container into another container or to the "
6247
"host."
6248
msgstr ""
6249
6250
#: serverguide/C/virtualization.xml:2801(para)
6251
msgid ""
6252
"By default, LXC containers are started under a Apparmor policy to restrict "
6253
"some actions. The details of AppArmor integration with lxc are in section "
6254
"<xref linkend=\"lxc-apparmor\"/>. Unprivileged containers go further by "
6255
"mapping root in the container to an unprivileged host userid. This prevents "
6256
"access to <filename>/proc</filename> and <filename>/sys</filename> files "
6257
"representing host resources, as well as any other files owned by root on the "
6258
"host."
6259
msgstr ""
6260
6261
#: serverguide/C/virtualization.xml:2812(title)
6262
msgid "Exploitable system calls"
6263
msgstr ""
6264
6265
#: serverguide/C/virtualization.xml:2814(para)
6266
msgid ""
6267
"It is a core container feature that containers share a kernel with the host. "
6268
"Therefore if the kernel contains any exploitable system calls the container "
6269
"can exploit these as well. Once the container controls the kernel it can "
6270
"fully control any resource known to the host."
6271
msgstr ""
6272
6273
#: serverguide/C/virtualization.xml:2820(para)
6274
msgid ""
6275
"Since Ubuntu 12.10 (Quantal) a container can also be constrained by a "
6276
"seccomp filter. Seccomp is a new kernel feature which filters the system "
6277
"calls which may be used by a task and its children. While improved and "
6278
"simplified policy management is expected in the near future, the current "
6279
"policy consists of a simple whitelist of system call numbers. The policy "
6280
"file begins with a version number (which must be 1) on the first line and a "
6281
"policy type (which must be 'whitelist') on the second line. It is followed "
6282
"by a list of numbers, one per line."
6283
msgstr ""
6284
6285
#: serverguide/C/virtualization.xml:2830(para)
6286
msgid ""
6287
"In general to run a full distribution container a large number of system "
6288
"calls will be needed. However for application containers it may be possible "
6289
"to reduce the number of available system calls to only a few. Even for "
6290
"system containers running a full distribution security gains may be had, for "
6291
"instance by removing the 32-bit compatibility system calls in a 64-bit "
6292
"container. See the lxc.container.conf manual page for details of how to "
6293
"configure a container to use seccomp. By default, no seccomp policy is "
6294
"loaded."
6295
msgstr ""
6296
6297
#: serverguide/C/virtualization.xml:2846(para)
6298
msgid ""
6299
"The DeveloperWorks article <ulink "
6300
"url=\"https://www.ibm.com/developerworks/linux/library/l-lxc-"
6301
"containers/\">LXC: Linux container tools</ulink> was an early introduction "
6302
"to the use of containers."
6303
msgstr ""
6304
6305
#: serverguide/C/virtualization.xml:2853(para)
6306
msgid ""
6307
"The <ulink url=\"http://www.ibm.com/developerworks/linux/library/l-lxc-"
6308
"security/index.html\"> Secure Containers Cookbook</ulink> demonstrated the "
6309
"use of security modules to make containers more secure."
6310
msgstr ""
6311
6312
#: serverguide/C/virtualization.xml:2860(para) serverguide/C/cgroups.xml:202(para)
6313
msgid "Manual pages referenced above can be found at:"
6314
msgstr ""
6315
6316
#: serverguide/C/virtualization.xml:2862(ulink)
6317
msgid "capabilities"
6318
msgstr ""
6319
6320
#: serverguide/C/virtualization.xml:2863(ulink)
6321
msgid "lxc.conf"
6322
msgstr "lxc.conf"
6323
6324
#: serverguide/C/virtualization.xml:2868(para)
6325
msgid ""
6326
"The upstream LXC project is hosted at <ulink "
6327
"url=\"http://linuxcontainers.org\">linuxcontainers.org</ulink>."
6328
msgstr ""
6329
6330
#: serverguide/C/virtualization.xml:2873(para)
6331
msgid ""
6332
"LXC security issues are listed and discussed at <ulink "
6333
"url=\"http://wiki.ubuntu.com/LxcSecurity\">the LXC Security wiki page</ulink>"
6334
msgstr ""
6335
6336
#: serverguide/C/virtualization.xml:2879(para)
6337
msgid ""
6338
"For more on namespaces in Linux, see: S. Bhattiprolu, E. W. Biederman, S. E. "
6339
"Hallyn, and D. Lezcano. Virtual Servers and Check- point/Restart in "
6340
"Mainstream Linux. SIGOPS Operating Systems Review, 42(5), 2008."
6341
msgstr ""
6342
6343
#: serverguide/C/vcs.xml:11(title)
6344
msgid "Version Control System"
6345
msgstr "Sistem Kontrol Versi"
6346
6347
#: serverguide/C/vcs.xml:12(para)
6348
msgid ""
6349
"Version control is the art of managing changes to information. It has long "
6350
"been a critical tool for programmers, who typically spend their time making "
6351
"small changes to software and then undoing those changes the next day. But "
6352
"the usefulness of version control software extends far beyond the bounds of "
6353
"the software development world. Anywhere you can find people using computers "
6354
"to manage information that changes often, there is room for version control."
6355
msgstr ""
6356
6357
#: serverguide/C/vcs.xml:22(title)
6358
msgid "Bazaar"
6359
msgstr "Bazaar"
6360
6361
#: serverguide/C/vcs.xml:23(para)
6362
msgid ""
6363
"Bazaar is a new version control system sponsored by Canonical, the "
6364
"commercial company behind Ubuntu. Unlike Subversion and CVS that only "
6365
"support a central repository model, Bazaar also supports "
6366
"<emphasis>distributed version control</emphasis>, giving people the ability "
6367
"to collaborate more efficiently. In particular, Bazaar is designed to "
6368
"maximize the level of community participation in open source projects."
6369
msgstr ""
6370
6371
#: serverguide/C/vcs.xml:34(para)
6372
msgid ""
6373
"At a terminal prompt, enter the following command to install "
6374
"<application>bzr</application>: <screen>\n"
6375
"<command>sudo apt install bzr</command>\n"
6376
"</screen>"
6377
msgstr ""
6378
6379
#: serverguide/C/vcs.xml:45(para)
6380
msgid ""
6381
"To introduce yourself to <application>bzr</application>, use the "
6382
"<emphasis>whoami</emphasis> command like this: <screen>\n"
6383
"<command>$ bzr whoami 'Joe Doe <joe.doe@gmail.com>'</command>\n"
6384
"</screen>"
6385
msgstr ""
6386
6387
#: serverguide/C/vcs.xml:54(title)
6388
msgid "Learning Bazaar"
6389
msgstr ""
6390
6391
#: serverguide/C/vcs.xml:55(para)
6392
msgid ""
6393
"Bazaar comes with bundled documentation installed into "
6394
"<application>/usr/share/doc/bzr/html</application> by default. The tutorial "
6395
"is a good place to start. The <application>bzr</application> command also "
6396
"comes with built-in help: <screen>\n"
6397
"<command>$ bzr help</command>\n"
6398
"</screen>"
6399
msgstr ""
6400
6401
#: serverguide/C/vcs.xml:65(para)
6402
msgid ""
6403
"To learn more about the <emphasis>foo</emphasis> command: <screen>\n"
6404
"<command>$ bzr help foo</command>\n"
6405
"</screen>"
6406
msgstr ""
6407
6408
#: serverguide/C/vcs.xml:73(title)
6409
msgid "Launchpad Integration"
6410
msgstr ""
6411
6412
#: serverguide/C/vcs.xml:74(para)
6413
msgid ""
6414
"While highly useful as a stand-alone system, Bazaar has good, optional "
6415
"integration with <ulink url=\"https://launchpad.net/\">Launchpad</ulink>, "
6416
"the collaborative development system used by Canonical and the broader open "
6417
"source community to manage and extend Ubuntu itself. For information on how "
6418
"Bazaar can be used with Launchpad to collaborate on open source projects, "
6419
"see <ulink url=\"http://bazaar-vcs.org/LaunchpadIntegration/\"> "
6420
"http://bazaar-vcs.org/LaunchpadIntegration</ulink>."
6421
msgstr ""
6422
6423
#: serverguide/C/vcs.xml:87(title)
6424
msgid "Git"
6425
msgstr "Git"
6426
6427
#: serverguide/C/vcs.xml:89(para)
6428
msgid ""
6429
"Git is an open source distributed version control system originally "
6430
"developped by Linus Torvalds to support the development of the linux kernel. "
6431
"Every Git working directory is a full-fledged repository with complete "
6432
"history and full version tracking capabilities, not dependent on network "
6433
"access or a central server."
6434
msgstr ""
6435
6436
#: serverguide/C/vcs.xml:95(para)
6437
msgid ""
6438
"The <application>git</application> version control system is installed with "
6439
"the following command"
6440
msgstr ""
6441
6442
#: serverguide/C/vcs.xml:99(command)
6443
msgid "sudo apt install git"
6444
msgstr "sudo apt install git"
6445
6446
#: serverguide/C/vcs.xml:104(para)
6447
msgid ""
6448
"Every git user should first introduce himself to git, by running these two "
6449
"commands:"
6450
msgstr ""
6451
6452
#: serverguide/C/vcs.xml:106(command)
6453
msgid "git config --global user.email \"you@example.com\""
6454
msgstr "git config --global user.email \"you@example.com\""
6455
6456
#: serverguide/C/vcs.xml:107(command)
6457
msgid "git config --global user.name \"Your Name\""
6458
msgstr "git config --global user.name \"Your Name\""
6459
6460
#: serverguide/C/vcs.xml:112(para)
6461
msgid ""
6462
"The above is already sufficient to use git in a distributed and secure way, "
6463
"provided users have access to the machine assuming the server role via SSH. "
6464
"On the server machine, creating a new repository can be done with:"
6465
msgstr ""
6466
6467
#: serverguide/C/vcs.xml:119(command)
6468
msgid "git init --bare /path/to/repository"
6469
msgstr "git init --bare /path/to/repository"
6470
6471
#: serverguide/C/vcs.xml:121(para)
6472
msgid ""
6473
"This creates a bare repository, that cannot be used to edit files directly. "
6474
"If you would rather have a working copy of the contents of the repository on "
6475
"the server, ommit the <emphasis>--bare</emphasis> option."
6476
msgstr ""
6477
6478
#: serverguide/C/vcs.xml:122(para)
6479
msgid ""
6480
"Any client with SSH access to the machine can then clone the repository with:"
6481
msgstr ""
6482
6483
#: serverguide/C/vcs.xml:127(command)
6484
msgid "git clone username@hostname:/path/to/repository"
6485
msgstr "git clone username@hostname:/path/to/repository"
6486
6487
#: serverguide/C/vcs.xml:129(para)
6488
msgid ""
6489
"Once cloned to the client's machine, the client can edit files, then commit "
6490
"and share them with:"
6491
msgstr ""
6492
6493
#: serverguide/C/vcs.xml:133(command)
6494
msgid "cd /path/to/repository"
6495
msgstr "cd /path/to/repository"
6496
6497
#: serverguide/C/vcs.xml:134(command)
6498
msgid "#(edit some files"
6499
msgstr ""
6500
6501
#: serverguide/C/vcs.xml:135(command)
6502
msgid ""
6503
"git commit -a # Commit all changes to the local version of the repository"
6504
msgstr ""
6505
6506
#: serverguide/C/vcs.xml:136(command)
6507
msgid ""
6508
"git push origin master # Push changes to the server's version of the "
6509
"repository"
6510
msgstr ""
6511
6512
#: serverguide/C/vcs.xml:141(title)
6513
msgid "Installing a gitolite server"
6514
msgstr ""
6515
6516
#: serverguide/C/vcs.xml:142(para)
6517
msgid ""
6518
"While the above is sufficient to create, clone and edit repositories, users "
6519
"wanting to install git on a server will most likely want to have git work "
6520
"like a more traditional source control management server, with multiple "
6521
"users and access rights management. The suggested solution is to install "
6522
"<application>gitolite</application> with the following command:"
6523
msgstr ""
6524
6525
#: serverguide/C/vcs.xml:148(command)
6526
msgid "sudo apt install gitolite"
6527
msgstr ""
6528
6529
#: serverguide/C/vcs.xml:153(title)
6530
msgid "Gitolite configuration"
6531
msgstr ""
6532
6533
#: serverguide/C/vcs.xml:154(para)
6534
msgid ""
6535
"Configuration of the <application>gitolite</application> server is a little "
6536
"different that most other servers on Unix-like systems. Instead of the "
6537
"traditional configuration files in /etc/, gitolite stores its configuration "
6538
"in a git repository. The first step to configuring a new installation is "
6539
"therefore to allow access to the configuration repository."
6540
msgstr ""
6541
6542
#: serverguide/C/vcs.xml:159(para)
6543
msgid "First of all, let's create a user for gitolite to be accessed as."
6544
msgstr ""
6545
6546
#: serverguide/C/vcs.xml:163(command)
6547
msgid ""
6548
"sudo adduser --system --shell /bin/bash --group --disabled-password --home "
6549
"/home/git git"
6550
msgstr ""
6551
"sudo adduser --system --shell /bin/bash --group --disabled-password --home "
6552
"/home/git git"
6553
6554
#: serverguide/C/vcs.xml:165(para)
6555
msgid ""
6556
"Now we want to let gitolite know about the repository administrator's public "
6557
"SSH key. This assumes that the current user is the repository administrator. "
6558
"If you have not yet configured an SSH key, refer to <xref linkend=\"openssh-"
6559
"keys\"/>"
6560
msgstr ""
6561
6562
#: serverguide/C/vcs.xml:170(command)
6563
msgid "cp ~/.ssh/id_rsa.pub /tmp/$(whoami).pub"
6564
msgstr "cp ~/.ssh/id_rsa.pub /tmp/$(whoami).pub"
6565
6566
#: serverguide/C/vcs.xml:172(para)
6567
msgid ""
6568
"Let's switch to the git user and import the administrator's key into "
6569
"gitolite."
6570
msgstr ""
6571
6572
#: serverguide/C/vcs.xml:176(command)
6573
msgid "sudo su - git"
6574
msgstr "sudo su - git"
6575
6576
#: serverguide/C/vcs.xml:177(command)
6577
msgid "gl-setup /tmp/*.pub"
6578
msgstr "gl-setup /tmp/*.pub"
6579
6580
#: serverguide/C/vcs.xml:179(para)
6581
msgid ""
6582
"Gitolite will allow you to make initial changes to its configuration file "
6583
"during the setup process. You can now clone and modify the gitolite "
6584
"configuration repository from your administrator user (the user whose public "
6585
"SSH key you imported). Switch back to that user, then clone the "
6586
"configuration repository:"
6587
msgstr ""
6588
6589
#: serverguide/C/vcs.xml:183(command)
6590
msgid "exit"
6591
msgstr "exit"
6592
6593
#: serverguide/C/vcs.xml:184(command)
6594
msgid "git clone git@$IP_ADDRESS:gitolite-admin.git"
6595
msgstr ""
6596
6597
#: serverguide/C/vcs.xml:185(command)
6598
msgid "cd gitolite-admin"
6599
msgstr "cd gitolite-admin"
6600
6601
#: serverguide/C/vcs.xml:187(para)
6602
msgid ""
6603
"The gitolite-admin contains two subdirectories, \"conf\" and \"keydir\". The "
6604
"configuration files are in the conf dir, and the keydir directory contains "
6605
"the list of user's public SSH keys."
6606
msgstr ""
6607
6608
#: serverguide/C/vcs.xml:190(title)
6609
msgid "Managing gitolite users and repositories"
6610
msgstr ""
6611
6612
#: serverguide/C/vcs.xml:191(para)
6613
msgid ""
6614
"Adding new users to gitolite is simple: just obtain their public SSH key and "
6615
"add it to the keydir directory as $DESIRED_USER_NAME.pub. Note that the "
6616
"gitolite usernames don't have to match the system usernames - they are only "
6617
"used in the gitolite configuration file to manage access control. Similarly, "
6618
"users are deleted by deleting their public key file. After each change, do "
6619
"not forget to commit the changes to git, and push the changes back to the "
6620
"server with"
6621
msgstr ""
6622
6623
#: serverguide/C/vcs.xml:193(command)
6624
msgid "git commit -a"
6625
msgstr "git commit -a"
6626
6627
#: serverguide/C/vcs.xml:194(command)
6628
msgid "git push origin master"
6629
msgstr "git push origin master"
6630
6631
#: serverguide/C/vcs.xml:196(para)
6632
msgid ""
6633
"Repositories are managed by editing the conf/gitolite.conf file. The syntax "
6634
"is space separated, and simply specifies the list of repositories followed "
6635
"by some access rules. The following is a default example"
6636
msgstr ""
6637
6638
#: serverguide/C/vcs.xml:197(programlisting)
6639
#, no-wrap
6640
msgid ""
6641
"\n"
6642
"repo gitolite-admin\n"
6643
" RW+ = admin\n"
6644
" R = alice\n"
6645
"\n"
6646
"repo project1\n"
6647
" RW+ = alice\n"
6648
" RW = bob\n"
6649
" R = denise\n"
6650
msgstr ""
6651
6652
#: serverguide/C/vcs.xml:209(title)
6653
msgid "Using your server"
6654
msgstr ""
6655
6656
#: serverguide/C/vcs.xml:210(para)
6657
msgid ""
6658
"To use the newly created server, users have to have the gitolite admin "
6659
"import their public key into the gitolite configuration repository, they can "
6660
"then access any project they have access to with the following command:"
6661
msgstr ""
6662
6663
#: serverguide/C/vcs.xml:212(command)
6664
msgid "git clone git@$SERVER_IP:$PROJECT_NAME.git"
6665
msgstr ""
6666
6667
#: serverguide/C/vcs.xml:214(para)
6668
msgid ""
6669
"Or add the server's project as a remote for an existing git repository:"
6670
msgstr ""
6671
6672
#: serverguide/C/vcs.xml:216(command)
6673
msgid "git remote add gitolite git@$SERVER_IP:$PROJECT_NAME.git"
6674
msgstr ""
6675
6676
#: serverguide/C/vcs.xml:221(title)
6677
msgid "Subversion"
6678
msgstr "Subversion"
6679
6680
#: serverguide/C/vcs.xml:222(para)
6681
msgid ""
6682
"Subversion is an open source version control system. Using Subversion, you "
6683
"can record the history of source files and documents. It manages files and "
6684
"directories over time. A tree of files is placed into a central repository. "
6685
"The repository is much like an ordinary file server, except that it "
6686
"remembers every change ever made to files and directories."
6687
msgstr ""
6688
6689
#: serverguide/C/vcs.xml:227(para)
6690
msgid ""
6691
"To access Subversion repository using the HTTP protocol, you must install "
6692
"and configure a web server. Apache2 is proven to work with Subversion. "
6693
"Please refer to the HTTP subsection in the Apache2 section to install and "
6694
"configure Apache2. To access the Subversion repository using the HTTPS "
6695
"protocol, you must install and configure a digital certificate in your "
6696
"Apache 2 web server. Please refer to the HTTPS subsection in the Apache2 "
6697
"section to install and configure the digital certificate."
6698
msgstr ""
6699
6700
#: serverguide/C/vcs.xml:236(para)
6701
msgid ""
6702
"To install Subversion, run the following command from a terminal prompt:"
6703
msgstr ""
6704
"Untuk menginstal Subversion, jalankan perintah berikut dari terminal prompt:"
6705
6706
#: serverguide/C/vcs.xml:241(command)
6707
msgid "sudo apt install subversion apache2 libapache2-svn"
6708
msgstr ""
6709
6710
#: serverguide/C/vcs.xml:247(title)
6711
msgid "Server Configuration"
6712
msgstr "Konfigurasi Server"
6713
6714
#: serverguide/C/vcs.xml:248(para)
6715
msgid ""
6716
"This step assumes you have installed above mentioned packages on your "
6717
"system. This section explains how to create a Subversion repository and "
6718
"access the project."
6719
msgstr ""
6720
6721
#: serverguide/C/vcs.xml:251(title)
6722
msgid "Create Subversion Repository"
6723
msgstr "Membuat Gudang Subversion"
6724
6725
#: serverguide/C/vcs.xml:252(para)
6726
msgid ""
6727
"The Subversion repository can be created using the following command from a "
6728
"terminal prompt:"
6729
msgstr ""
6730
"Repository Subversion dapat di buat dengan mengikuti perintah berikut dalam "
6731
"terminal prompt:"
6732
6733
#: serverguide/C/vcs.xml:256(command)
6734
msgid "svnadmin create /path/to/repos/project"
6735
msgstr "svnadmin create /path/to/repos/project"
6736
6737
#: serverguide/C/vcs.xml:261(title)
6738
msgid "Importing Files"
6739
msgstr "Mengimpor File"
6740
6741
#: serverguide/C/vcs.xml:262(para)
6742
msgid ""
6743
"Once you create the repository you can <emphasis>import</emphasis> files "
6744
"into the repository. To import a directory, enter the following from a "
6745
"terminal prompt: <screen>\n"
6746
"<command>svn import /path/to/import/directory "
6747
"file:///path/to/repos/project</command>\n"
6748
"</screen>"
6749
msgstr ""
6750
6751
#: serverguide/C/vcs.xml:274(title) serverguide/C/vcs.xml:279(title)
6752
msgid "Access Methods"
6753
msgstr "Metode Akses"
6754
6755
#: serverguide/C/vcs.xml:275(para)
6756
msgid ""
6757
"Subversion repositories can be accessed (checked out) through many different "
6758
"methods --on local disk, or through various network protocols. A repository "
6759
"location, however, is always a URL. The table describes how different URL "
6760
"schemes map to the available access methods."
6761
msgstr ""
6762
6763
#: serverguide/C/vcs.xml:286(para)
6764
msgid "Schema"
6765
msgstr "Skema"
6766
6767
#: serverguide/C/vcs.xml:287(para)
6768
msgid "Access Method"
6769
msgstr "Metode Akses"
6770
6771
#: serverguide/C/vcs.xml:292(para)
6772
msgid "file://"
6773
msgstr "file://"
6774
6775
#: serverguide/C/vcs.xml:293(para)
6776
msgid "direct repository access (on local disk)"
6777
msgstr "akses langsung ke gudang (pada cakram lokal)"
6778
6779
#: serverguide/C/vcs.xml:296(para)
6780
msgid "http://"
6781
msgstr "http://"
6782
6783
#: serverguide/C/vcs.xml:297(para)
6784
msgid "Access via WebDAV protocol to Subversion-aware Apache2 web server"
6785
msgstr ""
6786
"Akses lewat protokol WebDAV ke server web Apache dengan modul Subversion"
6787
6788
#: serverguide/C/vcs.xml:300(para)
6789
msgid "https://"
6790
msgstr "https://"
6791
6792
#: serverguide/C/vcs.xml:301(para)
6793
msgid "Same as http://, but with SSL encryption"
6794
msgstr "Sama seperti http://, namun dengan enkripsi SSL"
6795
6796
#: serverguide/C/vcs.xml:304(para)
6797
msgid "svn://"
6798
msgstr "svn://"
6799
6800
#: serverguide/C/vcs.xml:305(para)
6801
msgid "Access via custom protocol to an svnserve server"
6802
msgstr "Akses lewat protokol custom ke server svnserve"
6803
6804
#: serverguide/C/vcs.xml:308(para)
6805
msgid "svn+ssh://"
6806
msgstr "svn+ssh://"
6807
6808
#: serverguide/C/vcs.xml:309(para)
6809
msgid "Same as svn://, but through an SSH tunnel"
6810
msgstr "Sama seperti svn://, namun melalui tunnel SSH"
6811
6812
#: serverguide/C/vcs.xml:315(para)
6813
msgid ""
6814
"In this section, we will see how to configure Subversion for all these "
6815
"access methods. Here, we cover the basics. For more advanced usage details, "
6816
"refer to the <ulink url=\"http://svnbook.red-bean.com/\">svn book</ulink>."
6817
msgstr ""
6818
6819
#: serverguide/C/vcs.xml:322(title)
6820
msgid "Direct repository access (file://)"
6821
msgstr "Akses langsung ke repositori (file://)"
6822
6823
#: serverguide/C/vcs.xml:323(para)
6824
msgid ""
6825
"This is the simplest of all access methods. It does not require any "
6826
"Subversion server process to be running. This access method is used to "
6827
"access Subversion from the same machine. The syntax of the command, entered "
6828
"at a terminal prompt, is as follows:"
6829
msgstr ""
6830
6831
#: serverguide/C/vcs.xml:330(command)
6832
msgid "svn co file:///path/to/repos/project"
6833
msgstr "svn co file:///path/to/repos/project"
6834
6835
#: serverguide/C/vcs.xml:333(para)
6836
msgid "or"
6837
msgstr "atau"
6838
6839
#: serverguide/C/vcs.xml:336(command)
6840
msgid "svn co file://localhost/path/to/repos/project"
6841
msgstr "svn co file://localhost/path/to/repos/project"
6842
6843
#: serverguide/C/vcs.xml:340(para)
6844
msgid ""
6845
"If you do not specify the hostname, there are three forward slashes (///) -- "
6846
"two for the protocol (file, in this case) plus the leading slash in the "
6847
"path. If you specify the hostname, you must use two forward slashes (//)."
6848
msgstr ""
6849
6850
#: serverguide/C/vcs.xml:342(para)
6851
msgid ""
6852
"The repository permissions depend on filesystem permissions. If the user has "
6853
"read/write permission, he can checkout from and commit to the repository."
6854
msgstr ""
6855
6856
#: serverguide/C/vcs.xml:345(title)
6857
msgid "Access via WebDAV protocol (http://)"
6858
msgstr "Akses melalui protokol WebDAV (http://)"
6859
6860
#: serverguide/C/vcs.xml:346(para)
6861
msgid ""
6862
"To access the Subversion repository via WebDAV protocol, you must configure "
6863
"your Apache 2 web server. Add the following snippet between the "
6864
"<emphasis><VirtualHost></emphasis> and "
6865
"<emphasis></VirtualHost></emphasis> elements in "
6866
"<filename>/etc/apache2/sites-available/000-default.conf</filename>, or "
6867
"another VirtualHost file:"
6868
msgstr ""
6869
6870
#: serverguide/C/vcs.xml:352(programlisting)
6871
#, no-wrap
6872
msgid ""
6873
"\n"
6874
" <Location /svn>\n"
6875
" DAV svn\n"
6876
" SVNParentPath /path/to/repos\n"
6877
" AuthType Basic\n"
6878
" AuthName \"Your repository name\"\n"
6879
" AuthUserFile /etc/subversion/passwd\n"
6880
" Require valid-user\n"
6881
" </Location> \n"
6882
msgstr ""
6883
6884
#: serverguide/C/vcs.xml:363(para)
6885
msgid ""
6886
"The above configuration snippet assumes that Subversion repositories are "
6887
"created under <filename>/path/to/repos</filename> directory using "
6888
"<command>svnadmin</command> command and that the HTTP user has sufficent "
6889
"access rights to the files (see below). They can be accessible using "
6890
"<command>http://hostname/svn/repos_name</command> url."
6891
msgstr ""
6892
6893
#: serverguide/C/vcs.xml:369(para)
6894
msgid ""
6895
"Changing the apache configuration like the above requires to reload the "
6896
"service with the following command"
6897
msgstr ""
6898
6899
#: serverguide/C/vcs.xml:374(command) serverguide/C/lamp-applications.xml:360(command)
6900
msgid "sudo systemctl reload apache2.service"
6901
msgstr ""
6902
6903
#: serverguide/C/vcs.xml:376(para)
6904
msgid ""
6905
"To import or commit files to your Subversion repository over HTTP, the "
6906
"repository should be owned by the HTTP user. In Ubuntu systems, the HTTP "
6907
"user is <command>www-data</command>. To change the ownership of the "
6908
"repository files enter the following command from terminal prompt:"
6909
msgstr ""
6910
6911
#: serverguide/C/vcs.xml:385(command)
6912
msgid "sudo chown -R www-data:www-data /path/to/repos"
6913
msgstr "sudo chown -R www-data:www-data /path/to/repos"
6914
6915
#: serverguide/C/vcs.xml:388(para)
6916
msgid ""
6917
"By changing the ownership of repository as <command>www-data</command> you "
6918
"will not be able to import or commit files into the repository by running "
6919
"<command>svn import file:///</command> command as any user other than "
6920
"<command>www-data</command>."
6921
msgstr ""
6922
6923
#: serverguide/C/vcs.xml:397(para)
6924
msgid ""
6925
"Next, you must create the <filename>/etc/subversion/passwd</filename> file "
6926
"that will contain user authentication details. To create a file issue the "
6927
"following command at a command prompt (which will create the file and add "
6928
"the first user):"
6929
msgstr ""
6930
6931
#: serverguide/C/vcs.xml:403(command)
6932
msgid "sudo htpasswd -c /etc/subversion/passwd user_name"
6933
msgstr "sudo htpasswd -c /etc/subversion/passwd nama_user"
6934
6935
#: serverguide/C/vcs.xml:406(para)
6936
msgid ""
6937
"To add additional users omit the <emphasis>\"-c\"</emphasis> option as this "
6938
"option replaces the old file. Instead use this form:"
6939
msgstr ""
6940
6941
#: serverguide/C/vcs.xml:411(command)
6942
msgid "sudo htpasswd /etc/subversion/passwd user_name"
6943
msgstr ""
6944
6945
#: serverguide/C/vcs.xml:415(para)
6946
msgid ""
6947
"This command will prompt you to enter the password. Once you enter the "
6948
"password, the user is added. Now, to access the repository you can run the "
6949
"following command:"
6950
msgstr ""
6951
"Perintah ini akan menampilkan prompt untuk memasukkan kata sandi. Setelah "
6952
"Anda memasukkan kata sandi, pengguna akan dibuat. Sekarang, untuk mengakses "
6953
"repositori Anda dapat menjalankan perintah berikut:"
6954
6955
#: serverguide/C/vcs.xml:416(command)
6956
msgid "svn co http://servername/svn"
6957
msgstr "svn co http://servername/svn"
6958
6959
#: serverguide/C/vcs.xml:418(para)
6960
msgid ""
6961
"The password is transmitted as plain text. If you are worried about password "
6962
"snooping, you are advised to use SSL encryption. For details, please refer "
6963
"next section."
6964
msgstr ""
6965
6966
#: serverguide/C/vcs.xml:424(title)
6967
msgid "Access via WebDAV protocol with SSL encryption (https://)"
6968
msgstr "Akses melalui protokol WebDAV dengan enkripsi SSL (https://)"
6969
6970
#: serverguide/C/vcs.xml:425(para)
6971
msgid ""
6972
"Accessing Subversion repository via WebDAV protocol with SSL encryption "
6973
"(https://) is similar to http:// except that you must install and configure "
6974
"the digital certificate in your Apache2 web server. To use SSL with "
6975
"Subversion add the above Apache2 configuration to "
6976
"<filename>/etc/apache2/sites-available/default-ssl.conf</filename>. For more "
6977
"information on setting up Apache2 with SSL see <xref linkend=\"https-"
6978
"configuration\"/>."
6979
msgstr ""
6980
6981
#: serverguide/C/vcs.xml:434(para)
6982
msgid ""
6983
"You can install a digital certificate issued by a signing authority. "
6984
"Alternatively, you can install your own self-signed certificate."
6985
msgstr ""
6986
6987
#: serverguide/C/vcs.xml:439(para)
6988
msgid ""
6989
"This step assumes you have installed and configured a digital certificate in "
6990
"your Apache 2 web server. Now, to access the Subversion repository, please "
6991
"refer to the above section! The access methods are exactly the same, except "
6992
"the protocol. You must use https:// to access the Subversion repository."
6993
msgstr ""
6994
6995
#: serverguide/C/vcs.xml:449(title)
6996
msgid "Access via custom protocol (svn://)"
6997
msgstr "Akses melalui protokol custom (svn://)"
6998
6999
#: serverguide/C/vcs.xml:450(para)
7000
msgid ""
7001
"Once the Subversion repository is created, you can configure the access "
7002
"control. You can edit the <filename> "
7003
"/path/to/repos/project/conf/svnserve.conf</filename> file to configure the "
7004
"access control. For example, to set up authentication, you can uncomment the "
7005
"following lines in the configuration file:"
7006
msgstr ""
7007
7008
#: serverguide/C/vcs.xml:457(programlisting)
7009
#, no-wrap
7010
msgid ""
7011
"# [general]\n"
7012
"# password-db = passwd"
7013
msgstr ""
7014
"# [general]\n"
7015
"# password-db = passwd"
7016
7017
#: serverguide/C/vcs.xml:460(para)
7018
msgid ""
7019
"After uncommenting the above lines, you can maintain the user list in the "
7020
"passwd file. So, edit the file <filename>passwd </filename> in the same "
7021
"directory and add the new user. The syntax is as follows:"
7022
msgstr ""
7023
7024
#: serverguide/C/vcs.xml:466(programlisting)
7025
#, no-wrap
7026
msgid "username = password"
7027
msgstr "username = password"
7028
7029
#: serverguide/C/vcs.xml:467(para)
7030
msgid "For more details, please refer to the file."
7031
msgstr "Untuk keterangan lebih lanjut, silakan lihat berkas tersebut."
7032
7033
#: serverguide/C/vcs.xml:471(para)
7034
msgid ""
7035
"Now, to access Subversion via the svn:// custom protocol, either from the "
7036
"same machine or a different machine, you can run svnserver using svnserve "
7037
"command. The syntax is as follows:"
7038
msgstr ""
7039
7040
#: serverguide/C/vcs.xml:476(programlisting)
7041
#, no-wrap
7042
msgid ""
7043
"$ svnserve -d --foreground -r /path/to/repos\n"
7044
"# -d -- daemon mode\n"
7045
"# --foreground -- run in foreground (useful for debugging)\n"
7046
"# -r -- root of directory to serve\n"
7047
"\n"
7048
"For more usage details, please refer to:\n"
7049
"$ svnserve --help"
7050
msgstr ""
7051
"$ svnserve -d --foreground -r /path/to/repos\n"
7052
"# -d -- daemon mode\n"
7053
"# --foreground -- run in foreground (useful for debugging)\n"
7054
"# -r -- root of directory to serve\n"
7055
"\n"
7056
"For more usage details, please refer to:\n"
7057
"$ svnserve --help"
7058
7059
#: serverguide/C/vcs.xml:484(para)
7060
msgid ""
7061
"Once you run this command, Subversion starts listening on default port "
7062
"(3690). To access the project repository, you must run the following command "
7063
"from a terminal prompt:"
7064
msgstr ""
7065
7066
#: serverguide/C/vcs.xml:487(command)
7067
msgid "svn co svn://hostname/project project --username user_name"
7068
msgstr "svn co svn://hostname/project project --username user_name"
7069
7070
#: serverguide/C/vcs.xml:490(para)
7071
msgid ""
7072
"Based on server configuration, it prompts for password. Once you are "
7073
"authenticated, it checks out the code from Subversion repository. To "
7074
"synchronize the project repository with the local copy, you can run the "
7075
"<command>update</command> sub-command. The syntax of the command, entered at "
7076
"a terminal prompt, is as follows:"
7077
msgstr ""
7078
7079
#: serverguide/C/vcs.xml:498(command)
7080
msgid "cd project_dir ; svn update"
7081
msgstr "cd project_dir ; svn update"
7082
7083
#: serverguide/C/vcs.xml:501(para)
7084
msgid ""
7085
"For more details about using each Subversion sub-command, you can refer to "
7086
"the manual. For example, to learn more about the co (checkout) command, "
7087
"please run the following command from a terminal prompt:"
7088
msgstr ""
7089
7090
#: serverguide/C/vcs.xml:505(command)
7091
msgid "svn co help"
7092
msgstr "svn co help"
7093
7094
#: serverguide/C/vcs.xml:509(title)
7095
msgid "Access via custom protocol with SSH encryption (svn+ssh://)"
7096
msgstr ""
7097
7098
#: serverguide/C/vcs.xml:510(para)
7099
msgid ""
7100
"The configuration and server process is same as in the svn:// method. For "
7101
"details, please refer to the above section. This step assumes you have "
7102
"followed the above step and started the Subversion server using "
7103
"<application>svnserve</application> command."
7104
msgstr ""
7105
7106
#: serverguide/C/vcs.xml:516(para)
7107
msgid ""
7108
"It is also assumed that the ssh server is running on that machine and that "
7109
"it is allowing incoming connections. To confirm, please try to login to that "
7110
"machine using ssh. If you can login, everything is perfect. If you cannot "
7111
"login, please address it before continuing further."
7112
msgstr ""
7113
7114
#: serverguide/C/vcs.xml:522(para)
7115
msgid ""
7116
"The svn+ssh:// protocol is used to access the Subversion repository using "
7117
"SSL encryption. The data transfer is encrypted using this method. To access "
7118
"the project repository (for example with a checkout), you must use the "
7119
"following command syntax:"
7120
msgstr ""
7121
7122
#: serverguide/C/vcs.xml:529(command)
7123
msgid "svn co svn+ssh://ssh_username@hostname/path/to/repos/project"
7124
msgstr ""
7125
7126
#: serverguide/C/vcs.xml:533(para)
7127
msgid ""
7128
"You must use the full path (/path/to/repos/project) to access the Subversion "
7129
"repository using this access method."
7130
msgstr ""
7131
"Anda harus menggunakan path penuh (/path/to/repos/project) untuk mengakses "
7132
"repositori Subversion menggunakan metode akses ini."
7133
7134
#: serverguide/C/vcs.xml:536(para)
7135
msgid ""
7136
"Based on server configuration, it prompts for password. You must enter the "
7137
"password you use to login via ssh. Once you are authenticated, it checks out "
7138
"the code from the Subversion repository."
7139
msgstr ""
7140
7141
#: serverguide/C/vcs.xml:551(ulink)
7142
msgid "Bazaar Home Page"
7143
msgstr "Halaman web Bazaar"
7144
7145
#: serverguide/C/vcs.xml:556(ulink)
7146
msgid "Launchpad"
7147
msgstr "Launchpad"
7148
7149
#: serverguide/C/vcs.xml:561(ulink)
7150
msgid "Git homepage"
7151
msgstr ""
7152
7153
#: serverguide/C/vcs.xml:566(ulink)
7154
msgid "Gitolite"
7155
msgstr ""
7156
7157
#: serverguide/C/vcs.xml:571(ulink)
7158
msgid "Subversion Home Page"
7159
msgstr "Laman Subversion"
7160
7161
#: serverguide/C/vcs.xml:576(ulink)
7162
msgid "Subversion Book"
7163
msgstr "Buku Subversion"
7164
7165
#: serverguide/C/vcs.xml:581(ulink)
7166
msgid "Easy Bazaar Ubuntu Wiki page"
7167
msgstr ""
7168
7169
#: serverguide/C/vcs.xml:586(ulink)
7170
msgid "Ubuntu Wiki Subversion page"
7171
msgstr ""
7172
7173
#: serverguide/C/serverguide.xml:12(title)
7174
msgid "Ubuntu Server Guide"
7175
msgstr "Panduan Ubuntu Server"
7176
7177
#: serverguide/C/serverguide.xml:3(title)
7178
msgid "Credits and License"
7179
msgstr "Kredit dan Lisensi"
7180
7181
#: serverguide/C/serverguide.xml:4(para)
7182
msgid ""
7183
"This document is maintained by the Ubuntu documentation team "
7184
"(https://wiki.ubuntu.com/DocumentationTeam). A list of contributors is below."
7185
msgstr ""
7186
7187
#: serverguide/C/serverguide.xml:5(para)
7188
msgid ""
7189
"This document is made available under the Creative Commons ShareAlike 3.0 "
7190
"License (CC-BY-SA)."
7191
msgstr ""
7192
7193
#: serverguide/C/serverguide.xml:6(para)
7194
msgid ""
7195
"You are free to modify, extend, and improve the Ubuntu documentation source "
7196
"code under the terms of this license. All derivative works must be released "
7197
"under this license."
7198
msgstr ""
7199
"Anda bebas untuk mengubah, memperluas, dan memperbaiki kode sumber "
7200
"dokumentasi Ubuntu sesuai syarat-syarat yang ada dari lisensi ini. Semua "
7201
"pekerjaan turunan harus diterbitkan dibawah lisensi ini."
7202
7203
#: serverguide/C/serverguide.xml:8(para)
7204
msgid ""
7205
"This documentation is distributed in the hope that it will be useful, but "
7206
"WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY "
7207
"or FITNESS FOR A PARTICULAR PURPOSE AS DESCRIBED IN THE DISCLAIMER."
7208
msgstr ""
7209
"Dokumentasi ini didistribusikan dengan harapan bahwa dokumentasi ini akan "
7210
"bermanfaat, tetapi TANPA GARANSI; tanpa garansi yang termasuk dari DAGANGAN "
7211
"atau KECOCOKAN UNTUK TUJUAN TERTENTU SEPERTI DIGAMBARKAN DALAM PENYANGKALAN."
7212
7213
#: serverguide/C/serverguide.xml:11(para)
7214
msgid ""
7215
"A copy of the license is available here: <ulink "
7216
"url=\"https://creativecommons.org/licenses/by-sa/3.0/\">Creative Commons "
7217
"ShareAlike License</ulink>."
7218
msgstr ""
7219
7220
#: serverguide/C/serverguide.xml:14(para)
7221
msgid ""
7222
"Members of the <ulink url=\"https://launchpad.net/~ubuntu-core-doc\">Ubuntu "
7223
"Documentation Project</ulink>"
7224
msgstr ""
7225
7226
#: serverguide/C/serverguide.xml:15(para)
7227
msgid ""
7228
"Members of the <ulink url=\"https://launchpad.net/~ubuntu-server\">Ubuntu "
7229
"Server Team</ulink>"
7230
msgstr ""
7231
7232
#: serverguide/C/serverguide.xml:16(para)
7233
msgid ""
7234
"Contributors to the <ulink "
7235
"url=\"https://help.ubuntu.com/community/\">Community Help Wiki</ulink>"
7236
msgstr ""
7237
7238
#: serverguide/C/serverguide.xml:17(para)
7239
msgid ""
7240
"Other contributors can be found in the revision history of the <ulink "
7241
"url=\"https://bazaar.launchpad.net/~ubuntu-core-"
7242
"doc/serverguide/trunk/changes\">serverguide</ulink> and <ulink "
7243
"url=\"https://bazaar.launchpad.net/~ubuntu-core-doc/ubuntu-"
7244
"docs/trunk/changes\">ubuntu-docs</ulink> bzr branches available on Launchpad."
7245
msgstr ""
7246
7247
#: serverguide/C/serverguide.xml:12(para)
7248
msgid "Contributors to this document are: <placeholder-1/>"
7249
msgstr ""
7250
7251
#: serverguide/C/serverguide.xml:22(year)
7252
msgid "2016"
7253
msgstr "2016"
7254
7255
#: serverguide/C/serverguide.xml:23(holder)
7256
msgid "Contributors to the document"
7257
msgstr ""
7258
7259
#: serverguide/C/serverguide.xml:26(publishername)
7260
msgid "The Ubuntu Documentation Project"
7261
msgstr "Proyek Dokumentasi Ubuntu"
7262
7263
#: serverguide/C/serverguide.xml:15(para)
7264
msgid ""
7265
"Welcome to the <emphasis>Ubuntu Server Guide</emphasis>! It contains "
7266
"information on how to install and configure various server applications on "
7267
"your Ubuntu system to fit your needs. It is a step-by-step, task-oriented "
7268
"guide for configuring and customizing your system."
7269
msgstr ""
7270
7271
#: serverguide/C/security.xml:12(para)
7272
msgid ""
7273
"Security should always be considered when installing, deploying, and using "
7274
"any type of computer system. Although a fresh installation of Ubuntu is "
7275
"relatively safe for immediate use on the Internet, it is important to have a "
7276
"balanced understanding of your system's security posture based on how it "
7277
"will be used after deployment."
7278
msgstr ""
7279
7280
#: serverguide/C/security.xml:15(para)
7281
msgid ""
7282
"This chapter provides an overview of security-related topics as they pertain "
7283
"to Ubuntu 16.04 LTS Server Edition, and outlines simple measures you may use "
7284
"to protect your server and network from any number of potential security "
7285
"threats."
7286
msgstr ""
7287
7288
#: serverguide/C/security.xml:19(title)
7289
msgid "User Management"
7290
msgstr ""
7291
7292
#: serverguide/C/security.xml:20(para)
7293
msgid ""
7294
"User management is a critical part of maintaining a secure system. "
7295
"Ineffective user and privilege management often lead many systems into being "
7296
"compromised. Therefore, it is important that you understand how you can "
7297
"protect your server through simple and effective user account management "
7298
"techniques."
7299
msgstr ""
7300
7301
#: serverguide/C/security.xml:24(title)
7302
msgid "Where is root?"
7303
msgstr ""
7304
7305
#: serverguide/C/security.xml:25(para)
7306
msgid ""
7307
"Ubuntu developers made a conscientious decision to disable the "
7308
"administrative root account by default in all Ubuntu installations. This "
7309
"does not mean that the root account has been deleted or that it may not be "
7310
"accessed. It merely has been given a password which matches no possible "
7311
"encrypted value, therefore may not log in directly by itself."
7312
msgstr ""
7313
7314
#: serverguide/C/security.xml:28(para)
7315
msgid ""
7316
"Instead, users are encouraged to make use of a tool by the name of "
7317
"<application>sudo</application> to carry out system administrative duties. "
7318
"<application>Sudo</application> allows an authorized user to temporarily "
7319
"elevate their privileges using their own password instead of having to know "
7320
"the password belonging to the root account. This simple yet effective "
7321
"methodology provides accountability for all user actions, and gives the "
7322
"administrator granular control over which actions a user can perform with "
7323
"said privileges."
7324
msgstr ""
7325
7326
#: serverguide/C/security.xml:33(para)
7327
msgid ""
7328
"If for some reason you wish to enable the root account, simply give it a "
7329
"password:"
7330
msgstr ""
7331
7332
#: serverguide/C/security.xml:37(para)
7333
msgid "Configurations with root passwords are not supported."
7334
msgstr ""
7335
7336
#: serverguide/C/security.xml:42(command)
7337
msgid "sudo passwd"
7338
msgstr "sudo passwd"
7339
7340
#: serverguide/C/security.xml:44(para)
7341
msgid ""
7342
"Sudo will prompt you for your password, and then ask you to supply a new "
7343
"password for root as shown below:"
7344
msgstr ""
7345
7346
#: serverguide/C/security.xml:47(computeroutput)
7347
#, no-wrap
7348
msgid "[sudo] password for username:"
7349
msgstr ""
7350
7351
#: serverguide/C/security.xml:47(userinput)
7352
#, no-wrap
7353
msgid "(enter your own password)"
7354
msgstr ""
7355
7356
#: serverguide/C/security.xml:48(computeroutput)
7357
#, no-wrap
7358
msgid "Enter new UNIX password:"
7359
msgstr ""
7360
7361
#: serverguide/C/security.xml:48(userinput)
7362
#, no-wrap
7363
msgid "(enter a new password for root)"
7364
msgstr ""
7365
7366
#: serverguide/C/security.xml:49(computeroutput)
7367
#, no-wrap
7368
msgid "Retype new UNIX password:"
7369
msgstr ""
7370
7371
#: serverguide/C/security.xml:49(userinput)
7372
#, no-wrap
7373
msgid "(repeat new password for root)"
7374
msgstr ""
7375
7376
#: serverguide/C/security.xml:50(computeroutput)
7377
#, no-wrap
7378
msgid "passwd: password updated successfully"
7379
msgstr ""
7380
7381
#: serverguide/C/security.xml:54(para)
7382
msgid ""
7383
"To disable the root account password, use the following passwd syntax:"
7384
msgstr ""
7385
7386
#: serverguide/C/security.xml:58(command)
7387
msgid "sudo passwd -l root"
7388
msgstr "sudo passwd -l root"
7389
7390
#: serverguide/C/security.xml:60(para)
7391
msgid ""
7392
"However, to disable the root account itself, use the following command:"
7393
msgstr ""
7394
7395
#: serverguide/C/security.xml:64(command)
7396
msgid "usermod --expiredate 1"
7397
msgstr "usermod --expiredate 1"
7398
7399
#: serverguide/C/security.xml:68(para)
7400
msgid ""
7401
"You should read more on <application>Sudo</application> by reading the man "
7402
"page:"
7403
msgstr ""
7404
7405
#: serverguide/C/security.xml:72(command)
7406
msgid "man sudo"
7407
msgstr "man sudo"
7408
7409
#: serverguide/C/security.xml:76(para)
7410
msgid ""
7411
"By default, the initial user created by the Ubuntu installer is a member of "
7412
"the group \"<emphasis>sudo</emphasis>\" which is added to the file "
7413
"<filename>/etc/sudoers</filename> as an authorized sudo user. If you wish to "
7414
"give any other account full root access through "
7415
"<application>sudo</application>, simply add them to the "
7416
"<emphasis>sudo</emphasis> group."
7417
msgstr ""
7418
7419
#: serverguide/C/security.xml:82(title)
7420
msgid "Adding and Deleting Users"
7421
msgstr ""
7422
7423
#: serverguide/C/security.xml:83(para)
7424
msgid ""
7425
"The process for managing local users and groups is straightforward and "
7426
"differs very little from most other GNU/Linux operating systems. Ubuntu and "
7427
"other Debian based distributions encourage the use of the \"adduser\" "
7428
"package for account management."
7429
msgstr ""
7430
7431
#: serverguide/C/security.xml:88(para)
7432
msgid ""
7433
"To add a user account, use the following syntax, and follow the prompts to "
7434
"give the account a password and identifiable characteristics, such as a full "
7435
"name, phone number, etc."
7436
msgstr ""
7437
7438
#: serverguide/C/security.xml:92(command)
7439
msgid "sudo adduser username"
7440
msgstr "sudo adduser username"
7441
7442
#: serverguide/C/security.xml:96(para)
7443
msgid ""
7444
"To delete a user account and its primary group, use the following syntax:"
7445
msgstr ""
7446
7447
#: serverguide/C/security.xml:100(command)
7448
msgid "sudo deluser username"
7449
msgstr "sudo deluser username"
7450
7451
#: serverguide/C/security.xml:102(para)
7452
msgid ""
7453
"Deleting an account does not remove their respective home folder. It is up "
7454
"to you whether or not you wish to delete the folder manually or keep it "
7455
"according to your desired retention policies."
7456
msgstr ""
7457
7458
#: serverguide/C/security.xml:105(para)
7459
msgid ""
7460
"Remember, any user added later on with the same UID/GID as the previous "
7461
"owner will now have access to this folder if you have not taken the "
7462
"necessary precautions."
7463
msgstr ""
7464
7465
#: serverguide/C/security.xml:108(para)
7466
msgid ""
7467
"You may want to change these UID/GID values to something more appropriate, "
7468
"such as the root account, and perhaps even relocate the folder to avoid "
7469
"future conflicts:"
7470
msgstr ""
7471
7472
#: serverguide/C/security.xml:112(command)
7473
msgid "sudo chown -R root:root /home/username/"
7474
msgstr "sudo chown -R root:root /home/username/"
7475
7476
#: serverguide/C/security.xml:113(command)
7477
msgid "sudo mkdir /home/archived_users/"
7478
msgstr "sudo mkdir /home/archived_users/"
7479
7480
#: serverguide/C/security.xml:114(command)
7481
msgid "sudo mv /home/username /home/archived_users/"
7482
msgstr "sudo mv /home/username /home/archived_users/"
7483
7484
#: serverguide/C/security.xml:118(para)
7485
msgid ""
7486
"To temporarily lock or unlock a user account, use the following syntax, "
7487
"respectively:"
7488
msgstr ""
7489
7490
#: serverguide/C/security.xml:122(command)
7491
msgid "sudo passwd -l username"
7492
msgstr "sudo passwd -l username"
7493
7494
#: serverguide/C/security.xml:123(command)
7495
msgid "sudo passwd -u username"
7496
msgstr "sudo passwd -u username"
7497
7498
#: serverguide/C/security.xml:127(para)
7499
msgid ""
7500
"To add or delete a personalized group, use the following syntax, "
7501
"respectively:"
7502
msgstr ""
7503
7504
#: serverguide/C/security.xml:131(command)
7505
msgid "sudo addgroup groupname"
7506
msgstr "sudo addgroup groupname"
7507
7508
#: serverguide/C/security.xml:132(command)
7509
msgid "sudo delgroup groupname"
7510
msgstr "sudo delgroup groupname"
7511
7512
#: serverguide/C/security.xml:136(para)
7513
msgid "To add a user to a group, use the following syntax:"
7514
msgstr ""
7515
7516
#: serverguide/C/security.xml:140(command)
7517
msgid "sudo adduser username groupname"
7518
msgstr "sudo adduser username groupname"
7519
7520
#: serverguide/C/security.xml:147(title)
7521
msgid "User Profile Security"
7522
msgstr ""
7523
7524
#: serverguide/C/security.xml:148(para)
7525
msgid ""
7526
"When a new user is created, the adduser utility creates a brand new home "
7527
"directory named <filename class=\"directory\">/home/username</filename>. The "
7528
"default profile is modeled after the contents found in the directory of "
7529
"<filename class=\"directory\">/etc/skel</filename>, which includes all "
7530
"profile basics."
7531
msgstr ""
7532
7533
#: serverguide/C/security.xml:151(para)
7534
msgid ""
7535
"If your server will be home to multiple users, you should pay close "
7536
"attention to the user home directory permissions to ensure confidentiality. "
7537
"By default, user home directories in Ubuntu are created with world "
7538
"read/execute permissions. This means that all users can browse and access "
7539
"the contents of other users home directories. This may not be suitable for "
7540
"your environment."
7541
msgstr ""
7542
7543
#: serverguide/C/security.xml:156(para)
7544
msgid ""
7545
"To verify your current user home directory permissions, use the following "
7546
"syntax:"
7547
msgstr ""
7548
7549
#: serverguide/C/security.xml:160(command) serverguide/C/security.xml:192(command)
7550
msgid "ls -ld /home/username"
7551
msgstr "ls -ld /home/username"
7552
7553
#: serverguide/C/security.xml:162(para)
7554
msgid ""
7555
"The following output shows that the directory <filename "
7556
"class=\"directory\">/home/username</filename> has world-readable permissions:"
7557
msgstr ""
7558
7559
#: serverguide/C/security.xml:165(computeroutput)
7560
#, no-wrap
7561
msgid "drwxr-xr-x 2 username username 4096 2007-10-02 20:03 username"
7562
msgstr "drwxr-xr-x 2 username username 4096 2007-10-02 20:03 username"
7563
7564
#: serverguide/C/security.xml:169(para)
7565
msgid ""
7566
"You can remove the world readable-permissions using the following syntax:"
7567
msgstr ""
7568
7569
#: serverguide/C/security.xml:173(command)
7570
msgid "sudo chmod 0750 /home/username"
7571
msgstr "sudo chmod 0750 /home/username"
7572
7573
#: serverguide/C/security.xml:176(para)
7574
msgid ""
7575
"Some people tend to use the recursive option (-R) indiscriminately which "
7576
"modifies all child folders and files, but this is not necessary, and may "
7577
"yield other undesirable results. The parent directory alone is sufficient "
7578
"for preventing unauthorized access to anything below the parent."
7579
msgstr ""
7580
7581
#: serverguide/C/security.xml:180(para)
7582
msgid ""
7583
"A much more efficient approach to the matter would be to modify the "
7584
"<application>adduser</application> global default permissions when creating "
7585
"user home folders. Simply edit the file "
7586
"<filename>/etc/adduser.conf</filename> and modify the "
7587
"<varname>DIR_MODE</varname> variable to something appropriate, so that all "
7588
"new home directories will receive the correct permissions."
7589
msgstr ""
7590
7591
#: serverguide/C/security.xml:183(programlisting)
7592
#, no-wrap
7593
msgid ""
7594
"\n"
7595
"DIR_MODE=0750\n"
7596
msgstr ""
7597
"\n"
7598
"DIR_MODE=0750\n"
7599
7600
#: serverguide/C/security.xml:188(para)
7601
msgid ""
7602
"After correcting the directory permissions using any of the previously "
7603
"mentioned techniques, verify the results using the following syntax:"
7604
msgstr ""
7605
7606
#: serverguide/C/security.xml:194(para)
7607
msgid ""
7608
"The results below show that world-readable permissions have been removed:"
7609
msgstr ""
7610
7611
#: serverguide/C/security.xml:197(computeroutput)
7612
#, no-wrap
7613
msgid "drwxr-x--- 2 username username 4096 2007-10-02 20:03 username"
7614
msgstr "drwxr-x--- 2 username username 4096 2007-10-02 20:03 username"
7615
7616
#: serverguide/C/security.xml:204(title)
7617
msgid "Password Policy"
7618
msgstr ""
7619
7620
#: serverguide/C/security.xml:205(para)
7621
msgid ""
7622
"A strong password policy is one of the most important aspects of your "
7623
"security posture. Many successful security breaches involve simple brute "
7624
"force and dictionary attacks against weak passwords. If you intend to offer "
7625
"any form of remote access involving your local password system, make sure "
7626
"you adequately address minimum password complexity requirements, maximum "
7627
"password lifetimes, and frequent audits of your authentication systems."
7628
msgstr ""
7629
7630
#: serverguide/C/security.xml:209(title)
7631
msgid "Minimum Password Length"
7632
msgstr ""
7633
7634
#: serverguide/C/security.xml:210(para)
7635
msgid ""
7636
"By default, Ubuntu requires a minimum password length of 6 characters, as "
7637
"well as some basic entropy checks. These values are controlled in the file "
7638
"<filename>/etc/pam.d/common-password</filename>, which is outlined below."
7639
msgstr ""
7640
7641
#: serverguide/C/security.xml:213(programlisting)
7642
#, no-wrap
7643
msgid ""
7644
"\n"
7645
"password [success=1 default=ignore] pam_unix.so obscure sha512\n"
7646
msgstr ""
7647
7648
#: serverguide/C/security.xml:216(para)
7649
msgid ""
7650
"If you would like to adjust the minimum length to 8 characters, change the "
7651
"appropriate variable to min=8. The modification is outlined below."
7652
msgstr ""
7653
7654
#: serverguide/C/security.xml:219(programlisting)
7655
#, no-wrap
7656
msgid ""
7657
"\n"
7658
"password [success=1 default=ignore] pam_unix.so obscure sha512 "
7659
"minlen=8\n"
7660
msgstr ""
7661
7662
#: serverguide/C/security.xml:223(para)
7663
msgid ""
7664
"Basic password entropy checks and minimum length rules do not apply to the "
7665
"administrator using sudo level commands to setup a new user."
7666
msgstr ""
7667
7668
#: serverguide/C/security.xml:229(title)
7669
msgid "Password Expiration"
7670
msgstr ""
7671
7672
#: serverguide/C/security.xml:230(para)
7673
msgid ""
7674
"When creating user accounts, you should make it a policy to have a minimum "
7675
"and maximum password age forcing users to change their passwords when they "
7676
"expire."
7677
msgstr ""
7678
7679
#: serverguide/C/security.xml:235(para)
7680
msgid ""
7681
"To easily view the current status of a user account, use the following "
7682
"syntax:"
7683
msgstr ""
7684
7685
#: serverguide/C/security.xml:239(command) serverguide/C/security.xml:272(command)
7686
msgid "sudo chage -l username"
7687
msgstr "sudo chage -l username"
7688
7689
#: serverguide/C/security.xml:241(para)
7690
msgid ""
7691
"The output below shows interesting facts about the user account, namely that "
7692
"there are no policies applied:"
7693
msgstr ""
7694
7695
#: serverguide/C/security.xml:244(computeroutput)
7696
#, no-wrap
7697
msgid ""
7698
"Last password change : Jan 20, 2015\n"
7699
"Password expires : never\n"
7700
"Password inactive : never\n"
7701
"Account expires : never\n"
7702
"Minimum number of days between password change : 0\n"
7703
"Maximum number of days between password change : 99999\n"
7704
"Number of days of warning before password expires : 7"
7705
msgstr ""
7706
7707
#: serverguide/C/security.xml:254(para)
7708
msgid ""
7709
"To set any of these values, simply use the following syntax, and follow the "
7710
"interactive prompts:"
7711
msgstr ""
7712
7713
#: serverguide/C/security.xml:258(command)
7714
msgid "sudo chage username"
7715
msgstr "sudo chage username"
7716
7717
#: serverguide/C/security.xml:260(para)
7718
msgid ""
7719
"The following is also an example of how you can manually change the explicit "
7720
"expiration date (-E) to 01/31/2015, minimum password age (-m) of 5 days, "
7721
"maximum password age (-M) of 90 days, inactivity period (-I) of 5 days after "
7722
"password expiration, and a warning time period (-W) of 14 days before "
7723
"password expiration:"
7724
msgstr ""
7725
7726
#: serverguide/C/security.xml:264(command)
7727
msgid "sudo chage -E 01/31/2015 -m 5 -M 90 -I 30 -W 14 username"
7728
msgstr "sudo chage -E 01/31/2015 -m 5 -M 90 -I 30 -W 14 username"
7729
7730
#: serverguide/C/security.xml:268(para)
7731
msgid "To verify changes, use the same syntax as mentioned previously:"
7732
msgstr ""
7733
7734
#: serverguide/C/security.xml:274(para)
7735
msgid ""
7736
"The output below shows the new policies that have been established for the "
7737
"account:"
7738
msgstr ""
7739
7740
#: serverguide/C/security.xml:277(computeroutput)
7741
#, no-wrap
7742
msgid ""
7743
"Last password change : Jan 20, 2015\n"
7744
"Password expires : Apr 19, 2015\n"
7745
"Password inactive : May 19, 2015\n"
7746
"Account expires : Jan 31, 2015\n"
7747
"Minimum number of days between password change : 5\n"
7748
"Maximum number of days between password change : 90\n"
7749
"Number of days of warning before password expires : 14"
7750
msgstr ""
7751
7752
#: serverguide/C/security.xml:293(title)
7753
msgid "Other Security Considerations"
7754
msgstr ""
7755
7756
#: serverguide/C/security.xml:294(para)
7757
msgid ""
7758
"Many applications use alternate authentication mechanisms that can be easily "
7759
"overlooked by even experienced system administrators. Therefore, it is "
7760
"important to understand and control how users authenticate and gain access "
7761
"to services and applications on your server."
7762
msgstr ""
7763
7764
#: serverguide/C/security.xml:299(title)
7765
msgid "SSH Access by Disabled Users"
7766
msgstr ""
7767
7768
#: serverguide/C/security.xml:300(para)
7769
msgid ""
7770
"Simply disabling/locking a user account will not prevent a user from logging "
7771
"into your server remotely if they have previously set up RSA public key "
7772
"authentication. They will still be able to gain shell access to the server, "
7773
"without the need for any password. Remember to check the users home "
7774
"directory for files that will allow for this type of authenticated SSH "
7775
"access, e.g. <filename>/home/username/.ssh/authorized_keys</filename>."
7776
msgstr ""
7777
7778
#: serverguide/C/security.xml:303(para)
7779
msgid ""
7780
"Remove or rename the directory <filename "
7781
"class=\"directory\">.ssh/</filename> in the user's home folder to prevent "
7782
"further SSH authentication capabilities."
7783
msgstr ""
7784
7785
#: serverguide/C/security.xml:306(para)
7786
msgid ""
7787
"Be sure to check for any established SSH connections by the disabled user, "
7788
"as it is possible they may have existing inbound or outbound connections. "
7789
"Kill any that are found."
7790
msgstr ""
7791
7792
#: serverguide/C/security.xml:310(command)
7793
msgid "who | grep username"
7794
msgstr "who | grep username"
7795
7796
#: serverguide/C/security.xml:311(command)
7797
msgid "sudo pkill -f pts/#"
7798
msgstr "sudo pkill -f pts/#"
7799
7800
#: serverguide/C/security.xml:309(screen)
7801
#, no-wrap
7802
msgid ""
7803
"\n"
7804
"<placeholder-1/> (to get the pts/# terminal)\n"
7805
"<placeholder-2/>\n"
7806
msgstr ""
7807
7808
#: serverguide/C/security.xml:313(para)
7809
msgid ""
7810
"Restrict SSH access to only user accounts that should have it. For example, "
7811
"you may create a group called \"sshlogin\" and add the group name as the "
7812
"value associated with the <varname>AllowGroups</varname> variable located in "
7813
"the file <filename>/etc/ssh/sshd_config</filename>."
7814
msgstr ""
7815
7816
#: serverguide/C/security.xml:316(programlisting)
7817
#, no-wrap
7818
msgid ""
7819
"\n"
7820
"AllowGroups sshlogin\n"
7821
msgstr ""
7822
7823
#: serverguide/C/security.xml:319(para)
7824
msgid ""
7825
"Then add your permitted SSH users to the group \"sshlogin\", and restart the "
7826
"SSH service."
7827
msgstr ""
7828
7829
#: serverguide/C/security.xml:323(command)
7830
msgid "sudo adduser username sshlogin"
7831
msgstr "sudo adduser username sshlogin"
7832
7833
#: serverguide/C/security.xml:324(command) serverguide/C/remote-administration.xml:144(command)
7834
msgid "sudo systemctl restart sshd.service"
7835
msgstr "sudo systemctl restart sshd.service"
7836
7837
#: serverguide/C/security.xml:328(title)
7838
msgid "External User Database Authentication"
7839
msgstr ""
7840
7841
#: serverguide/C/security.xml:329(para)
7842
msgid ""
7843
"Most enterprise networks require centralized authentication and access "
7844
"controls for all system resources. If you have configured your server to "
7845
"authenticate users against external databases, be sure to disable the user "
7846
"accounts both externally and locally. This way you ensure that local "
7847
"fallback authentication is not possible."
7848
msgstr ""
7849
7850
#: serverguide/C/security.xml:338(title)
7851
msgid "Console Security"
7852
msgstr ""
7853
7854
#: serverguide/C/security.xml:339(para)
7855
msgid ""
7856
"As with any other security barrier you put in place to protect your server, "
7857
"it is pretty tough to defend against untold damage caused by someone with "
7858
"physical access to your environment, for example, theft of hard drives, "
7859
"power or service disruption, and so on. Therefore, console security should "
7860
"be addressed merely as one component of your overall physical security "
7861
"strategy. A locked \"screen door\" may deter a casual criminal, or at the "
7862
"very least slow down a determined one, so it is still advisable to perform "
7863
"basic precautions with regard to console security."
7864
msgstr ""
7865
7866
#: serverguide/C/security.xml:342(para)
7867
msgid ""
7868
"The following instructions will help defend your server against issues that "
7869
"could otherwise yield very serious consequences."
7870
msgstr ""
7871
7872
#: serverguide/C/security.xml:347(title)
7873
msgid "Disable Ctrl+Alt+Delete"
7874
msgstr ""
7875
7876
#: serverguide/C/security.xml:348(para)
7877
msgid ""
7878
"Anyone that has physical access to the keyboard can simply use the "
7879
"<keycombo><keycap>Ctrl</keycap><keycap>Alt</keycap><keycap>Delete</keycap></k"
7880
"eycombo> key combination to reboot the server without having to log on. "
7881
"While someone could simply unplug the power source, you should still prevent "
7882
"the use of this key combination on a production server. This forces an "
7883
"attacker to take more drastic measures to reboot the server, and will "
7884
"prevent accidental reboots at the same time."
7885
msgstr ""
7886
7887
#: serverguide/C/security.xml:351(para)
7888
msgid ""
7889
"To disable the reboot action taken by pressing the "
7890
"<keycombo><keycap>Ctrl</keycap><keycap>Alt</keycap><keycap>Delete</keycap></k"
7891
"eycombo> key combination, run the following two commands: <screen>\n"
7892
"sudo systemctl mask ctrl-alt-del.target\n"
7893
"sudo systemctl daemon-reload\n"
7894
"</screen>"
7895
msgstr ""
7896
7897
#: serverguide/C/security.xml:364(title)
7898
msgid "Firewall"
7899
msgstr "Firewall"
7900
7901
#: serverguide/C/security.xml:367(para)
7902
msgid ""
7903
"The Linux kernel includes the <emphasis>Netfilter</emphasis> subsystem, "
7904
"which is used to manipulate or decide the fate of network traffic headed "
7905
"into or through your server. All modern Linux firewall solutions use this "
7906
"system for packet filtering."
7907
msgstr ""
7908
7909
#: serverguide/C/security.xml:372(para)
7910
msgid ""
7911
"The kernel's packet filtering system would be of little use to "
7912
"administrators without a userspace interface to manage it. This is the "
7913
"purpose of iptables: When a packet reaches your server, it will be handed "
7914
"off to the Netfilter subsystem for acceptance, manipulation, or rejection "
7915
"based on the rules supplied to it from userspace via iptables. Thus, "
7916
"iptables is all you need to manage your firewall, if you're familiar with "
7917
"it, but many frontends are available to simplify the task."
7918
msgstr ""
7919
7920
#: serverguide/C/security.xml:382(title)
7921
msgid "ufw - Uncomplicated Firewall"
7922
msgstr ""
7923
7924
#: serverguide/C/security.xml:383(para)
7925
msgid ""
7926
"The default firewall configuration tool for Ubuntu is "
7927
"<application>ufw</application>. Developed to ease iptables firewall "
7928
"configuration, <application>ufw</application> provides a user-friendly way "
7929
"to create an IPv4 or IPv6 host-based firewall."
7930
msgstr ""
7931
7932
#: serverguide/C/security.xml:387(para)
7933
msgid ""
7934
"<application>ufw</application> by default is initially disabled. From the "
7935
"<application>ufw</application> man page:"
7936
msgstr ""
7937
7938
#: serverguide/C/security.xml:391(quote)
7939
msgid ""
7940
"ufw is not intended to provide complete firewall functionality via its "
7941
"command interface, but instead provides an easy way to add or remove simple "
7942
"rules. It is currently mainly used for host-based firewalls."
7943
msgstr ""
7944
7945
#: serverguide/C/security.xml:395(para)
7946
msgid ""
7947
"The following are some examples of how to use <application>ufw</application>:"
7948
msgstr ""
7949
7950
#: serverguide/C/security.xml:400(para)
7951
msgid ""
7952
"First, <application>ufw</application> needs to be enabled. From a terminal "
7953
"prompt enter:"
7954
msgstr ""
7955
7956
#: serverguide/C/security.xml:404(command)
7957
msgid "sudo ufw enable"
7958
msgstr "sudo ufw enable"
7959
7960
#: serverguide/C/security.xml:408(para)
7961
msgid "To open a port (SSH in this example):"
7962
msgstr ""
7963
7964
#: serverguide/C/security.xml:412(command)
7965
msgid "sudo ufw allow 22"
7966
msgstr "sudo ufw allow 22"
7967
7968
#: serverguide/C/security.xml:416(para)
7969
msgid "Rules can also be added using a <emphasis>numbered</emphasis> format:"
7970
msgstr ""
7971
7972
#: serverguide/C/security.xml:420(command)
7973
msgid "sudo ufw insert 1 allow 80"
7974
msgstr "sudo ufw insert 1 allow 80"
7975
7976
#: serverguide/C/security.xml:424(para)
7977
msgid "Similarly, to close an opened port:"
7978
msgstr ""
7979
7980
#: serverguide/C/security.xml:428(command)
7981
msgid "sudo ufw deny 22"
7982
msgstr "sudo ufw deny 22"
7983
7984
#: serverguide/C/security.xml:432(para)
7985
msgid "To remove a rule, use delete followed by the rule:"
7986
msgstr ""
7987
7988
#: serverguide/C/security.xml:436(command)
7989
msgid "sudo ufw delete deny 22"
7990
msgstr "sudo ufw delete deny 22"
7991
7992
#: serverguide/C/security.xml:440(para)
7993
msgid ""
7994
"It is also possible to allow access from specific hosts or networks to a "
7995
"port. The following example allows SSH access from host 192.168.0.2 to any "
7996
"IP address on this host:"
7997
msgstr ""
7998
7999
#: serverguide/C/security.xml:445(command)
8000
msgid "sudo ufw allow proto tcp from 192.168.0.2 to any port 22"
8001
msgstr "sudo ufw allow proto tcp from 192.168.0.2 to any port 22"
8002
8003
#: serverguide/C/security.xml:447(para)
8004
msgid ""
8005
"Replace 192.168.0.2 with 192.168.0.0/24 to allow SSH access from the entire "
8006
"subnet."
8007
msgstr ""
8008
8009
#: serverguide/C/security.xml:453(para)
8010
msgid ""
8011
"Adding the <emphasis>--dry-run</emphasis> option to a "
8012
"<emphasis>ufw</emphasis> command will output the resulting rules, but not "
8013
"apply them. For example, the following is what would be applied if opening "
8014
"the HTTP port:"
8015
msgstr ""
8016
8017
#: serverguide/C/security.xml:459(command)
8018
msgid "sudo ufw --dry-run allow http"
8019
msgstr "sudo ufw --dry-run allow http"
8020
8021
#: serverguide/C/security.xml:463(computeroutput)
8022
#, no-wrap
8023
msgid ""
8024
"*filter\n"
8025
":ufw-user-input - [0:0]\n"
8026
":ufw-user-output - [0:0]\n"
8027
":ufw-user-forward - [0:0]\n"
8028
":ufw-user-limit - [0:0]\n"
8029
":ufw-user-limit-accept - [0:0]\n"
8030
"### RULES ###\n"
8031
"\n"
8032
"### tuple ### allow tcp 80 0.0.0.0/0 any 0.0.0.0/0\n"
8033
"-A ufw-user-input -p tcp --dport 80 -j ACCEPT\n"
8034
"\n"
8035
"### END RULES ###\n"
8036
"-A ufw-user-input -j RETURN\n"
8037
"-A ufw-user-output -j RETURN\n"
8038
"-A ufw-user-forward -j RETURN\n"
8039
"-A ufw-user-limit -m limit --limit 3/minute -j LOG --log-prefix \"[UFW "
8040
"LIMIT]: \"\n"
8041
"-A ufw-user-limit -j REJECT\n"
8042
"-A ufw-user-limit-accept -j ACCEPT\n"
8043
"COMMIT\n"
8044
"Rules updated"
8045
msgstr ""
8046
8047
#: serverguide/C/security.xml:487(para)
8048
msgid "<application>ufw</application> can be disabled by:"
8049
msgstr ""
8050
8051
#: serverguide/C/security.xml:491(command)
8052
msgid "sudo ufw disable"
8053
msgstr "sudo ufw disable"
8054
8055
#: serverguide/C/security.xml:495(para)
8056
msgid "To see the firewall status, enter:"
8057
msgstr ""
8058
8059
#: serverguide/C/security.xml:499(command)
8060
msgid "sudo ufw status"
8061
msgstr "sudo ufw status"
8062
8063
#: serverguide/C/security.xml:503(para)
8064
msgid "And for more verbose status information use:"
8065
msgstr ""
8066
8067
#: serverguide/C/security.xml:507(command)
8068
msgid "sudo ufw status verbose"
8069
msgstr "sudo ufw status verbose"
8070
8071
#: serverguide/C/security.xml:511(para)
8072
msgid "To view the <emphasis>numbered</emphasis> format:"
8073
msgstr ""
8074
8075
#: serverguide/C/security.xml:515(command)
8076
msgid "sudo ufw status numbered"
8077
msgstr "sudo ufw status numbered"
8078
8079
#: serverguide/C/security.xml:520(para)
8080
msgid ""
8081
"If the port you want to open or close is defined in "
8082
"<filename>/etc/services</filename>, you can use the port name instead of the "
8083
"number. In the above examples, replace <emphasis>22</emphasis> with "
8084
"<emphasis>ssh</emphasis>."
8085
msgstr ""
8086
8087
#: serverguide/C/security.xml:526(para)
8088
msgid ""
8089
"This is a quick introduction to using <application>ufw</application>. Please "
8090
"refer to the <application>ufw</application> man page for more information."
8091
msgstr ""
8092
8093
#: serverguide/C/security.xml:532(title)
8094
msgid "ufw Application Integration"
8095
msgstr ""
8096
8097
#: serverguide/C/security.xml:534(para)
8098
msgid ""
8099
"Applications that open ports can include an <application>ufw</application> "
8100
"profile, which details the ports needed for the application to function "
8101
"properly. The profiles are kept in <filename "
8102
"role=\"directory\">/etc/ufw/applications.d</filename>, and can be edited if "
8103
"the default ports have been changed."
8104
msgstr ""
8105
8106
#: serverguide/C/security.xml:543(para)
8107
msgid ""
8108
"To view which applications have installed a profile, enter the following in "
8109
"a terminal:"
8110
msgstr ""
8111
8112
#: serverguide/C/security.xml:548(command)
8113
msgid "sudo ufw app list"
8114
msgstr "sudo ufw app list"
8115
8116
#: serverguide/C/security.xml:554(para)
8117
msgid ""
8118
"Similar to allowing traffic to a port, using an application profile is "
8119
"accomplished by entering:"
8120
msgstr ""
8121
8122
#: serverguide/C/security.xml:559(command)
8123
msgid "sudo ufw allow Samba"
8124
msgstr "sudo ufw allow Samba"
8125
8126
#: serverguide/C/security.xml:565(para)
8127
msgid "An extended syntax is available as well:"
8128
msgstr ""
8129
8130
#: serverguide/C/security.xml:570(command)
8131
msgid "ufw allow from 192.168.0.0/24 to any app Samba"
8132
msgstr "ufw allow from 192.168.0.0/24 to any app Samba"
8133
8134
#: serverguide/C/security.xml:573(para)
8135
msgid ""
8136
"Replace <emphasis>Samba</emphasis> and <emphasis>192.168.0.0/24</emphasis> "
8137
"with the application profile you are using and the IP range for your network."
8138
msgstr ""
8139
8140
#: serverguide/C/security.xml:579(para)
8141
msgid ""
8142
"There is no need to specify the <emphasis>protocol</emphasis> for the "
8143
"application, because that information is detailed in the profile. Also, note "
8144
"that the <emphasis>app</emphasis> name replaces the "
8145
"<emphasis>port</emphasis> number."
8146
msgstr ""
8147
8148
#: serverguide/C/security.xml:588(para)
8149
msgid ""
8150
"To view details about which ports, protocols, etc., are defined for an "
8151
"application, enter:"
8152
msgstr ""
8153
8154
#: serverguide/C/security.xml:593(command)
8155
msgid "sudo ufw app info Samba"
8156
msgstr "sudo ufw app info Samba"
8157
8158
#: serverguide/C/security.xml:599(para)
8159
msgid ""
8160
"Not all applications that require opening a network port come with "
8161
"<application>ufw</application> profiles, but if you have profiled an "
8162
"application and want the file to be included with the package, please file a "
8163
"bug against the package in Launchpad."
8164
msgstr ""
8165
8166
#: serverguide/C/security.xml:605(command)
8167
msgid "ubuntu-bug nameofpackage"
8168
msgstr "ubuntu-bug nameofpackage"
8169
8170
#: serverguide/C/security.xml:611(title)
8171
msgid "IP Masquerading"
8172
msgstr "IP Masquerading"
8173
8174
#: serverguide/C/security.xml:612(para)
8175
msgid ""
8176
"The purpose of IP Masquerading is to allow machines with private, non-"
8177
"routable IP addresses on your network to access the Internet through the "
8178
"machine doing the masquerading. Traffic from your private network destined "
8179
"for the Internet must be manipulated for replies to be routable back to the "
8180
"machine that made the request. To do this, the kernel must modify the "
8181
"<emphasis>source</emphasis> IP address of each packet so that replies will "
8182
"be routed back to it, rather than to the private IP address that made the "
8183
"request, which is impossible over the Internet. Linux uses "
8184
"<emphasis>Connection Tracking</emphasis> (conntrack) to keep track of which "
8185
"connections belong to which machines and reroute each return packet "
8186
"accordingly. Traffic leaving your private network is thus \"masqueraded\" as "
8187
"having originated from your Ubuntu gateway machine. This process is referred "
8188
"to in Microsoft documentation as Internet Connection Sharing."
8189
msgstr ""
8190
8191
#: serverguide/C/security.xml:628(title)
8192
msgid "ufw Masquerading"
8193
msgstr ""
8194
8195
#: serverguide/C/security.xml:629(para)
8196
msgid ""
8197
"IP Masquerading can be achieved using custom <application>ufw</application> "
8198
"rules. This is possible because the current back-end for "
8199
"<application>ufw</application> is <application>iptables-"
8200
"restore</application> with the rules files located in "
8201
"<filename>/etc/ufw/*.rules</filename>. These files are a great place to add "
8202
"legacy iptables rules used without <application>ufw</application>, and rules "
8203
"that are more network gateway or bridge related."
8204
msgstr ""
8205
8206
#: serverguide/C/security.xml:635(para)
8207
msgid ""
8208
"The rules are split into two different files, rules that should be executed "
8209
"before <application>ufw</application> command line rules, and rules that are "
8210
"executed after <application>ufw</application> command line rules."
8211
msgstr ""
8212
8213
#: serverguide/C/security.xml:641(para)
8214
msgid ""
8215
"First, packet forwarding needs to be enabled in "
8216
"<application>ufw</application>. Two configuration files will need to be "
8217
"adjusted, in <filename>/etc/default/ufw</filename> change the "
8218
"<emphasis>DEFAULT_FORWARD_POLICY</emphasis> to <quote>ACCEPT</quote>:"
8219
msgstr ""
8220
8221
#: serverguide/C/security.xml:645(programlisting)
8222
#, no-wrap
8223
msgid ""
8224
"\n"
8225
"DEFAULT_FORWARD_POLICY=\"ACCEPT\"\n"
8226
msgstr ""
8227
8228
#: serverguide/C/security.xml:648(para)
8229
msgid "Then edit <filename>/etc/ufw/sysctl.conf</filename> and uncomment:"
8230
msgstr ""
8231
8232
#: serverguide/C/security.xml:651(programlisting)
8233
#, no-wrap
8234
msgid ""
8235
"\n"
8236
"net/ipv4/ip_forward=1\n"
8237
msgstr ""
8238
"\n"
8239
"net/ipv4/ip_forward=1\n"
8240
8241
#: serverguide/C/security.xml:654(para)
8242
msgid "Similarly, for IPv6 forwarding uncomment:"
8243
msgstr ""
8244
8245
#: serverguide/C/security.xml:657(programlisting)
8246
#, no-wrap
8247
msgid ""
8248
"\n"
8249
"net/ipv6/conf/default/forwarding=1\n"
8250
msgstr ""
8251
"\n"
8252
"net/ipv6/conf/default/forwarding=1\n"
8253
8254
#: serverguide/C/security.xml:662(para)
8255
msgid ""
8256
"Now add rules to the <filename>/etc/ufw/before.rules</filename> file. The "
8257
"default rules only configure the <emphasis>filter</emphasis> table, and to "
8258
"enable masquerading the <emphasis>nat</emphasis> table will need to be "
8259
"configured. Add the following to the top of the file just after the header "
8260
"comments:"
8261
msgstr ""
8262
8263
#: serverguide/C/security.xml:667(programlisting)
8264
#, no-wrap
8265
msgid ""
8266
"\n"
8267
"# nat Table rules\n"
8268
"*nat\n"
8269
":POSTROUTING ACCEPT [0:0]\n"
8270
"\n"
8271
"# Forward traffic from eth1 through eth0.\n"
8272
"-A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE\n"
8273
"\n"
8274
"# don't delete the 'COMMIT' line or these nat table rules won't be "
8275
"processed\n"
8276
"COMMIT\n"
8277
msgstr ""
8278
8279
#: serverguide/C/security.xml:678(para)
8280
msgid ""
8281
"The comments are not strictly necessary, but it is considered good practice "
8282
"to document your configuration. Also, when modifying any of the "
8283
"<emphasis>rules</emphasis> files in <filename "
8284
"class=\"directory\">/etc/ufw</filename>, make sure these lines are the last "
8285
"line for each table modified:"
8286
msgstr ""
8287
8288
#: serverguide/C/security.xml:684(programlisting)
8289
#, no-wrap
8290
msgid ""
8291
"\n"
8292
"# don't delete the 'COMMIT' line or these rules won't be processed\n"
8293
"COMMIT\n"
8294
msgstr ""
8295
8296
#: serverguide/C/security.xml:689(para)
8297
msgid ""
8298
"For each <emphasis>Table</emphasis> a corresponding "
8299
"<emphasis>COMMIT</emphasis> statement is required. In these examples only "
8300
"the <emphasis>nat</emphasis> and <emphasis>filter</emphasis> tables are "
8301
"shown, but you can also add rules for the <emphasis>raw</emphasis> and "
8302
"<emphasis>mangle</emphasis> tables."
8303
msgstr ""
8304
8305
#: serverguide/C/security.xml:696(para)
8306
msgid ""
8307
"In the above example replace <emphasis>eth0</emphasis>, "
8308
"<emphasis>eth1</emphasis>, and <emphasis>192.168.0.0/24</emphasis> with the "
8309
"appropriate interfaces and IP range for your network."
8310
msgstr ""
8311
8312
#: serverguide/C/security.xml:704(para)
8313
msgid ""
8314
"Finally, disable and re-enable <application>ufw</application> to apply the "
8315
"changes:"
8316
msgstr ""
8317
8318
#: serverguide/C/security.xml:708(command)
8319
msgid "sudo ufw disable && sudo ufw enable"
8320
msgstr ""
8321
8322
#: serverguide/C/security.xml:712(para)
8323
msgid ""
8324
"IP Masquerading should now be enabled. You can also add any additional "
8325
"FORWARD rules to the <filename>/etc/ufw/before.rules</filename>. It is "
8326
"recommended that these additional rules be added to the <emphasis>ufw-before-"
8327
"forward</emphasis> chain."
8328
msgstr ""
8329
8330
#: serverguide/C/security.xml:719(title)
8331
msgid "iptables Masquerading"
8332
msgstr ""
8333
8334
#: serverguide/C/security.xml:720(para)
8335
msgid ""
8336
"<application>iptables</application> can also be used to enable Masquerading."
8337
msgstr ""
8338
8339
#: serverguide/C/security.xml:725(para)
8340
msgid ""
8341
"Similar to <application>ufw</application>, the first step is to enable IPv4 "
8342
"packet forwarding by editing <filename>/etc/sysctl.conf</filename> and "
8343
"uncomment the following line:"
8344
msgstr ""
8345
8346
#: serverguide/C/security.xml:729(programlisting)
8347
#, no-wrap
8348
msgid ""
8349
"\n"
8350
"net.ipv4.ip_forward=1\n"
8351
msgstr ""
8352
"\n"
8353
"net.ipv4.ip_forward=1\n"
8354
8355
#: serverguide/C/security.xml:732(para)
8356
msgid "If you wish to enable IPv6 forwarding also uncomment:"
8357
msgstr ""
8358
8359
#: serverguide/C/security.xml:735(programlisting)
8360
#, no-wrap
8361
msgid ""
8362
"\n"
8363
"net.ipv6.conf.default.forwarding=1\n"
8364
msgstr ""
8365
"\n"
8366
"net.ipv6.conf.default.forwarding=1\n"
8367
8368
#: serverguide/C/security.xml:740(para)
8369
msgid ""
8370
"Next, execute the <application>sysctl</application> command to enable the "
8371
"new settings in the configuration file:"
8372
msgstr ""
8373
8374
#: serverguide/C/security.xml:744(command)
8375
msgid "sudo sysctl -p"
8376
msgstr "sudo sysctl -p"
8377
8378
#: serverguide/C/security.xml:748(para)
8379
msgid ""
8380
"IP Masquerading can now be accomplished with a single iptables rule, which "
8381
"may differ slightly based on your network configuration:"
8382
msgstr ""
8383
8384
#: serverguide/C/security.xml:751(screen)
8385
#, no-wrap
8386
msgid ""
8387
"\n"
8388
"sudo iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -o ppp0 -j MASQUERADE\n"
8389
msgstr ""
8390
"\n"
8391
"sudo iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -o ppp0 -j MASQUERADE\n"
8392
8393
#: serverguide/C/security.xml:754(para)
8394
msgid ""
8395
"The above command assumes that your private address space is 192.168.0.0/16 "
8396
"and that your Internet-facing device is ppp0. The syntax is broken down as "
8397
"follows:"
8398
msgstr ""
8399
8400
#: serverguide/C/security.xml:759(para)
8401
msgid "-t nat -- the rule is to go into the nat table"
8402
msgstr "-t nat -- aturan ini menuju ke tabel at"
8403
8404
#: serverguide/C/security.xml:760(para)
8405
msgid ""
8406
"-A POSTROUTING -- the rule is to be appended (-A) to the POSTROUTING chain"
8407
msgstr ""
8408
"-A POSTROUTING -- aturan ini akan ditambahkan (-A) ke aturan POSTROUTING"
8409
8410
#: serverguide/C/security.xml:761(para)
8411
msgid ""
8412
"-s 192.168.0.0/16 -- the rule applies to traffic originating from the "
8413
"specified address space"
8414
msgstr ""
8415
"-s 192.168.0.0/16 -- aturan ini berfungsi terhadap aliran data yang berasal "
8416
"dari alamat network yang disebutkan"
8417
8418
#: serverguide/C/security.xml:762(para)
8419
msgid ""
8420
"-o ppp0 -- the rule applies to traffic scheduled to be routed through the "
8421
"specified network device"
8422
msgstr ""
8423
"-o ppp0 -- aturan ini berfungis untuk mengatur aliran data agar di teruskan "
8424
"melalui perangkat network tertentu"
8425
8426
#: serverguide/C/security.xml:764(para)
8427
msgid ""
8428
"-j MASQUERADE -- traffic matching this rule is to \"jump\" (-j) to the "
8429
"MASQUERADE target to be manipulated as described above"
8430
msgstr ""
8431
"-j MASQUERADE -- aliran data yang sesuai dengan aturan ini akan di \"jump\" "
8432
"(-j) ke MASQUERADE target untuk di manipulasi seperti di deskripsikan di atas"
8433
8434
#: serverguide/C/security.xml:772(para)
8435
msgid ""
8436
"Also, each chain in the filter table (the default table, and where most or "
8437
"all packet filtering occurs) has a default <emphasis>policy</emphasis> of "
8438
"ACCEPT, but if you are creating a firewall in addition to a gateway device, "
8439
"you may have set the policies to DROP or REJECT, in which case your "
8440
"masqueraded traffic needs to be allowed through the FORWARD chain for the "
8441
"above rule to work:"
8442
msgstr ""
8443
8444
#: serverguide/C/security.xml:779(screen)
8445
#, no-wrap
8446
msgid ""
8447
"\n"
8448
"sudo iptables -A FORWARD -s 192.168.0.0/16 -o ppp0 -j ACCEPT\n"
8449
"sudo iptables -A FORWARD -d 192.168.0.0/16 -m state \\\n"
8450
"--state ESTABLISHED,RELATED -i ppp0 -j ACCEPT\n"
8451
msgstr ""
8452
8453
#: serverguide/C/security.xml:784(para)
8454
msgid ""
8455
"The above commands will allow all connections from your local network to the "
8456
"Internet and all traffic related to those connections to return to the "
8457
"machine that initiated them."
8458
msgstr ""
8459
8460
#: serverguide/C/security.xml:791(para)
8461
msgid ""
8462
"If you want masquerading to be enabled on reboot, which you probably do, "
8463
"edit <filename>/etc/rc.local</filename> and add any commands used above. For "
8464
"example add the first command with no filtering:"
8465
msgstr ""
8466
8467
#: serverguide/C/security.xml:795(screen)
8468
#, no-wrap
8469
msgid ""
8470
"\n"
8471
"iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -o ppp0 -j MASQUERADE\n"
8472
msgstr ""
8473
8474
#: serverguide/C/security.xml:803(title)
8475
msgid "Logs"
8476
msgstr "Log"
8477
8478
#: serverguide/C/security.xml:804(para)
8479
msgid ""
8480
"Firewall logs are essential for recognizing attacks, troubleshooting your "
8481
"firewall rules, and noticing unusual activity on your network. You must "
8482
"include logging rules in your firewall for them to be generated, though, and "
8483
"logging rules must come before any applicable terminating rule (a rule with "
8484
"a target that decides the fate of the packet, such as ACCEPT, DROP, or "
8485
"REJECT)."
8486
msgstr ""
8487
8488
#: serverguide/C/security.xml:811(para)
8489
msgid ""
8490
"If you are using <application>ufw</application>, you can turn on logging by "
8491
"entering the following in a terminal:"
8492
msgstr ""
8493
8494
#: serverguide/C/security.xml:815(command)
8495
msgid "sudo ufw logging on"
8496
msgstr "sudo ufw logging on"
8497
8498
#: serverguide/C/security.xml:817(para)
8499
msgid ""
8500
"To turn logging off in <application>ufw</application>, simply replace "
8501
"<emphasis role=\"italic\">on</emphasis> with <emphasis "
8502
"role=\"italic\">off</emphasis> in the above command."
8503
msgstr ""
8504
8505
#: serverguide/C/security.xml:820(para)
8506
msgid ""
8507
"If using <application>iptables</application> instead of "
8508
"<application>ufw</application>, enter:"
8509
msgstr ""
8510
8511
#: serverguide/C/security.xml:823(screen)
8512
#, no-wrap
8513
msgid ""
8514
"\n"
8515
"sudo iptables -A INPUT -m state --state NEW -p tcp --dport 80 \\\n"
8516
"-j LOG --log-prefix \"NEW_HTTP_CONN: \"\n"
8517
msgstr ""
8518
8519
#: serverguide/C/security.xml:827(para)
8520
msgid ""
8521
"A request on port 80 from the local machine, then, would generate a log in "
8522
"dmesg that looks like this (single line split into 3 to fit this document):"
8523
msgstr ""
8524
8525
#: serverguide/C/security.xml:831(programlisting)
8526
#, no-wrap
8527
msgid ""
8528
"[4304885.870000] NEW_HTTP_CONN: IN=lo OUT= "
8529
"MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00\n"
8530
"SRC=127.0.0.1 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=58288 DF "
8531
"PROTO=TCP\n"
8532
"SPT=53981 DPT=80 WINDOW=32767 RES=0x00 SYN URGP=0\n"
8533
msgstr ""
8534
8535
#: serverguide/C/security.xml:835(para)
8536
msgid ""
8537
"The above log will also appear in <filename>/var/log/messages</filename>, "
8538
"<filename>/var/log/syslog</filename>, and "
8539
"<filename>/var/log/kern.log</filename>. This behavior can be modified by "
8540
"editing <filename>/etc/syslog.conf</filename> appropriately or by installing "
8541
"and configuring <application>ulogd</application> and using the ULOG target "
8542
"instead of LOG. The <application>ulogd</application> daemon is a userspace "
8543
"server that listens for logging instructions from the kernel specifically "
8544
"for firewalls, and can log to any file you like, or even to a "
8545
"<application>PostgreSQL</application> or <application>MySQL</application> "
8546
"database. Making sense of your firewall logs can be simplified by using a "
8547
"log analyzing tool such as <application>logwatch</application>, "
8548
"<application>fwanalog</application>, <application>fwlogwatch</application>, "
8549
"or <application>lire</application>."
8550
msgstr ""
8551
8552
#: serverguide/C/security.xml:850(title)
8553
msgid "Other Tools"
8554
msgstr ""
8555
8556
#: serverguide/C/security.xml:851(para)
8557
msgid ""
8558
"There are many tools available to help you construct a complete firewall "
8559
"without intimate knowledge of iptables. For the GUI-inclined:"
8560
msgstr ""
8561
8562
#: serverguide/C/security.xml:857(para)
8563
msgid ""
8564
"<ulink url=\"http://www.fwbuilder.org/\">fwbuilder</ulink> is very powerful "
8565
"and will look familiar to an administrator who has used a commercial "
8566
"firewall utility such as <application>Checkpoint FireWall-1</application>."
8567
msgstr ""
8568
8569
#: serverguide/C/security.xml:863(para)
8570
msgid ""
8571
"If you prefer a command-line tool with plain-text configuration files:"
8572
msgstr ""
8573
8574
#: serverguide/C/security.xml:868(para)
8575
msgid ""
8576
"<ulink url=\"http://www.shorewall.net/\">Shorewall</ulink> is a very "
8577
"powerful solution to help you configure an advanced firewall for any network."
8578
msgstr ""
8579
8580
#: serverguide/C/security.xml:879(para)
8581
msgid ""
8582
"The <ulink url=\"https://wiki.ubuntu.com/UncomplicatedFirewall\">Ubuntu "
8583
"Firewall</ulink> wiki page contains information on the development of "
8584
"<application>ufw</application>."
8585
msgstr ""
8586
8587
#: serverguide/C/security.xml:885(para)
8588
msgid ""
8589
"Also, the <application>ufw</application> manual page contains some very "
8590
"useful information: <command>man ufw</command>."
8591
msgstr ""
8592
8593
#: serverguide/C/security.xml:890(para)
8594
msgid ""
8595
"See the <ulink url=\"http://www.netfilter.org/documentation/HOWTO/packet-"
8596
"filtering-HOWTO.html\">packet-filtering-HOWTO</ulink> for more information "
8597
"on using <application>iptables</application>."
8598
msgstr ""
8599
8600
#: serverguide/C/security.xml:896(para)
8601
msgid ""
8602
"The <ulink url=\"http://www.netfilter.org/documentation/HOWTO/NAT-"
8603
"HOWTO.html\">nat-HOWTO</ulink> contains further details on masquerading."
8604
msgstr ""
8605
8606
#: serverguide/C/security.xml:902(para)
8607
msgid ""
8608
"The <ulink url=\"https://help.ubuntu.com/community/IptablesHowTo\">IPTables "
8609
"HowTo</ulink> in the Ubuntu wiki is a great resource."
8610
msgstr ""
8611
8612
#: serverguide/C/security.xml:910(title)
8613
msgid "AppArmor"
8614
msgstr "AppArmor"
8615
8616
#: serverguide/C/security.xml:911(para)
8617
msgid ""
8618
"<application>AppArmor</application> is a Linux Security Module "
8619
"implementation of name-based mandatory access controls. AppArmor confines "
8620
"individual programs to a set of listed files and posix 1003.1e draft "
8621
"capabilities."
8622
msgstr ""
8623
8624
#: serverguide/C/security.xml:915(para)
8625
msgid ""
8626
"<application>AppArmor</application> is installed and loaded by default. It "
8627
"uses <emphasis>profiles</emphasis> of an application to determine what files "
8628
"and permissions the application requires. Some packages will install their "
8629
"own profiles, and additional profiles can be found in the "
8630
"<application>apparmor-profiles</application> package."
8631
msgstr ""
8632
8633
#: serverguide/C/security.xml:920(para)
8634
msgid ""
8635
"To install the <application>apparmor-profiles</application> package from a "
8636
"terminal prompt:"
8637
msgstr ""
8638
8639
#: serverguide/C/security.xml:924(command)
8640
msgid "sudo apt install apparmor-profiles"
8641
msgstr "sudo apt install apparmor-profiles"
8642
8643
#: serverguide/C/security.xml:926(para)
8644
msgid "AppArmor profiles have two modes of execution:"
8645
msgstr ""
8646
8647
#: serverguide/C/security.xml:931(para)
8648
msgid ""
8649
"Complaining/Learning: profile violations are permitted and logged. Useful "
8650
"for testing and developing new profiles."
8651
msgstr ""
8652
8653
#: serverguide/C/security.xml:936(para)
8654
msgid ""
8655
"Enforced/Confined: enforces profile policy as well as logging the violation."
8656
msgstr ""
8657
8658
#: serverguide/C/security.xml:942(title)
8659
msgid "Using AppArmor"
8660
msgstr ""
8661
8662
#: serverguide/C/security.xml:944(para)
8663
msgid ""
8664
"This section is plagued by a bug (<ulink "
8665
"url=\"https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1304134\">LP "
8666
"#1304134</ulink>) and instructions will not work as advertised."
8667
msgstr ""
8668
8669
#: serverguide/C/security.xml:949(para)
8670
msgid ""
8671
"The <application>apparmor-utils</application> package contains command line "
8672
"utilities that you can use to change the <application>AppArmor</application> "
8673
"execution mode, find the status of a profile, create new profiles, etc."
8674
msgstr ""
8675
8676
#: serverguide/C/security.xml:955(para)
8677
msgid ""
8678
"<application>apparmor_status</application> is used to view the current "
8679
"status of AppArmor profiles."
8680
msgstr ""
8681
8682
#: serverguide/C/security.xml:959(command)
8683
msgid "sudo apparmor_status"
8684
msgstr "sudo apparmor_status"
8685
8686
#: serverguide/C/security.xml:963(para)
8687
msgid ""
8688
"<application>aa-complain</application> places a profile into "
8689
"<emphasis>complain</emphasis> mode."
8690
msgstr ""
8691
8692
#: serverguide/C/security.xml:967(command)
8693
msgid "sudo aa-complain /path/to/bin"
8694
msgstr "sudo aa-complain /path/to/bin"
8695
8696
#: serverguide/C/security.xml:971(para)
8697
msgid ""
8698
"<application>aa-enforce</application> places a profile into "
8699
"<emphasis>enforce</emphasis> mode."
8700
msgstr ""
8701
8702
#: serverguide/C/security.xml:975(command)
8703
msgid "sudo aa-enforce /path/to/bin"
8704
msgstr "sudo aa-enforce /path/to/bin"
8705
8706
#: serverguide/C/security.xml:979(para)
8707
msgid ""
8708
"The <filename>/etc/apparmor.d</filename> directory is where the AppArmor "
8709
"profiles are located. It can be used to manipulate the "
8710
"<emphasis>mode</emphasis> of all profiles."
8711
msgstr ""
8712
8713
#: serverguide/C/security.xml:983(para)
8714
msgid "Enter the following to place all profiles into complain mode:"
8715
msgstr ""
8716
8717
#: serverguide/C/security.xml:987(command)
8718
msgid "sudo aa-complain /etc/apparmor.d/*"
8719
msgstr "sudo aa-complain /etc/apparmor.d/*"
8720
8721
#: serverguide/C/security.xml:989(para)
8722
msgid "To place all profiles in enforce mode:"
8723
msgstr ""
8724
8725
#: serverguide/C/security.xml:993(command)
8726
msgid "sudo aa-enforce /etc/apparmor.d/*"
8727
msgstr "sudo aa-enforce /etc/apparmor.d/*"
8728
8729
#: serverguide/C/security.xml:997(para)
8730
msgid ""
8731
"<application>apparmor_parser</application> is used to load a profile into "
8732
"the kernel. It can also be used to reload a currently loaded profile using "
8733
"the <emphasis>-r</emphasis> option. To load a profile:"
8734
msgstr ""
8735
8736
#: serverguide/C/security.xml:1002(command) serverguide/C/security.xml:1034(command)
8737
msgid "cat /etc/apparmor.d/profile.name | sudo apparmor_parser -a"
8738
msgstr "cat /etc/apparmor.d/profile.name | sudo apparmor_parser -a"
8739
8740
#: serverguide/C/security.xml:1004(para)
8741
msgid "To reload a profile:"
8742
msgstr ""
8743
8744
#: serverguide/C/security.xml:1008(command)
8745
msgid "cat /etc/apparmor.d/profile.name | sudo apparmor_parser -r"
8746
msgstr "cat /etc/apparmor.d/profile.name | sudo apparmor_parser -r"
8747
8748
#: serverguide/C/security.xml:1012(para)
8749
msgid ""
8750
"<filename>systemctl</filename> can be used to <emphasis>reload</emphasis> "
8751
"all profiles:"
8752
msgstr ""
8753
8754
#: serverguide/C/security.xml:1016(command)
8755
msgid "sudo systemctl reload apparmor.service"
8756
msgstr "sudo systemctl reload apparmor.service"
8757
8758
#: serverguide/C/security.xml:1020(para)
8759
msgid ""
8760
"The <filename>/etc/apparmor.d/disable</filename> directory can be used along "
8761
"with the <application>apparmor_parser -R</application> option to "
8762
"<emphasis>disable</emphasis> a profile."
8763
msgstr ""
8764
8765
#: serverguide/C/security.xml:1025(command)
8766
msgid "sudo ln -s /etc/apparmor.d/profile.name /etc/apparmor.d/disable/"
8767
msgstr "sudo ln -s /etc/apparmor.d/profile.name /etc/apparmor.d/disable/"
8768
8769
#: serverguide/C/security.xml:1026(command)
8770
msgid "sudo apparmor_parser -R /etc/apparmor.d/profile.name"
8771
msgstr "sudo apparmor_parser -R /etc/apparmor.d/profile.name"
8772
8773
#: serverguide/C/security.xml:1028(para)
8774
msgid ""
8775
"To <emphasis>re-enable</emphasis> a disabled profile remove the symbolic "
8776
"link to the profile in <filename>/etc/apparmor.d/disable/</filename>. Then "
8777
"load the profile using the <emphasis>-a</emphasis> option."
8778
msgstr ""
8779
8780
#: serverguide/C/security.xml:1033(command)
8781
msgid "sudo rm /etc/apparmor.d/disable/profile.name"
8782
msgstr "sudo rm /etc/apparmor.d/disable/profile.name"
8783
8784
#: serverguide/C/security.xml:1038(para)
8785
msgid ""
8786
"<application>AppArmor</application> can be disabled, and the kernel module "
8787
"unloaded by entering the following:"
8788
msgstr ""
8789
8790
#: serverguide/C/security.xml:1042(command)
8791
msgid "sudo systemctl stop apparmor.service"
8792
msgstr "sudo systemctl stop apparmor.service"
8793
8794
#: serverguide/C/security.xml:1043(command)
8795
msgid "sudo update-rc.d -f apparmor remove"
8796
msgstr "sudo update-rc.d -f apparmor remove"
8797
8798
#: serverguide/C/security.xml:1047(para)
8799
msgid "To re-enable <application>AppArmor</application> enter:"
8800
msgstr ""
8801
8802
#: serverguide/C/security.xml:1051(command)
8803
msgid "sudo systemctl start apparmor.service"
8804
msgstr "sudo systemctl start apparmor.service"
8805
8806
#: serverguide/C/security.xml:1052(command)
8807
msgid "sudo update-rc.d apparmor defaults"
8808
msgstr "sudo update-rc.d apparmor defaults"
8809
8810
#: serverguide/C/security.xml:1057(para)
8811
msgid ""
8812
"Replace <emphasis>profile.name</emphasis> with the name of the profile you "
8813
"want to manipulate. Also, replace <filename>/path/to/bin/</filename> with "
8814
"the actual executable file path. For example for the "
8815
"<application>ping</application> command use <filename>/bin/ping</filename>"
8816
msgstr ""
8817
8818
#: serverguide/C/security.xml:1066(para)
8819
msgid ""
8820
"<application>AppArmor</application> profiles are simple text files located "
8821
"in <filename>/etc/apparmor.d/</filename>. The files are named after the full "
8822
"path to the executable they profile replacing the \"/\" with \".\". For "
8823
"example <filename>/etc/apparmor.d/bin.ping</filename> is the AppArmor "
8824
"profile for the <filename>/bin/ping</filename> command."
8825
msgstr ""
8826
8827
#: serverguide/C/security.xml:1072(para)
8828
msgid "There are two main type of rules used in profiles:"
8829
msgstr ""
8830
8831
#: serverguide/C/security.xml:1077(para)
8832
msgid ""
8833
"<emphasis>Path entries:</emphasis> detail which files an application can "
8834
"access in the file system."
8835
msgstr ""
8836
8837
#: serverguide/C/security.xml:1082(para)
8838
msgid ""
8839
"<emphasis>Capability entries:</emphasis> determine what privileges a "
8840
"confined process is allowed to use."
8841
msgstr ""
8842
8843
#: serverguide/C/security.xml:1087(para)
8844
msgid ""
8845
"As an example, take a look at <filename>/etc/apparmor.d/bin.ping</filename>:"
8846
msgstr ""
8847
8848
#: serverguide/C/security.xml:1090(programlisting)
8849
#, no-wrap
8850
msgid ""
8851
"\n"
8852
"#include <tunables/global>\n"
8853
"/bin/ping flags=(complain) {\n"
8854
" #include <abstractions/base>\n"
8855
" #include <abstractions/consoles>\n"
8856
" #include <abstractions/nameservice>\n"
8857
"\n"
8858
" capability net_raw,\n"
8859
" capability setuid,\n"
8860
" network inet raw,\n"
8861
" \n"
8862
" /bin/ping mixr,\n"
8863
" /etc/modules.conf r,\n"
8864
"}\n"
8865
msgstr ""
8866
8867
#: serverguide/C/security.xml:1107(para)
8868
msgid ""
8869
"<emphasis>#include <tunables/global>:</emphasis> include statements "
8870
"from other files. This allows statements pertaining to multiple applications "
8871
"to be placed in a common file."
8872
msgstr ""
8873
8874
#: serverguide/C/security.xml:1113(para)
8875
msgid ""
8876
"<emphasis>/bin/ping flags=(complain):</emphasis> path to the profiled "
8877
"program, also setting the mode to <emphasis>complain</emphasis>."
8878
msgstr ""
8879
8880
#: serverguide/C/security.xml:1119(para)
8881
msgid ""
8882
"<emphasis>capability net_raw,:</emphasis> allows the application access to "
8883
"the CAP_NET_RAW Posix.1e capability."
8884
msgstr ""
8885
8886
#: serverguide/C/security.xml:1124(para)
8887
msgid ""
8888
"<emphasis>/bin/ping mixr,:</emphasis> allows the application read and "
8889
"execute access to the file."
8890
msgstr ""
8891
8892
#: serverguide/C/security.xml:1130(para)
8893
msgid ""
8894
"After editing a profile file the profile must be reloaded. See <xref "
8895
"linkend=\"apparmor-usage\"/> for details."
8896
msgstr ""
8897
8898
#: serverguide/C/security.xml:1135(title)
8899
msgid "Creating a Profile"
8900
msgstr ""
8901
8902
#: serverguide/C/security.xml:1138(para)
8903
msgid ""
8904
"<emphasis>Design a test plan:</emphasis> Try to think about how the "
8905
"application should be exercised. The test plan should be divided into small "
8906
"test cases. Each test case should have a small description and list the "
8907
"steps to follow."
8908
msgstr ""
8909
8910
#: serverguide/C/security.xml:1142(para)
8911
msgid "Some standard test cases are:"
8912
msgstr ""
8913
8914
#: serverguide/C/security.xml:1147(para)
8915
msgid "Starting the program."
8916
msgstr ""
8917
8918
#: serverguide/C/security.xml:1152(para)
8919
msgid "Stopping the program."
8920
msgstr ""
8921
8922
#: serverguide/C/security.xml:1157(para)
8923
msgid "Reloading the program."
8924
msgstr ""
8925
8926
#: serverguide/C/security.xml:1162(para)
8927
msgid "Testing all the commands supported by the init script."
8928
msgstr ""
8929
8930
#: serverguide/C/security.xml:1169(para)
8931
msgid ""
8932
"<emphasis>Generate the new profile:</emphasis> Use <application>aa-"
8933
"genprof</application> to generate a new profile. From a terminal:"
8934
msgstr ""
8935
8936
#: serverguide/C/security.xml:1174(command)
8937
msgid "sudo aa-genprof executable"
8938
msgstr ""
8939
8940
#: serverguide/C/security.xml:1176(para)
8941
msgid "For example:"
8942
msgstr ""
8943
8944
#: serverguide/C/security.xml:1180(command)
8945
msgid "sudo aa-genprof slapd"
8946
msgstr ""
8947
8948
#: serverguide/C/security.xml:1184(para)
8949
msgid ""
8950
"To get your new profile included in the <application>apparmor-"
8951
"profiles</application> package, file a bug in <emphasis>Launchpad</emphasis> "
8952
"against the <ulink "
8953
"url=\"https://bugs.launchpad.net/ubuntu/+source/apparmor/+filebug\">AppArmor<"
8954
"/ulink> package:"
8955
msgstr ""
8956
8957
#: serverguide/C/security.xml:1191(para)
8958
msgid "Include your test plan and test cases."
8959
msgstr ""
8960
8961
#: serverguide/C/security.xml:1196(para)
8962
msgid "Attach your new profile to the bug."
8963
msgstr ""
8964
8965
#: serverguide/C/security.xml:1205(title)
8966
msgid "Updating Profiles"
8967
msgstr ""
8968
8969
#: serverguide/C/security.xml:1206(para)
8970
msgid ""
8971
"When the program is misbehaving, audit messages are sent to the log files. "
8972
"The program <application>aa-logprof</application> can be used to scan log "
8973
"files for <application>AppArmor</application> audit messages, review them "
8974
"and update the profiles. From a terminal:"
8975
msgstr ""
8976
8977
#: serverguide/C/security.xml:1211(command)
8978
msgid "sudo aa-logprof"
8979
msgstr ""
8980
8981
#: serverguide/C/security.xml:1219(para)
8982
msgid ""
8983
"See the <ulink "
8984
"url=\"http://www.novell.com/documentation/apparmor/apparmor201_sp10_admin/ind"
8985
"ex.html?page=/documentation/apparmor/apparmor201_sp10_admin/data/book_apparmo"
8986
"r_admin.html\">AppArmor Administration Guide</ulink> for advanced "
8987
"configuration options."
8988
msgstr ""
8989
8990
#: serverguide/C/security.xml:1226(para)
8991
msgid ""
8992
"For details using AppArmor with other Ubuntu releases see the <ulink "
8993
"url=\"https://help.ubuntu.com/community/AppArmor\"> AppArmor Community "
8994
"Wiki</ulink> page."
8995
msgstr ""
8996
8997
#: serverguide/C/security.xml:1234(para)
8998
msgid ""
8999
"The <ulink url=\"http://en.opensuse.org/SDB:AppArmor_geeks\">OpenSUSE "
9000
"AppArmor</ulink> page is another introduction to AppArmor."
9001
msgstr ""
9002
9003
#: serverguide/C/security.xml:1241(para)
9004
msgid ""
9005
"A great place to ask for <application>AppArmor</application> assistance, and "
9006
"get involved with the Ubuntu Server community, is the <emphasis>#ubuntu-"
9007
"server</emphasis> IRC channel on <ulink "
9008
"url=\"http://freenode.net\">freenode</ulink>."
9009
msgstr ""
9010
9011
#: serverguide/C/security.xml:1251(title)
9012
msgid "Certificates"
9013
msgstr ""
9014
9015
#: serverguide/C/security.xml:1252(para)
9016
msgid ""
9017
"One of the most common forms of cryptography today is <emphasis>public-"
9018
"key</emphasis> cryptography. Public-key cryptography utilizes a "
9019
"<emphasis>public key</emphasis> and a <emphasis>private key</emphasis>. The "
9020
"system works by <emphasis>encrypting</emphasis> information using the public "
9021
"key. The information can then only be <emphasis>decrypted</emphasis> using "
9022
"the private key."
9023
msgstr ""
9024
9025
#: serverguide/C/security.xml:1258(para)
9026
msgid ""
9027
"A common use for public-key cryptography is encrypting application traffic "
9028
"using a Secure Socket Layer (SSL) or Transport Layer Security (TLS) "
9029
"connection. One example: configuring Apache to provide "
9030
"<emphasis>HTTPS</emphasis>, the HTTP protocol over SSL. This allows a way to "
9031
"encrypt traffic using a protocol that does not itself provide encryption."
9032
msgstr ""
9033
9034
#: serverguide/C/security.xml:1263(para)
9035
msgid ""
9036
"A <emphasis>Certificate</emphasis> is a method used to distribute a "
9037
"<emphasis>public key</emphasis> and other information about a server and the "
9038
"organization who is responsible for it. Certificates can be digitally signed "
9039
"by a <emphasis>Certification Authority</emphasis>, or CA. A CA is a trusted "
9040
"third party that has confirmed that the information contained in the "
9041
"certificate is accurate."
9042
msgstr ""
9043
9044
#: serverguide/C/security.xml:1270(title)
9045
msgid "Types of Certificates"
9046
msgstr "Tipe Sertifikat"
9047
9048
#: serverguide/C/security.xml:1271(para)
9049
msgid ""
9050
"To set up a secure server using public-key cryptography, in most cases, you "
9051
"send your certificate request (including your public key), proof of your "
9052
"company's identity, and payment to a CA. The CA verifies the certificate "
9053
"request and your identity, and then sends back a certificate for your secure "
9054
"server. Alternatively, you can create your own <emphasis>self-"
9055
"signed</emphasis> certificate."
9056
msgstr ""
9057
9058
#: serverguide/C/security.xml:1281(para)
9059
msgid ""
9060
"Note that self-signed certificates should not be used in most production "
9061
"environments."
9062
msgstr ""
9063
9064
#: serverguide/C/security.xml:1285(para)
9065
msgid ""
9066
"Continuing the HTTPS example, a CA-signed certificate provides two important "
9067
"capabilities that a self-signed certificate does not:"
9068
msgstr ""
9069
9070
#: serverguide/C/security.xml:1292(para)
9071
msgid ""
9072
"Browsers (usually) automatically recognize the certificate and allow a "
9073
"secure connection to be made without prompting the user."
9074
msgstr ""
9075
9076
#: serverguide/C/security.xml:1299(para)
9077
msgid ""
9078
"When a CA issues a signed certificate, it is guaranteeing the identity of "
9079
"the organization that is providing the web pages to the browser."
9080
msgstr ""
9081
9082
#: serverguide/C/security.xml:1307(para)
9083
msgid ""
9084
"Most Web browsers, and computers, that support SSL have a list of CAs whose "
9085
"certificates they automatically accept. If a browser encounters a "
9086
"certificate whose authorizing CA is not in the list, the browser asks the "
9087
"user to either accept or decline the connection. Also, other applications "
9088
"may generate an error message when using a self-signed certificate."
9089
msgstr ""
9090
9091
#: serverguide/C/security.xml:1315(para)
9092
msgid ""
9093
"The process of getting a certificate from a CA is fairly easy. A quick "
9094
"overview is as follows:"
9095
msgstr ""
9096
9097
#: serverguide/C/security.xml:1322(para)
9098
msgid "Create a private and public encryption key pair."
9099
msgstr "Buat pasangan kunci enkripsi private dan public."
9100
9101
#: serverguide/C/security.xml:1325(para)
9102
msgid ""
9103
"Create a certificate request based on the public key. The certificate "
9104
"request contains information about your server and the company hosting it."
9105
msgstr ""
9106
"Membuat permintaan sertifikat yang berbasiskan kunci publik. Sertifikat ini "
9107
"mengandung permintaan tentang server anda dan perusahaan yang menghosting"
9108
9109
#: serverguide/C/security.xml:1330(para)
9110
msgid ""
9111
"Send the certificate request, along with documents proving your identity, to "
9112
"a CA. We cannot tell you which certificate authority to choose. Your "
9113
"decision may be based on your past experiences, or on the experiences of "
9114
"your friends or colleagues, or purely on monetary factors."
9115
msgstr ""
9116
9117
#: serverguide/C/security.xml:1336(para)
9118
msgid ""
9119
"Once you have decided upon a CA, you need to follow the instructions they "
9120
"provide on how to obtain a certificate from them."
9121
msgstr ""
9122
9123
#: serverguide/C/security.xml:1341(para)
9124
msgid ""
9125
"When the CA is satisfied that you are indeed who you claim to be, they send "
9126
"you a digital certificate."
9127
msgstr ""
9128
9129
#: serverguide/C/security.xml:1345(para)
9130
msgid ""
9131
"Install this certificate on your secure server, and configure the "
9132
"appropriate applications to use the certificate."
9133
msgstr ""
9134
9135
#: serverguide/C/security.xml:1354(title)
9136
msgid "Generating a Certificate Signing Request (CSR)"
9137
msgstr "Men-generate Certificate Signing Request (CSR)"
9138
9139
#: serverguide/C/security.xml:1356(para)
9140
msgid ""
9141
"Whether you are getting a certificate from a CA or generating your own self-"
9142
"signed certificate, the first step is to generate a key."
9143
msgstr ""
9144
9145
#: serverguide/C/security.xml:1361(para)
9146
msgid ""
9147
"If the certificate will be used by service daemons, such as Apache, Postfix, "
9148
"Dovecot, etc., a key without a passphrase is often appropriate. Not having a "
9149
"passphrase allows the services to start without manual intervention, usually "
9150
"the preferred way to start a daemon."
9151
msgstr ""
9152
9153
#: serverguide/C/security.xml:1367(para)
9154
msgid ""
9155
"This section will cover generating a key with a passphrase, and one without. "
9156
"The non-passphrase key will then be used to generate a certificate that can "
9157
"be used with various service daemons."
9158
msgstr ""
9159
9160
#: serverguide/C/security.xml:1373(para)
9161
msgid ""
9162
"Running your secure service without a passphrase is convenient because you "
9163
"will not need to enter the passphrase every time you start your secure "
9164
"service. But it is insecure and a compromise of the key means a compromise "
9165
"of the server as well."
9166
msgstr ""
9167
9168
#: serverguide/C/security.xml:1380(para)
9169
msgid ""
9170
"To generate the <emphasis>keys</emphasis> for the Certificate Signing "
9171
"Request (CSR) run the following command from a terminal prompt:"
9172
msgstr ""
9173
9174
#: serverguide/C/security.xml:1386(command)
9175
msgid "openssl genrsa -des3 -out server.key 2048"
9176
msgstr ""
9177
9178
#: serverguide/C/security.xml:1389(programlisting)
9179
#, no-wrap
9180
msgid ""
9181
"\n"
9182
"Generating RSA private key, 2048 bit long modulus\n"
9183
"..........................++++++\n"
9184
".......++++++\n"
9185
"e is 65537 (0x10001)\n"
9186
"Enter pass phrase for server.key:\n"
9187
msgstr ""
9188
9189
#: serverguide/C/security.xml:1397(para)
9190
msgid ""
9191
"You can now enter your passphrase. For best security, it should at least "
9192
"contain eight characters. The minimum length when specifying -des3 is four "
9193
"characters. It should include numbers and/or punctuation and not be a word "
9194
"in a dictionary. Also remember that your passphrase is case-sensitive."
9195
msgstr ""
9196
9197
#: serverguide/C/security.xml:1405(para)
9198
msgid ""
9199
"Re-type the passphrase to verify. Once you have re-typed it correctly, the "
9200
"server key is generated and stored in the <filename>server.key</filename> "
9201
"file."
9202
msgstr ""
9203
9204
#: serverguide/C/security.xml:1411(para)
9205
msgid ""
9206
"Now create the insecure key, the one without a passphrase, and shuffle the "
9207
"key names:"
9208
msgstr ""
9209
9210
#: serverguide/C/security.xml:1417(command)
9211
msgid "openssl rsa -in server.key -out server.key.insecure"
9212
msgstr "openssl rsa -in server.key -out server.key.insecure"
9213
9214
#: serverguide/C/security.xml:1418(command)
9215
msgid "mv server.key server.key.secure"
9216
msgstr ""
9217
9218
#: serverguide/C/security.xml:1419(command)
9219
msgid "mv server.key.insecure server.key"
9220
msgstr ""
9221
9222
#: serverguide/C/security.xml:1422(para)
9223
msgid ""
9224
"The insecure key is now named <filename>server.key</filename>, and you can "
9225
"use this file to generate the CSR without passphrase."
9226
msgstr ""
9227
9228
#: serverguide/C/security.xml:1427(para)
9229
msgid "To create the CSR, run the following command at a terminal prompt:"
9230
msgstr "Untuk membuat CSR, jalankan perintah berikut pada terminal prompt:"
9231
9232
#: serverguide/C/security.xml:1432(command)
9233
msgid "openssl req -new -key server.key -out server.csr"
9234
msgstr "openssl req -new -key server.key -out server.csr"
9235
9236
#: serverguide/C/security.xml:1435(para)
9237
msgid ""
9238
"It will prompt you enter the passphrase. If you enter the correct "
9239
"passphrase, it will prompt you to enter Company Name, Site Name, Email Id, "
9240
"etc. Once you enter all these details, your CSR will be created and it will "
9241
"be stored in the <filename>server.csr</filename> file."
9242
msgstr ""
9243
9244
#: serverguide/C/security.xml:1443(para)
9245
msgid ""
9246
"You can now submit this CSR file to a CA for processing. The CA will use "
9247
"this CSR file and issue the certificate. On the other hand, you can create "
9248
"self-signed certificate using this CSR."
9249
msgstr ""
9250
9251
#: serverguide/C/security.xml:1451(title)
9252
msgid "Creating a Self-Signed Certificate"
9253
msgstr "Membuat Self-Signed Certificate"
9254
9255
#: serverguide/C/security.xml:1452(para)
9256
msgid ""
9257
"To create the self-signed certificate, run the following command at a "
9258
"terminal prompt:"
9259
msgstr ""
9260
"Untuk membuat self-signed certificate, jalankan perintah berikut pada "
9261
"terminal prompt:"
9262
9263
#: serverguide/C/security.xml:1457(command)
9264
msgid ""
9265
"openssl x509 -req -days 365 -in server.csr -signkey server.key -out "
9266
"server.crt"
9267
msgstr ""
9268
"openssl x509 -req -days 365 -in server.csr -signkey server.key -out "
9269
"server.crt"
9270
9271
#: serverguide/C/security.xml:1460(para)
9272
msgid ""
9273
"The above command will prompt you to enter the passphrase. Once you enter "
9274
"the correct passphrase, your certificate will be created and it will be "
9275
"stored in the <filename>server.crt</filename> file."
9276
msgstr ""
9277
9278
#: serverguide/C/security.xml:1465(para)
9279
msgid ""
9280
"If your secure server is to be used in a production environment, you "
9281
"probably need a CA-signed certificate. It is not recommended to use self-"
9282
"signed certificate."
9283
msgstr ""
9284
9285
#: serverguide/C/security.xml:1473(title)
9286
msgid "Installing the Certificate"
9287
msgstr "Menginstal Certificate"
9288
9289
#: serverguide/C/security.xml:1475(para)
9290
msgid ""
9291
"You can install the key file <filename>server.key</filename> and certificate "
9292
"file <filename>server.crt</filename>, or the certificate file issued by your "
9293
"CA, by running following commands at a terminal prompt:"
9294
msgstr ""
9295
9296
#: serverguide/C/security.xml:1481(command)
9297
msgid "sudo cp server.crt /etc/ssl/certs"
9298
msgstr "sudo cp server.crt /etc/ssl/certs"
9299
9300
#: serverguide/C/security.xml:1482(command)
9301
msgid "sudo cp server.key /etc/ssl/private"
9302
msgstr "sudo cp server.key /etc/ssl/private"
9303
9304
#: serverguide/C/security.xml:1484(para)
9305
msgid ""
9306
"Now simply configure any applications, with the ability to use public-key "
9307
"cryptography, to use the <emphasis>certificate</emphasis> and "
9308
"<emphasis>key</emphasis> files. For example, "
9309
"<application>Apache</application> can provide HTTPS, "
9310
"<application>Dovecot</application> can provide IMAPS and POP3S, etc."
9311
msgstr ""
9312
9313
#: serverguide/C/security.xml:1491(title)
9314
msgid "Certification Authority"
9315
msgstr ""
9316
9317
#: serverguide/C/security.xml:1493(para)
9318
msgid ""
9319
"If the services on your network require more than a few self-signed "
9320
"certificates it may be worth the additional effort to setup your own "
9321
"internal <emphasis>Certification Authority (CA)</emphasis>. Using "
9322
"certificates signed by your own CA, allows the various services using the "
9323
"certificates to easily trust other services using certificates issued from "
9324
"the same CA."
9325
msgstr ""
9326
9327
#: serverguide/C/security.xml:1503(para)
9328
msgid ""
9329
"First, create the directories to hold the CA certificate and related files:"
9330
msgstr ""
9331
9332
#: serverguide/C/security.xml:1508(command)
9333
msgid "sudo mkdir /etc/ssl/CA"
9334
msgstr ""
9335
9336
#: serverguide/C/security.xml:1509(command)
9337
msgid "sudo mkdir /etc/ssl/newcerts"
9338
msgstr ""
9339
9340
#: serverguide/C/security.xml:1515(para)
9341
msgid ""
9342
"The CA needs a few additional files to operate, one to keep track of the "
9343
"last serial number used by the CA, each certificate must have a unique "
9344
"serial number, and another file to record which certificates have been "
9345
"issued:"
9346
msgstr ""
9347
9348
#: serverguide/C/security.xml:1522(command)
9349
msgid "sudo sh -c \"echo '01' > /etc/ssl/CA/serial\""
9350
msgstr ""
9351
9352
#: serverguide/C/security.xml:1523(command)
9353
msgid "sudo touch /etc/ssl/CA/index.txt"
9354
msgstr ""
9355
9356
#: serverguide/C/security.xml:1529(para)
9357
msgid ""
9358
"The third file is a CA configuration file. Though not strictly necessary, it "
9359
"is very convenient when issuing multiple certificates. Edit "
9360
"<filename>/etc/ssl/openssl.cnf</filename>, and in the <emphasis>[ CA_default "
9361
"]</emphasis> change:"
9362
msgstr ""
9363
9364
#: serverguide/C/security.xml:1535(programlisting)
9365
#, no-wrap
9366
msgid ""
9367
"\n"
9368
"dir = /etc/ssl # Where everything is kept\n"
9369
"database = $dir/CA/index.txt # database index file.\n"
9370
"certificate = $dir/certs/cacert.pem # The CA certificate\n"
9371
"serial = $dir/CA/serial # The current serial number\n"
9372
"private_key = $dir/private/cakey.pem# The private key\n"
9373
msgstr ""
9374
9375
#: serverguide/C/security.xml:1546(para)
9376
msgid "Next, create the self-signed root certificate:"
9377
msgstr ""
9378
9379
#: serverguide/C/security.xml:1551(command)
9380
msgid ""
9381
"openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -"
9382
"days 3650"
9383
msgstr ""
9384
9385
#: serverguide/C/security.xml:1554(para)
9386
msgid "You will then be asked to enter the details about the certificate."
9387
msgstr ""
9388
9389
#: serverguide/C/security.xml:1561(para)
9390
msgid "Now install the root certificate and key:"
9391
msgstr ""
9392
9393
#: serverguide/C/security.xml:1566(command)
9394
msgid "sudo mv cakey.pem /etc/ssl/private/"
9395
msgstr "sudo mv cakey.pem /etc/ssl/private/"
9396
9397
#: serverguide/C/security.xml:1567(command)
9398
msgid "sudo mv cacert.pem /etc/ssl/certs/"
9399
msgstr "sudo mv cacert.pem /etc/ssl/certs/"
9400
9401
#: serverguide/C/security.xml:1573(para)
9402
msgid ""
9403
"You are now ready to start signing certificates. The first item needed is a "
9404
"Certificate Signing Request (CSR), see <xref linkend=\"generating-a-csr\"/> "
9405
"for details. Once you have a CSR, enter the following to generate a "
9406
"certificate signed by the CA:"
9407
msgstr ""
9408
9409
#: serverguide/C/security.xml:1580(command)
9410
msgid "sudo openssl ca -in server.csr -config /etc/ssl/openssl.cnf"
9411
msgstr ""
9412
9413
#: serverguide/C/security.xml:1583(para)
9414
msgid ""
9415
"After entering the password for the CA key, you will be prompted to sign the "
9416
"certificate, and again to commit the new certificate. You should then see a "
9417
"somewhat large amount of output related to the certificate creation."
9418
msgstr ""
9419
9420
#: serverguide/C/security.xml:1592(para)
9421
msgid ""
9422
"There should now be a new file, "
9423
"<filename>/etc/ssl/newcerts/01.pem</filename>, containing the same output. "
9424
"Copy and paste everything beginning with the line: <emphasis>-----BEGIN "
9425
"CERTIFICATE-----</emphasis> and continuing through the line: <emphasis>----"
9426
"END CERTIFICATE-----</emphasis> lines to a file named after the hostname of "
9427
"the server where the certificate will be installed. For example "
9428
"<filename>mail.example.com.crt</filename>, is a nice descriptive name."
9429
msgstr ""
9430
9431
#: serverguide/C/security.xml:1600(para)
9432
msgid ""
9433
"Subsequent certificates will be named <filename>02.pem</filename>, "
9434
"<filename>03.pem</filename>, etc."
9435
msgstr ""
9436
9437
#: serverguide/C/security.xml:1605(para)
9438
msgid ""
9439
"Replace <emphasis>mail.example.com.crt</emphasis> with your own descriptive "
9440
"name."
9441
msgstr ""
9442
9443
#: serverguide/C/security.xml:1613(para)
9444
msgid ""
9445
"Finally, copy the new certificate to the host that needs it, and configure "
9446
"the appropriate applications to use it. The default location to install "
9447
"certificates is <filename role=\"directory\">/etc/ssl/certs</filename>. This "
9448
"enables multiple services to use the same certificate without overly "
9449
"complicated file permissions."
9450
msgstr ""
9451
9452
#: serverguide/C/security.xml:1619(para)
9453
msgid ""
9454
"For applications that can be configured to use a CA certificate, you should "
9455
"also copy the <filename>/etc/ssl/certs/cacert.pem</filename> file to the "
9456
"<filename role=\"directory\">/etc/ssl/certs/</filename> directory on each "
9457
"server."
9458
msgstr ""
9459
9460
#: serverguide/C/security.xml:1633(para)
9461
msgid ""
9462
"For more detailed instructions on using cryptography see the <ulink "
9463
"url=\"http://tldp.org/HOWTO/SSL-Certificates-HOWTO/index.html\">SSL "
9464
"Certificates HOWTO</ulink> by tldp.org:"
9465
msgstr ""
9466
9467
#: serverguide/C/security.xml:1639(para)
9468
msgid ""
9469
"The Wikipedia <ulink "
9470
"url=\"http://en.wikipedia.org/wiki/HTTPS\">HTTPS</ulink> page has more "
9471
"information regarding HTTPS."
9472
msgstr ""
9473
9474
#: serverguide/C/security.xml:1644(para)
9475
msgid ""
9476
"For more information on <emphasis>OpenSSL</emphasis> see the <ulink "
9477
"url=\"http://www.openssl.org/\">OpenSSL Home Page</ulink>."
9478
msgstr ""
9479
9480
#: serverguide/C/security.xml:1649(para)
9481
msgid ""
9482
"Also, O'Reilly's <ulink "
9483
"url=\"http://oreilly.com/catalog/9780596002701/\">Network Security with "
9484
"OpenSSL</ulink> is a good in-depth reference."
9485
msgstr ""
9486
9487
#: serverguide/C/security.xml:1658(title)
9488
msgid "eCryptfs"
9489
msgstr "eCryptfs"
9490
9491
#: serverguide/C/security.xml:1660(para)
9492
msgid ""
9493
"<emphasis>eCryptfs</emphasis> is a POSIX-compliant enterprise-class stacked "
9494
"cryptographic filesystem for Linux. Layering on top of the filesystem layer "
9495
"<emphasis>eCryptfs</emphasis> protects files no matter the underlying "
9496
"filesystem, partition type, etc."
9497
msgstr ""
9498
9499
#: serverguide/C/security.xml:1666(para)
9500
msgid ""
9501
"During installation there is an option to encrypt the <filename "
9502
"role=\"directory\">/home</filename> partition. This will automatically "
9503
"configure everything needed to encrypt and mount the partition."
9504
msgstr ""
9505
9506
#: serverguide/C/security.xml:1671(para)
9507
msgid ""
9508
"As an example, this section will cover configuring <filename "
9509
"role=\"directory\">/srv</filename> to be encrypted using "
9510
"<emphasis>eCryptfs</emphasis>."
9511
msgstr ""
9512
9513
#: serverguide/C/security.xml:1676(title)
9514
msgid "Using eCryptfs"
9515
msgstr ""
9516
9517
#: serverguide/C/security.xml:1678(para)
9518
msgid "First, install the necessary packages. From a terminal prompt enter:"
9519
msgstr ""
9520
9521
#: serverguide/C/security.xml:1683(command)
9522
msgid "sudo apt install ecryptfs-utils"
9523
msgstr "sudo apt install ecryptfs-utils"
9524
9525
#: serverguide/C/security.xml:1686(para)
9526
msgid "Now mount the partition to be encrypted:"
9527
msgstr ""
9528
9529
#: serverguide/C/security.xml:1691(command)
9530
msgid "sudo mount -t ecryptfs /srv /srv"
9531
msgstr "sudo mount -t ecryptfs /srv /srv"
9532
9533
#: serverguide/C/security.xml:1694(para)
9534
msgid ""
9535
"You will then be prompted for some details on how "
9536
"<application>ecryptfs</application> should encrypt the data."
9537
msgstr ""
9538
9539
#: serverguide/C/security.xml:1698(para)
9540
msgid ""
9541
"To test that files placed in <filename>/srv</filename> are indeed encrypted "
9542
"copy the <filename>/etc/default</filename> folder to "
9543
"<filename>/srv</filename>:"
9544
msgstr ""
9545
9546
#: serverguide/C/security.xml:1704(command) serverguide/C/clustering.xml:190(command)
9547
msgid "sudo cp -r /etc/default /srv"
9548
msgstr "sudo cp -r /etc/default /srv"
9549
9550
#: serverguide/C/security.xml:1707(para)
9551
msgid "Now unmount <filename>/srv</filename>, and try to view a file:"
9552
msgstr ""
9553
9554
#: serverguide/C/security.xml:1712(command) serverguide/C/installation.xml:1131(command) serverguide/C/clustering.xml:198(command)
9555
msgid "sudo umount /srv"
9556
msgstr "sudo umount /srv"
9557
9558
#: serverguide/C/security.xml:1713(command)
9559
msgid "cat /srv/default/cron"
9560
msgstr "cat /srv/default/cron"
9561
9562
#: serverguide/C/security.xml:1716(para)
9563
msgid ""
9564
"Remounting <filename>/srv</filename> using "
9565
"<application>ecryptfs</application> will make the data viewable once again."
9566
msgstr ""
9567
9568
#: serverguide/C/security.xml:1722(title)
9569
msgid "Automatically Mounting Encrypted Partitions"
9570
msgstr ""
9571
9572
#: serverguide/C/security.xml:1724(para)
9573
msgid ""
9574
"There are a couple of ways to automatically mount an "
9575
"<application>ecryptfs</application> encrypted filesystem at boot. This "
9576
"example will use a <filename>/root/.ecryptfsrc</filename> file containing "
9577
"mount options, along with a passphrase file residing on a USB key."
9578
msgstr ""
9579
9580
#: serverguide/C/security.xml:1730(para)
9581
msgid "First, create <filename>/root/.ecryptfsrc</filename> containing:"
9582
msgstr ""
9583
9584
#: serverguide/C/security.xml:1734(programlisting)
9585
#, no-wrap
9586
msgid ""
9587
"\n"
9588
"key=passphrase:passphrase_passwd_file=/mnt/usb/passwd_file.txt\n"
9589
"ecryptfs_sig=5826dd62cf81c615\n"
9590
"ecryptfs_cipher=aes\n"
9591
"ecryptfs_key_bytes=16\n"
9592
"ecryptfs_passthrough=n\n"
9593
"ecryptfs_enable_filename_crypto=n\n"
9594
msgstr ""
9595
9596
#: serverguide/C/security.xml:1744(para)
9597
msgid ""
9598
"Adjust the <emphasis>ecryptfs_sig</emphasis> to the signature in "
9599
"<filename>/root/.ecryptfs/sig-cache.txt</filename>."
9600
msgstr ""
9601
9602
#: serverguide/C/security.xml:1749(para)
9603
msgid ""
9604
"Next, create the <filename>/mnt/usb/passwd_file.txt</filename> passphrase "
9605
"file:"
9606
msgstr ""
9607
9608
#: serverguide/C/security.xml:1753(programlisting)
9609
#, no-wrap
9610
msgid ""
9611
"\n"
9612
"passphrase_passwd=[secrets]\n"
9613
msgstr ""
9614
9615
#: serverguide/C/security.xml:1757(para)
9616
msgid "Now add the necessary lines to <filename>/etc/fstab</filename>:"
9617
msgstr ""
9618
9619
#: serverguide/C/security.xml:1761(programlisting)
9620
#, no-wrap
9621
msgid ""
9622
"\n"
9623
"/dev/sdb1 /mnt/usb ext3 ro 0 0\n"
9624
"/srv /srv ecryptfs defaults 0 0\n"
9625
msgstr ""
9626
9627
#: serverguide/C/security.xml:1766(para)
9628
msgid "Make sure the USB drive is mounted before the encrypted partition."
9629
msgstr ""
9630
9631
#: serverguide/C/security.xml:1770(para)
9632
msgid ""
9633
"Finally, reboot and the <filename>/srv</filename> should be mounted using "
9634
"<emphasis>eCryptfs</emphasis>."
9635
msgstr ""
9636
9637
#: serverguide/C/security.xml:1776(title)
9638
msgid "Other Utilities"
9639
msgstr "Peralatan Lain"
9640
9641
#: serverguide/C/security.xml:1778(para)
9642
msgid ""
9643
"The <application>ecryptfs-utils</application> package includes several other "
9644
"useful utilities:"
9645
msgstr ""
9646
9647
#: serverguide/C/security.xml:1784(para)
9648
msgid ""
9649
"<emphasis>ecryptfs-setup-private:</emphasis> creates a "
9650
"<filename>~/Private</filename> directory to contain encrypted information. "
9651
"This utility can be run by unprivileged users to keep data private from "
9652
"other users on the system."
9653
msgstr ""
9654
9655
#: serverguide/C/security.xml:1791(para)
9656
msgid ""
9657
"<emphasis>ecryptfs-mount-private</emphasis> and <emphasis> ecryptfs-umount-"
9658
"private</emphasis> will mount and unmount a user's "
9659
"<filename>~/Private</filename> directory."
9660
msgstr ""
9661
9662
#: serverguide/C/security.xml:1797(para)
9663
msgid ""
9664
"<emphasis>ecryptfs-add-passphrase:</emphasis> adds a new passphrase to the "
9665
"kernel keyring."
9666
msgstr ""
9667
9668
#: serverguide/C/security.xml:1802(para)
9669
msgid ""
9670
"<emphasis>ecryptfs-manager:</emphasis> manages "
9671
"<application>eCryptfs</application> objects such as keys."
9672
msgstr ""
9673
9674
#: serverguide/C/security.xml:1807(para)
9675
msgid ""
9676
"<emphasis>ecryptfs-stat:</emphasis> allows you to view the "
9677
"<application>ecryptfs</application> meta information for a file."
9678
msgstr ""
9679
9680
#: serverguide/C/security.xml:1820(para)
9681
msgid ""
9682
"For more information on <emphasis>eCryptfs</emphasis> see the <ulink "
9683
"url=\"https://launchpad.net/ecryptfs\">Launchpad project page</ulink>."
9684
msgstr ""
9685
9686
#: serverguide/C/security.xml:1825(para)
9687
msgid ""
9688
"There is also a <ulink "
9689
"url=\"http://www.linuxjournal.com/article/9400\">Linux Journal</ulink> "
9690
"article covering <emphasis>eCryptfs</emphasis>."
9691
msgstr ""
9692
9693
#: serverguide/C/security.xml:1830(para)
9694
msgid ""
9695
"Also, for more <application>ecryptfs</application> options and details see "
9696
"the <ulink "
9697
"url=\"http://manpages.ubuntu.com/manpages/xenial/en/man7/ecryptfs.7.html\">ec"
9698
"ryptfs man page</ulink>."
9699
msgstr ""
9700
9701
#: serverguide/C/samba.xml:11(title)
9702
msgid "Samba"
9703
msgstr "Samba"
9704
9705
#: serverguide/C/samba.xml:13(para)
9706
msgid ""
9707
"Computer networks are often comprised of diverse systems, and while "
9708
"operating a network made up entirely of Ubuntu desktop and server computers "
9709
"would certainly be fun, some network environments must consist of both "
9710
"Ubuntu and <trademark class=\"registered\">Microsoft</trademark><trademark "
9711
"class=\"registered\">Windows</trademark> systems working together in "
9712
"harmony. This section of the <phrase>Ubuntu</phrase> Server Guide introduces "
9713
"principles and tools used in configuring your Ubuntu Server for sharing "
9714
"network resources with Windows computers."
9715
msgstr ""
9716
"Jaringan komputer seringkali terdiri dari sistem yang beragam, mengelola "
9717
"jaringan komputer yang terdiri dari komputer Ubuntu Desktop ataupun Ubuntu "
9718
"Server merupakan hal yang mudah dilakukan, bahkan komputer Ubuntu dapat "
9719
"bekerja bersama dalam satu jaringan dengan komputer bersistem <trademark "
9720
"class=\"registered\">Microsoft</trademark><trademark "
9721
"class=\"registered\">Windows</trademark> secara harmonis. Panduan Server "
9722
"<phrase>Ubuntu</phrase>, khususnya bagian ini akan memperkenalkan prinsip-"
9723
"prinsip dan alat (umumnya adalah aplikasi) yang digunakan untuk "
9724
"mengonfigurasi Server Ubuntu anda agar dapat melakukan pembagian sumber daya "
9725
"jaringan dengan komputer yang menggunakan sistem operasi Windows."
9726
9727
#: serverguide/C/samba.xml:25(para)
9728
msgid ""
9729
"Successfully networking your Ubuntu system with Windows clients involves "
9730
"providing and integrating with services common to Windows environments. Such "
9731
"services assist the sharing of data and information about the computers and "
9732
"users involved in the network, and may be classified under three major "
9733
"categories of functionality:"
9734
msgstr ""
9735
"Suksesnya hubungan jaringan sistem Ubuntu anda dengan klien Windows didukung "
9736
"oleh ketersediaan dan intregritas dengan layanan umum ke lingkungan Windows. "
9737
"Seperti layanan yang melayani pembagian data dan informasi tentang komputer "
9738
"dan pengguna yang terhubung kedalam jaringan, dan dapat diklasifikasikan "
9739
"dibawah tiga kategori utama berdasarkan fungsionalitasnya:"
9740
9741
#: serverguide/C/samba.xml:33(para)
9742
msgid ""
9743
"<emphasis role=\"bold\">File and Printer Sharing Services</emphasis>. Using "
9744
"the Server Message Block (SMB) protocol to facilitate the sharing of files, "
9745
"folders, volumes, and the sharing of printers throughout the network."
9746
msgstr ""
9747
"<emphasis role=\"bold\">Layanan Pembagian Berkas dan Pencetak</emphasis>. "
9748
"Menggunakan protocol Blok Pesan Server (SMB) sebagai fasilitas untuk berbagi "
9749
"berkas, folder, volume, dan berbagi pencetak keseluruh jaringan."
9750
9751
#: serverguide/C/samba.xml:39(para)
9752
msgid ""
9753
"<emphasis role=\"bold\">Directory Services</emphasis>. Sharing vital "
9754
"information about the computers and users of the network with such "
9755
"technologies as the Lightweight Directory Access Protocol (LDAP) and "
9756
"Microsoft <trademark class=\"registered\">Active Directory</trademark>."
9757
msgstr ""
9758
"<emphasis role=\"bold\">Layanan Direktori</emphasis>. Berbagi informasi "
9759
"penting tentang komputer dan pengguna jaringan dengan menggunakan teknologi "
9760
"seperti Protokol Akses Direktori Ringan (LDAP) dan Microsoft <trademark "
9761
"class=\"registered\">Active Directory</trademark>."
9762
9763
#: serverguide/C/samba.xml:46(para)
9764
msgid ""
9765
"<emphasis role=\"bold\">Authentication and Access</emphasis>. Establishing "
9766
"the identity of a computer or user of the network and determining the "
9767
"information the computer or user is authorized to access using such "
9768
"principles and technologies as file permissions, group policies, and the "
9769
"Kerberos authentication service."
9770
msgstr ""
9771
"<emphasis role=\"bold\">Pembuktian Keaslian dan Akses</emphasis>. Menetapkan "
9772
"Identitas dari sebuah komputer atau seorang pengguna dari sebuah jaringan "
9773
"dan memutuskan bahwa komputer atau pengguna tersebut disahkan untuk "
9774
"mengakses menggunakan asas-asas dan teknologi seperti izin file (permission "
9775
"file), kebijakan kelompok (group policies), dan layanan pembuktian keaslian "
9776
"Kerberos (the Kerberos authentication service)."
9777
9778
#: serverguide/C/samba.xml:54(para)
9779
msgid ""
9780
"Fortunately, your Ubuntu system may provide all such facilities to Windows "
9781
"clients and share network resources among them. One of the principal pieces "
9782
"of software your Ubuntu system includes for Windows networking is the Samba "
9783
"suite of SMB server applications and tools."
9784
msgstr ""
9785
"Untungnya, sistem Ubuntu anda memungkinkan semuanya tersedia seperti "
9786
"fasilitas untuk klien Windows dan berbagi sumber jaringan antara mereka. "
9787
"Satu dari beberapa bagian prinsip dari perangkat lunak yang dimuat oleh "
9788
"sistem Ubuntu anda untuk jaringan Windows adalah paket Samba dari aplikasi "
9789
"dan perlengkapan SMB server."
9790
9791
#: serverguide/C/samba.xml:60(para)
9792
msgid ""
9793
"This section of the <phrase>Ubuntu</phrase> Server Guide will introduce some "
9794
"of the common Samba use cases, and how to install and configure the "
9795
"necessary packages. Additional detailed documentation and information on "
9796
"Samba can be found on the <ulink url=\"http://www.samba.org\">Samba "
9797
"website</ulink>."
9798
msgstr ""
9799
"Pada bagian ini dari Panduan <phrase>Ubuntu</phrase> Server akan "
9800
"diperkenalkan contoh penerapan Samba yang sering dipergunakan, dan bagaimana "
9801
"cara menginstal dan mengkonfigurasi paket-paket yang diperlukan. Tambahan "
9802
"informasi dan detil dokumentasi pada Samba dapat ditemukan pada <ulink "
9803
"url=\"http://www.samba.org\">Samba website</ulink>."
9804
9805
#: serverguide/C/samba.xml:68(title)
9806
msgid "File Server"
9807
msgstr ""
9808
9809
#: serverguide/C/samba.xml:70(para)
9810
msgid ""
9811
"One of the most common ways to network Ubuntu and Windows computers is to "
9812
"configure Samba as a File Server. This section covers setting up a "
9813
"<application>Samba</application> server to share files with Windows clients."
9814
msgstr ""
9815
"Salah satu cara yang paling umum untuk menghubungkan komputer antara Ubuntu "
9816
"dan Windows adalah mengkonfigurasi Samba sebagai File Server. Bagian ini "
9817
"meliputi tentang cara menyiapkan server <application>Samba</application> "
9818
"untuk berbagi file dengan klien Windows."
9819
9820
#: serverguide/C/samba.xml:75(para)
9821
msgid ""
9822
"The server will be configured to share files with any client on the network "
9823
"without prompting for a password. If your environment requires stricter "
9824
"Access Controls see <xref linkend=\"samba-fileprint-security\"/>."
9825
msgstr ""
9826
9827
#: serverguide/C/samba.xml:83(para)
9828
msgid ""
9829
"The first step is to install the <application>samba</application> package. "
9830
"From a terminal prompt enter:"
9831
msgstr ""
9832
"Tahap pertama dari pemasangan paket <application>samba</application>. Dari "
9833
"terminal ketikkan:"
9834
9835
#: serverguide/C/samba.xml:88(command) serverguide/C/samba.xml:303(command)
9836
msgid "sudo apt install samba"
9837
msgstr "sudo apt install samba"
9838
9839
#: serverguide/C/samba.xml:91(para)
9840
msgid ""
9841
"That's all there is to it; you are now ready to configure Samba to share "
9842
"files."
9843
msgstr ""
9844
"Itu saja yang diperlukan, Anda sekarang siap untuk mengkonfigurasikan Samba "
9845
"untuk berbagi file."
9846
9847
#: serverguide/C/samba.xml:99(para)
9848
msgid ""
9849
"The main Samba configuration file is located in "
9850
"<filename>/etc/samba/smb.conf</filename>. The default configuration file has "
9851
"a significant number of comments in order to document various configuration "
9852
"directives."
9853
msgstr ""
9854
9855
#: serverguide/C/samba.xml:104(para)
9856
msgid ""
9857
"Not all the available options are included in the default configuration "
9858
"file. See the <filename>smb.conf</filename><application>man</application> "
9859
"page or the <ulink url=\"http://samba.org/samba/docs/man/Samba-HOWTO-"
9860
"Collection/\">Samba HOWTO Collection</ulink> for more details."
9861
msgstr ""
9862
"Tidak semua pilihan yang disertakan tersedia pada file konfigurasi default. "
9863
"Lihat halaman <filename>smb.conf</filename><application>man</application> "
9864
"atau <ulink url=\"http://samba.org/samba/docs/man/Samba-HOWTO-"
9865
"Collection/\">Samba HOWTO Collection</ulink> untuk lebih jelasnya."
9866
9867
#: serverguide/C/samba.xml:113(para)
9868
msgid ""
9869
"First, edit the following key/value pairs in the "
9870
"<emphasis>[global]</emphasis> section of "
9871
"<filename>/etc/samba/smb.conf</filename>:"
9872
msgstr ""
9873
9874
#: serverguide/C/samba.xml:118(programlisting) serverguide/C/samba.xml:315(programlisting) serverguide/C/samba.xml:780(programlisting) serverguide/C/samba.xml:1018(programlisting)
9875
#, no-wrap
9876
msgid ""
9877
"\n"
9878
" workgroup = EXAMPLE\n"
9879
" ...\n"
9880
" security = user\n"
9881
msgstr ""
9882
"\n"
9883
" workgroup = EXAMPLE\n"
9884
" ...\n"
9885
" security = user\n"
9886
9887
#: serverguide/C/samba.xml:124(para)
9888
msgid ""
9889
"The <emphasis>security</emphasis> parameter is farther down in the [global] "
9890
"section, and is commented by default. Also, change "
9891
"<emphasis>EXAMPLE</emphasis> to better match your environment."
9892
msgstr ""
9893
9894
#: serverguide/C/samba.xml:132(para)
9895
msgid ""
9896
"Create a new section at the bottom of the file, or uncomment one of the "
9897
"examples, for the directory to be shared:"
9898
msgstr ""
9899
"Membuat bagian baru di bagian bawah file, atau hilangkan tanda komentar "
9900
"salah satu contoh, untuk direktori yang akan dibagi:"
9901
9902
#: serverguide/C/samba.xml:136(programlisting)
9903
#, no-wrap
9904
msgid ""
9905
"\n"
9906
"[share]\n"
9907
" comment = Ubuntu File Server Share\n"
9908
" path = /srv/samba/share\n"
9909
" browsable = yes\n"
9910
" guest ok = yes\n"
9911
" read only = no\n"
9912
" create mask = 0755\n"
9913
msgstr ""
9914
"\n"
9915
"[share]\n"
9916
" comment = Ubuntu File Server Share\n"
9917
" path = /srv/samba/share\n"
9918
" browsable = yes\n"
9919
" guest ok = yes\n"
9920
" read only = no\n"
9921
" create mask = 0755\n"
9922
9923
#: serverguide/C/samba.xml:148(para)
9924
msgid ""
9925
"<emphasis>comment:</emphasis> a short description of the share. Adjust to "
9926
"fit your needs."
9927
msgstr ""
9928
"<emphasis>comment:</emphasis> sebuah deskripsi singkat. Sesuaikan dengan "
9929
"kebutuhan."
9930
9931
#: serverguide/C/samba.xml:153(para)
9932
msgid "<emphasis>path:</emphasis> the path to the directory to share."
9933
msgstr "<emphasis>path:</emphasis> Lokasi dari direktori yang akan dibagikan"
9934
9935
#: serverguide/C/samba.xml:156(para)
9936
msgid ""
9937
"This example uses <filename>/srv/samba/sharename</filename> because, "
9938
"according to the <emphasis>Filesystem Hierarchy Standard (FHS)</emphasis>, "
9939
"<ulink url=\"http://www.pathname.com/fhs/pub/fhs-"
9940
"2.3.html#SRVDATAFORSERVICESPROVIDEDBYSYSTEM\">/srv</ulink> is where site-"
9941
"specific data should be served. Technically Samba shares can be placed "
9942
"anywhere on the filesystem as long as the permissions are correct, but "
9943
"adhering to standards is recommended."
9944
msgstr ""
9945
9946
#: serverguide/C/samba.xml:165(para)
9947
msgid ""
9948
"<emphasis>browsable:</emphasis> enables Windows clients to browse the shared "
9949
"directory using <application>Windows Explorer</application>."
9950
msgstr ""
9951
"<emphasis>browsable:</emphasis> mengaktifkan klien windows untuk menjelajah "
9952
"direktori bagi menggunakan <application>Windows Explorer</application>."
9953
9954
#: serverguide/C/samba.xml:171(para)
9955
msgid ""
9956
"<emphasis>guest ok:</emphasis> allows clients to connect to the share "
9957
"without supplying a password."
9958
msgstr ""
9959
"<emphasis>guest ok:</emphasis> mengijinkan klien untuk terhubung dengan "
9960
"share tanpa kata sandi"
9961
9962
#: serverguide/C/samba.xml:176(para)
9963
msgid ""
9964
"<emphasis>read only:</emphasis> determines if the share is read only or if "
9965
"write privileges are granted. Write privileges are allowed only when the "
9966
"value is <emphasis>no</emphasis>, as is seen in this example. If the value "
9967
"is <emphasis>yes</emphasis>, then access to the share is read only."
9968
msgstr ""
9969
"<emphasis>hanya-baca:</emphasis> menentukan apakah berkas yang dibagikan "
9970
"memiliki hak baca saja atau hak menulis juga diberikan. Hak Menulis "
9971
"diperbolehkan hanya jika nilai tersebut <emphasis>no</ emphasis>, seperti "
9972
"yang terlihat dalam contoh ini. Jika nilai <emphasis>yas</ emphasis>, maka "
9973
"akses ke berkas tersebut hanya baca saja."
9974
9975
#: serverguide/C/samba.xml:181(para)
9976
msgid ""
9977
"<emphasis>create mask:</emphasis> determines the permissions new files will "
9978
"have when created."
9979
msgstr ""
9980
"<emphasis>create mask:</emphasis> menetapkan perijinan dari berkas baru "
9981
"ketika dibuat"
9982
9983
#: serverguide/C/samba.xml:190(para)
9984
msgid ""
9985
"Now that <application>Samba</application> is configured, the directory needs "
9986
"to be created and the permissions changed. From a terminal enter:"
9987
msgstr ""
9988
"Sekarang <application>Samba</application> telah di atur, direktori harus "
9989
"dibuat dan perijinan diubah. Dari terminal ketikkan:"
9990
9991
#: serverguide/C/samba.xml:196(command)
9992
msgid "sudo mkdir -p /srv/samba/share"
9993
msgstr "sudo mkdir -p /srv/samba/share"
9994
9995
#: serverguide/C/samba.xml:197(command)
9996
msgid "sudo chown nobody:nogroup /srv/samba/share/"
9997
msgstr "sudo chown nobody:nogroup /srv/samba/share/"
9998
9999
#: serverguide/C/samba.xml:201(para)
10000
msgid ""
10001
"The <emphasis>-p</emphasis> switch tells mkdir to create the entire "
10002
"directory tree if it doesn't exist."
10003
msgstr ""
10004
"<emphasis>-p</emphasis> memberitahu mkdir untuk membuat direktori model "
10005
"pohon semuanya jika tidak ada."
10006
10007
#: serverguide/C/samba.xml:209(para)
10008
msgid ""
10009
"Finally, restart the <application>samba</application> services to enable the "
10010
"new configuration:"
10011
msgstr ""
10012
"Terakhir, restart layanan <application>samba</application> untuk "
10013
"mengaktifkan pengaturan baru:"
10014
10015
#: serverguide/C/samba.xml:214(command) serverguide/C/samba.xml:335(command) serverguide/C/samba.xml:472(command) serverguide/C/samba.xml:571(command) serverguide/C/samba.xml:921(command) serverguide/C/samba.xml:1075(command) serverguide/C/samba.xml:1181(command) serverguide/C/network-auth.xml:2488(screen) serverguide/C/network-auth.xml:4090(command)
10016
msgid "sudo systemctl restart smbd.service nmbd.service"
10017
msgstr "sudo systemctl restart smbd.service nmbd.service"
10018
10019
#: serverguide/C/samba.xml:221(para)
10020
msgid ""
10021
"Once again, the above configuration gives all access to any client on the "
10022
"local network. For a more secure configuration see <xref linkend=\"samba-"
10023
"fileprint-security\"/>."
10024
msgstr ""
10025
"Sekali lagi, pengaturan diatas mengijinkan semua akses ke semua klien di "
10026
"jaringan lokal. Untuk pengaturan yang lebih aman lihat <xref linkend=\"samba-"
10027
"fileprint-security\"/>."
10028
10029
#: serverguide/C/samba.xml:227(para)
10030
msgid ""
10031
"From a Windows client you should now be able to browse to the Ubuntu file "
10032
"server and see the shared directory. If your client doesn't show your share "
10033
"automatically, try to access your server by its IP address, e.g. \\\\"
10034
"192.168.1.1, in a Windows Explorer window. To check that everything is "
10035
"working try creating a directory from Windows."
10036
msgstr ""
10037
"Dari klien Windows, anda seharusnya dapat menelusuri file server Ubuntu dan "
10038
"melihat direktori-bersama. Jika dari klien Windows tidak menunjukkan "
10039
"direktori-bersama secara otomatis, cobalah untuk mengakses server "
10040
"berdasarkan alamat IP-nya (misal 192.168.1.1) pada jendela Windows Explorer. "
10041
"Untuk memeriksa bahwa semuanya berjalan coba buat direktori dari Windows."
10042
10043
#: serverguide/C/samba.xml:231(para)
10044
msgid ""
10045
"To create additional shares simply create new <emphasis>[dir]</emphasis> "
10046
"sections in <filename>/etc/samba/smb.conf</filename>, and restart "
10047
"<emphasis>Samba</emphasis>. Just make sure that the directory you want to "
10048
"share actually exists and the permissions are correct."
10049
msgstr ""
10050
10051
#: serverguide/C/samba.xml:238(para)
10052
msgid ""
10053
"The file share named <emphasis>\"[share]\"</emphasis> and the path "
10054
"<filename>/srv/samba/share</filename> are just examples. Adjust the share "
10055
"and path names to fit your environment. It is a good idea to name a share "
10056
"after a directory on the file system. Another example would be a share name "
10057
"of <emphasis>[qa]</emphasis> with a path of "
10058
"<filename>/srv/samba/qa</filename>."
10059
msgstr ""
10060
10061
#: serverguide/C/samba.xml:251(para) serverguide/C/samba.xml:349(para) serverguide/C/samba.xml:704(para) serverguide/C/samba.xml:1098(para)
10062
msgid ""
10063
"For in depth Samba configurations see the <ulink "
10064
"url=\"http://samba.org/samba/docs/man/Samba-HOWTO-Collection/\">Samba HOWTO "
10065
"Collection</ulink>"
10066
msgstr ""
10067
"Untuk pengaturan samba lanjutan lihat <ulink "
10068
"url=\"http://samba.org/samba/docs/man/Samba-HOWTO-Collection/\">Samba HOWTO "
10069
"Collection</ulink>"
10070
10071
#: serverguide/C/samba.xml:257(para) serverguide/C/samba.xml:355(para) serverguide/C/samba.xml:710(para) serverguide/C/samba.xml:1104(para)
10072
msgid ""
10073
"The guide is also available in <ulink "
10074
"url=\"http://www.amazon.com/exec/obidos/tg/detail/-/0131882228\">printed "
10075
"format</ulink>."
10076
msgstr ""
10077
"Panduan ini juga tersedia di <ulink "
10078
"url=\"http://www.amazon.com/exec/obidos/tg/detail/-/0131882228\">printed "
10079
"format</ulink>."
10080
10081
#: serverguide/C/samba.xml:263(para) serverguide/C/samba.xml:361(para)
10082
msgid ""
10083
"O'Reilly's <ulink "
10084
"url=\"http://www.oreilly.com/catalog/9780596007690/\">Using Samba</ulink> is "
10085
"another good reference."
10086
msgstr ""
10087
"O'Reilly's <ulink "
10088
"url=\"http://www.oreilly.com/catalog/9780596007690/\">Using Samba</ulink> "
10089
"adalah panduan lain yang baik"
10090
10091
#: serverguide/C/samba.xml:269(para) serverguide/C/samba.xml:372(para) serverguide/C/samba.xml:735(para) serverguide/C/samba.xml:1128(para) serverguide/C/samba.xml:1305(para)
10092
msgid ""
10093
"The <ulink url=\"https://help.ubuntu.com/community/Samba\">Ubuntu Wiki Samba "
10094
"</ulink> page."
10095
msgstr ""
10096
"Halaman <ulink url=\"https://help.ubuntu.com/community/Samba\">Ubuntu Wiki "
10097
"Samba </ulink>"
10098
10099
#: serverguide/C/samba.xml:278(title) serverguide/C/network-config.xml:904(para)
10100
msgid "Print Server"
10101
msgstr "Print Server"
10102
10103
#: serverguide/C/samba.xml:280(para)
10104
msgid ""
10105
"Another common use of Samba is to configure it to share printers installed, "
10106
"either locally or over the network, on an Ubuntu server. Similar to <xref "
10107
"linkend=\"samba-fileserver\"/> this section will configure Samba to allow "
10108
"any client on the local network to use the installed printers without "
10109
"prompting for a username and password."
10110
msgstr ""
10111
"Penggunaan umum lainnya dari Samba adalah untuk mengkonfigurasinya printer "
10112
"yang telah diinstal untuk dipakai bersama, baik secara lokal atau melalui "
10113
"jaringan, pada server Ubuntu. Mirip dengan <xref linkend=\"samba-"
10114
"fileserver\"/> bagian ini akan mengkonfigurasi Samba dengan mengizinkan "
10115
"semua klien di jaringan lokal untuk menggunakan printer secara bersama yang "
10116
"telah terpasang tanpa meminta username dan password lagi."
10117
10118
#: serverguide/C/samba.xml:286(para)
10119
msgid ""
10120
"For a more secure configuration see <xref linkend=\"samba-fileprint-"
10121
"security\"/>."
10122
msgstr ""
10123
"Untuk pengaturan lebih aman lihat <xref linkend=\"samba-fileprint-"
10124
"security\"/>."
10125
10126
#: serverguide/C/samba.xml:293(para)
10127
msgid ""
10128
"Before installing and configuring Samba it is best to already have a working "
10129
"<application>CUPS</application> installation. See <xref linkend=\"cups\"/> "
10130
"for details."
10131
msgstr ""
10132
"Sebelum pemasangan dan pengaturan lebih baik telah bekerja di aplikasi "
10133
"<application>CUPS</application>. Lihat <xref linkend=\"cups\"/> untuk lebih "
10134
"detil."
10135
10136
#: serverguide/C/samba.xml:298(para)
10137
msgid ""
10138
"To install the <application>samba</application> package, from a terminal "
10139
"enter:"
10140
msgstr "Untuk memasang paket samba, dari terminal masukan:"
10141
10142
#: serverguide/C/samba.xml:309(para)
10143
msgid ""
10144
"After installing samba edit <filename>/etc/samba/smb.conf</filename>. Change "
10145
"the <emphasis>workgroup</emphasis> attribute to what is appropriate for your "
10146
"network, and change <emphasis>security</emphasis> to <emphasis "
10147
"role=\"italic\">user</emphasis>:"
10148
msgstr ""
10149
10150
#: serverguide/C/samba.xml:321(para)
10151
msgid ""
10152
"In the <emphasis>[printers]</emphasis> section change the <emphasis>guest "
10153
"ok</emphasis> option to <emphasis role=\"italic\">yes</emphasis>:"
10154
msgstr ""
10155
10156
#: serverguide/C/samba.xml:325(programlisting)
10157
#, no-wrap
10158
msgid ""
10159
"\n"
10160
" browsable = yes\n"
10161
" guest ok = yes\n"
10162
msgstr ""
10163
"\n"
10164
" browsable = yes\n"
10165
" guest ok = yes\n"
10166
10167
#: serverguide/C/samba.xml:330(para)
10168
msgid "After editing <filename>smb.conf</filename> restart Samba:"
10169
msgstr "Setelah menyunting <filename>smb.conf</filename> restart Samba:"
10170
10171
#: serverguide/C/samba.xml:338(para)
10172
msgid ""
10173
"The default Samba configuration will automatically share any printers "
10174
"installed. Simply install the printer locally on your Windows clients."
10175
msgstr ""
10176
"Konfigurasi default Samba secara otomatis akan berbagi-pakai semua printer "
10177
"yang dipasang. Anda cukup menginstal printer secara lokal pada klien "
10178
"Windows."
10179
10180
#: serverguide/C/samba.xml:367(para)
10181
msgid ""
10182
"Also, see the <ulink url=\"http://www.cups.org/\">CUPS Website</ulink> for "
10183
"more information on configuring CUPS."
10184
msgstr ""
10185
"Lihat juga <ulink url=\"http://www.cups.org/\">Situs CUPS</ulink>untuk "
10186
"informasi lebih lanjut dalam pengaturan CUPS."
10187
10188
#: serverguide/C/samba.xml:381(title)
10189
msgid "Securing File and Print Server"
10190
msgstr ""
10191
10192
#: serverguide/C/samba.xml:384(title)
10193
msgid "Samba Security Modes"
10194
msgstr "Mode Keamanan Samba"
10195
10196
#: serverguide/C/samba.xml:386(para)
10197
msgid ""
10198
"There are two security levels available to the Common Internet Filesystem "
10199
"(CIFS) network protocol <emphasis>user-level</emphasis> and <emphasis>share-"
10200
"level</emphasis>. Samba's <emphasis>security mode</emphasis> implementation "
10201
"allows more flexibility, providing four ways of implementing user-level "
10202
"security and one way to implement share-level:"
10203
msgstr ""
10204
10205
#: serverguide/C/samba.xml:395(para)
10206
msgid ""
10207
"<emphasis>security = user:</emphasis> requires clients to supply a username "
10208
"and password to connect to shares. Samba user accounts are separate from "
10209
"system accounts, but the <application>libpam-winbind</application> package "
10210
"will sync system users and passwords with the Samba user database."
10211
msgstr ""
10212
10213
#: serverguide/C/samba.xml:402(para)
10214
msgid ""
10215
"<emphasis>security = domain:</emphasis> this mode allows the Samba server to "
10216
"appear to Windows clients as a Primary Domain Controller (PDC), Backup "
10217
"Domain Controller (BDC), or a Domain Member Server (DMS). See <xref "
10218
"linkend=\"samba-dc\"/> for further information."
10219
msgstr ""
10220
10221
#: serverguide/C/samba.xml:409(para)
10222
msgid ""
10223
"<emphasis>security = ADS:</emphasis> allows the Samba server to join an "
10224
"Active Directory domain as a native member. See <xref linkend=\"samba-ad-"
10225
"integration\"/> for details."
10226
msgstr ""
10227
10228
#: serverguide/C/samba.xml:415(para)
10229
msgid ""
10230
"<emphasis>security = server:</emphasis> this mode is left over from before "
10231
"Samba could become a member server, and due to some security issues should "
10232
"not be used. See the <ulink url=\"http://samba.org/samba/docs/man/Samba-"
10233
"HOWTO-Collection/ServerType.html#id349531\">Server Security</ulink> section "
10234
"of the Samba guide for more details."
10235
msgstr ""
10236
10237
#: serverguide/C/samba.xml:423(para)
10238
msgid ""
10239
"<emphasis>security = share:</emphasis> allows clients to connect to shares "
10240
"without supplying a username and password."
10241
msgstr ""
10242
10243
#: serverguide/C/samba.xml:430(para)
10244
msgid ""
10245
"The security mode you choose will depend on your environment and what you "
10246
"need the Samba server to accomplish."
10247
msgstr ""
10248
"Modus keamanan yang anda pilih akan tergantung pada lingkungan dan "
10249
"konfgurasi anda pada server Samba."
10250
10251
#: serverguide/C/samba.xml:436(title)
10252
msgid "Security = User"
10253
msgstr "Security = User"
10254
10255
#: serverguide/C/samba.xml:438(para)
10256
msgid ""
10257
"This section will reconfigure the Samba file and print server, from <xref "
10258
"linkend=\"samba-fileserver\"/> and <xref linkend=\"samba-printserver\"/>, to "
10259
"require authentication."
10260
msgstr ""
10261
"Bagian ini akan mengkonfigurasi ulang file Samba dan print server, dari "
10262
"<xref linkend=\"samba-fileserver\"/> dan <xref linkend=\"samba-"
10263
"printserver\"/>, membutuhkan otentikasi."
10264
10265
#: serverguide/C/samba.xml:443(para)
10266
msgid ""
10267
"First, install the <application>libpam-winbind</application> package which "
10268
"will sync the system users to the Samba user database:"
10269
msgstr ""
10270
10271
#: serverguide/C/samba.xml:449(command)
10272
msgid "sudo apt install libpam-winbind"
10273
msgstr "sudo apt install libpam-winbind"
10274
10275
#: serverguide/C/samba.xml:453(para)
10276
msgid ""
10277
"If you chose the <emphasis>Samba Server</emphasis> task during installation "
10278
"<application>libpam-winbind</application> is already installed."
10279
msgstr ""
10280
10281
#: serverguide/C/samba.xml:459(para)
10282
msgid ""
10283
"Edit <filename>/etc/samba/smb.conf</filename>, and in the "
10284
"<emphasis>[share]</emphasis> section change:"
10285
msgstr ""
10286
10287
#: serverguide/C/samba.xml:463(programlisting)
10288
#, no-wrap
10289
msgid ""
10290
"\n"
10291
" guest ok = no\n"
10292
msgstr ""
10293
"\n"
10294
" guest ok = no\n"
10295
10296
#: serverguide/C/samba.xml:467(para)
10297
msgid "Finally, restart Samba for the new settings to take effect:"
10298
msgstr ""
10299
"Terakhir, restart Samba untuk melihan perubahan pada pengaturan yang baru."
10300
10301
#: serverguide/C/samba.xml:475(para)
10302
msgid ""
10303
"Now when connecting to the shared directories or printers you should be "
10304
"prompted for a username and password."
10305
msgstr ""
10306
"Sekarang saat menghubungkan ke direktori-bersama atau printer, anda akan "
10307
"ditanyai username dan password."
10308
10309
#: serverguide/C/samba.xml:480(para)
10310
msgid ""
10311
"If you choose to map a network drive to the share you can check the "
10312
"<quote>Reconnect at Logon</quote> check box, which will require you to only "
10313
"enter the username and password once, at least until the password changes."
10314
msgstr ""
10315
"Jika anda memilih untuk memetakan drive jaringan untuk berbagi anda dapat "
10316
"memilih kotak centang <quote>Reconnect at Logon</quote>, ini akan meminta "
10317
"anda untuk hanya memasukkan username dan password sekali saja, sampai ada "
10318
"perubahan password yang baru."
10319
10320
#: serverguide/C/samba.xml:488(title)
10321
msgid "Share Security"
10322
msgstr "Keamanan Berbagi"
10323
10324
#: serverguide/C/samba.xml:490(para)
10325
msgid ""
10326
"There are several options available to increase the security for each "
10327
"individual shared directory. Using the <emphasis>[share]</emphasis> example, "
10328
"this section will cover some common options."
10329
msgstr ""
10330
"Ada beberapa pilihan yang tersedia untuk meningkatkan keamanan pada setiap "
10331
"direktori bersama. Menggunakan contoh <emphasis>[share]</emphasis>, bagian "
10332
"ini akan membahas beberapa pilihan umum."
10333
10334
#: serverguide/C/samba.xml:496(title)
10335
msgid "Groups"
10336
msgstr "Grup"
10337
10338
#: serverguide/C/samba.xml:498(para)
10339
msgid ""
10340
"Groups define a collection of computers or users which have a common level "
10341
"of access to particular network resources and offer a level of granularity "
10342
"in controlling access to such resources. For example, if a group <emphasis "
10343
"role=\"italic\">qa</emphasis> is defined and contains the users <emphasis "
10344
"role=\"italic\">freda</emphasis>, <emphasis "
10345
"role=\"italic\">danika</emphasis>, and <emphasis "
10346
"role=\"italic\">rob</emphasis> and a second group <emphasis "
10347
"role=\"italic\">support</emphasis> is defined and consists of users "
10348
"<emphasis role=\"italic\">danika</emphasis>, <emphasis "
10349
"role=\"italic\">jeremy</emphasis>, and <emphasis "
10350
"role=\"italic\">vincent</emphasis> then certain network resources configured "
10351
"to allow access by the <emphasis role=\"italic\">qa</emphasis> group will "
10352
"subsequently enable access by freda, danika, and rob, but not jeremy or "
10353
"vincent. Since the user <emphasis role=\"italic\">danika</emphasis> belongs "
10354
"to both the <emphasis role=\"italic\">qa</emphasis> and <emphasis "
10355
"role=\"italic\">support</emphasis> groups, she will be able to access "
10356
"resources configured for access by both groups, whereas all other users will "
10357
"have only access to resources explicitly allowing the group they are part of."
10358
msgstr ""
10359
"Grup diartikan sebagai suatu kumpulan komputer atau pengguna yang memiliki "
10360
"tingkat akses yang sama ke suatu sumberdaya jaringan dan tingkat "
10361
"granularitas dalam mengatur akses ke sumberdaya tersebut. Sebagai contoh, "
10362
"jika sebuah grup <emphasis role=\"italic\">qa</emphasis> diartikan dan "
10363
"terdapat pengguna <emphasis role=\"italic\">freda</emphasis>, <emphasis "
10364
"role=\"italic\">danika</emphasis>, dan <emphasis "
10365
"role=\"italic\">rob</emphasis> serta grup kedua <emphasis "
10366
"role=\"italic\">support</emphasis> diartikan dan terdiri dari pengguna "
10367
"<emphasis role=\"italic\">danika</emphasis>, <emphasis "
10368
"role=\"italic\">jeremy</emphasis>, dan <emphasis "
10369
"role=\"italic\">vincent</emphasis> maka sumberdaya jaringan tertentu "
10370
"dikonfigurasi untuk mengizinkan akses oleh grup <emphasis "
10371
"role=\"italic\">qa</emphasis> akan mengizinkan akses oleh freda, danika, dan "
10372
"rob, tapi bukan kepada jeremy atau vincent. Karena pengguna <emphasis "
10373
"role=\"italic\">danika</emphasis> ada di dalam grup <emphasis "
10374
"role=\"italic\">qa</emphasis> dan <emphasis "
10375
"role=\"italic\">support</emphasis>, dia akan mampu mengakses sumberdaya yang "
10376
"dikonfigurasi untuk kedua grup, dimana pengguna yang lain hanya akan "
10377
"memiliki akses ke sumberdaya yang secara eksplisit mengizinkan grup dimana "
10378
"mereka menjadi bagian."
10379
10380
#: serverguide/C/samba.xml:512(para)
10381
msgid ""
10382
"By default Samba looks for the local system groups defined in "
10383
"<filename>/etc/group</filename> to determine which users belong to which "
10384
"groups. For more information on adding and removing users from groups see "
10385
"<xref linkend=\"adding-deleting-users\"/>."
10386
msgstr ""
10387
"Secara default Samba akan mencari grup sistem lokal yang terdefinisikan "
10388
"dalam <filename>/etc/group</filename> untuk menentukan pengguna termasuk "
10389
"grup yang mana. Untuk informasi lebih lanjut tentang cara menambahkan dan "
10390
"menghapus pengguna dari kelompok lihat <xref linkend=\"adding-deleting-"
10391
"users\"/>."
10392
10393
#: serverguide/C/samba.xml:518(para)
10394
msgid ""
10395
"When defining groups in the Samba configuration file, "
10396
"<filename>/etc/samba/smb.conf</filename>, the recognized syntax is to "
10397
"preface the group name with an \"@\" symbol. For example, if you wished to "
10398
"define a group named <emphasis role=\"italic\">sysadmin</emphasis> in a "
10399
"certain section of the <filename>/etc/samba/smb.conf</filename>, you would "
10400
"do so by entering the group name as <emphasis "
10401
"role=\"bold\">@sysadmin</emphasis>."
10402
msgstr ""
10403
10404
#: serverguide/C/samba.xml:527(title)
10405
msgid "File Permissions"
10406
msgstr "Pengijinan Data"
10407
10408
#: serverguide/C/samba.xml:529(para)
10409
msgid ""
10410
"File Permissions define the explicit rights a computer or user has to a "
10411
"particular directory, file, or set of files. Such permissions may be defined "
10412
"by editing the <filename>/etc/samba/smb.conf</filename> file and specifying "
10413
"the explicit permissions of a defined file share."
10414
msgstr ""
10415
"Perizinan file yang menentukan hak secara eksplisit antara komputer atau "
10416
"pengguna pada direktori, file, atau set file tertentu. Izin tersebut dapat "
10417
"didefinisikan dengan mengedit file <filename>/etc/samba/smb.conf</filename> "
10418
"dan menentukan izin eksplisit dari berbagi-file tersebut."
10419
10420
#: serverguide/C/samba.xml:535(para)
10421
msgid ""
10422
"For example, if you have defined a Samba share called "
10423
"<emphasis>share</emphasis> and wish to give <emphasis role=\"italic\">read-"
10424
"only</emphasis> permissions to the group of users known as <emphasis "
10425
"role=\"italic\">qa</emphasis>, but wanted to allow writing to the share by "
10426
"the group called <emphasis role=\"italic\">sysadmin</emphasis> and the user "
10427
"named <emphasis role=\"italic\">vincent</emphasis>, then you could edit the "
10428
"<filename>/etc/samba/smb.conf</filename> file, and add the following entries "
10429
"under the <emphasis>[share]</emphasis> entry:"
10430
msgstr ""
10431
10432
#: serverguide/C/samba.xml:544(programlisting)
10433
#, no-wrap
10434
msgid ""
10435
"\n"
10436
" read list = @qa\n"
10437
" write list = @sysadmin, vincent\n"
10438
msgstr ""
10439
"\n"
10440
" read list = @qa\n"
10441
" write list = @sysadmin, vincent\n"
10442
10443
#: serverguide/C/samba.xml:549(para)
10444
msgid ""
10445
"Another possible Samba permission is to declare "
10446
"<emphasis>administrative</emphasis> permissions to a particular shared "
10447
"resource. Users having administrative permissions may read, write, or modify "
10448
"any information contained in the resource the user has been given explicit "
10449
"administrative permissions to."
10450
msgstr ""
10451
10452
#: serverguide/C/samba.xml:555(para)
10453
msgid ""
10454
"For example, if you wanted to give the user <emphasis "
10455
"role=\"italic\">melissa</emphasis> administrative permissions to the "
10456
"<emphasis role=\"italic\">share</emphasis> example, you would edit the "
10457
"<filename>/etc/samba/smb.conf</filename> file, and add the following line "
10458
"under the <emphasis>[share]</emphasis> entry:"
10459
msgstr ""
10460
10461
#: serverguide/C/samba.xml:562(programlisting)
10462
#, no-wrap
10463
msgid ""
10464
"\n"
10465
" admin users = melissa\n"
10466
msgstr ""
10467
"\n"
10468
" admin users = melissa\n"
10469
10470
#: serverguide/C/samba.xml:566(para)
10471
msgid ""
10472
"After editing <filename>/etc/samba/smb.conf</filename>, restart Samba for "
10473
"the changes to take effect:"
10474
msgstr ""
10475
"Setelah mengedit <filename>/etc/samba/smb.conf</filename>, restart Samba "
10476
"untuk melihat perubahannya."
10477
10478
#: serverguide/C/samba.xml:575(para)
10479
msgid ""
10480
"For the <emphasis>read list</emphasis> and <emphasis>write list</emphasis> "
10481
"to work the Samba security mode must <emphasis>not</emphasis> be set to "
10482
"<emphasis role=\"italic\">security = share</emphasis>"
10483
msgstr ""
10484
10485
#: serverguide/C/samba.xml:581(para)
10486
msgid ""
10487
"Now that Samba has been configured to limit which groups have access to the "
10488
"shared directory, the filesystem permissions need to be updated."
10489
msgstr ""
10490
10491
#: serverguide/C/samba.xml:586(para)
10492
msgid ""
10493
"Traditional Linux file permissions do not map well to Windows NT Access "
10494
"Control Lists (ACLs). Fortunately POSIX ACLs are available on Ubuntu servers "
10495
"providing more fine grained control. For example, to enable ACLs on "
10496
"<filename>/srv</filename> an EXT3 filesystem, edit "
10497
"<filename>/etc/fstab</filename> adding the <emphasis>acl</emphasis> option:"
10498
msgstr ""
10499
10500
#: serverguide/C/samba.xml:593(programlisting)
10501
#, no-wrap
10502
msgid ""
10503
"\n"
10504
"UUID=66bcdd2e-8861-4fb0-b7e4-e61c569fe17d /srv ext3 noatime,relatime,acl "
10505
"0 1\n"
10506
msgstr ""
10507
"\n"
10508
"UUID=66bcdd2e-8861-4fb0-b7e4-e61c569fe17d /srv ext3 noatime,relatime,acl 0 "
10509
"1\n"
10510
10511
#: serverguide/C/samba.xml:597(para)
10512
msgid "Then remount the partition:"
10513
msgstr ""
10514
10515
#: serverguide/C/samba.xml:602(command)
10516
msgid "sudo mount -v -o remount /srv"
10517
msgstr "sudo mount -v -o remount /srv"
10518
10519
#: serverguide/C/samba.xml:606(para)
10520
msgid ""
10521
"The above example assumes <filename>/srv</filename> on a separate partition. "
10522
"If <filename>/srv</filename>, or wherever you have configured your share "
10523
"path, is part of the <filename>/</filename> partition a reboot may be "
10524
"required."
10525
msgstr ""
10526
10527
#: serverguide/C/samba.xml:613(para)
10528
msgid ""
10529
"To match the Samba configuration above the <emphasis>sysadmin</emphasis> "
10530
"group will be given read, write, and execute permissions to "
10531
"<filename>/srv/samba/share</filename>, the <emphasis>qa</emphasis> group "
10532
"will be given read and execute permissions, and the files will be owned by "
10533
"the username <emphasis>melissa</emphasis>. Enter the following in a terminal:"
10534
msgstr ""
10535
10536
#: serverguide/C/samba.xml:621(command)
10537
msgid "sudo chown -R melissa /srv/samba/share/"
10538
msgstr "sudo chown -R melissa /srv/samba/share/"
10539
10540
#: serverguide/C/samba.xml:622(command)
10541
msgid "sudo chgrp -R sysadmin /srv/samba/share/"
10542
msgstr "sudo chgrp -R sysadmin /srv/samba/share/"
10543
10544
#: serverguide/C/samba.xml:623(command)
10545
msgid "sudo setfacl -R -m g:qa:rx /srv/samba/share/"
10546
msgstr "sudo setfacl -R -m g:qa:rx /srv/samba/share/"
10547
10548
#: serverguide/C/samba.xml:627(para)
10549
msgid ""
10550
"The <application>setfacl</application> command above gives "
10551
"<emphasis>execute</emphasis> permissions to all files in the "
10552
"<filename>/srv/samba/share</filename> directory, which you may or may not "
10553
"want."
10554
msgstr ""
10555
10556
#: serverguide/C/samba.xml:633(para)
10557
msgid ""
10558
"Now from a Windows client you should notice the new file permissions are "
10559
"implemented. See the <application>acl</application> and "
10560
"<application>setfacl</application> man pages for more information on POSIX "
10561
"ACLs."
10562
msgstr ""
10563
10564
#: serverguide/C/samba.xml:641(title)
10565
msgid "Samba AppArmor Profile"
10566
msgstr "Profil Samba AppArmor"
10567
10568
#: serverguide/C/samba.xml:643(para)
10569
msgid ""
10570
"Ubuntu comes with the <application>AppArmor</application> security module, "
10571
"which provides mandatory access controls. The default AppArmor profile for "
10572
"Samba will need to be adapted to your configuration. For more details on "
10573
"using AppArmor see <xref linkend=\"apparmor\"/>."
10574
msgstr ""
10575
10576
#: serverguide/C/samba.xml:649(para)
10577
msgid ""
10578
"There are default AppArmor profiles for <filename>/usr/sbin/smbd</filename> "
10579
"and <filename>/usr/sbin/nmbd</filename>, the Samba daemon binaries, as part "
10580
"of the <application>apparmor-profiles</application> packages. To install the "
10581
"package, from a terminal prompt enter:"
10582
msgstr ""
10583
10584
#: serverguide/C/samba.xml:656(command)
10585
msgid "sudo apt install apparmor-profiles apparmor-utils"
10586
msgstr ""
10587
10588
#: serverguide/C/samba.xml:660(para)
10589
msgid "This package contains profiles for several other binaries."
10590
msgstr "Paket ini berisi profil untuk biner lainnya."
10591
10592
#: serverguide/C/samba.xml:665(para)
10593
msgid ""
10594
"By default the profiles for <application>smbd</application> and "
10595
"<application>nmbd</application> are in <emphasis>complain</emphasis> mode "
10596
"allowing Samba to work without modifying the profile, and only logging "
10597
"errors. To place the <application>smbd</application> profile into "
10598
"<emphasis>enforce</emphasis> mode, and have Samba work as expected, the "
10599
"profile will need to be modified to reflect any directories that are shared."
10600
msgstr ""
10601
10602
#: serverguide/C/samba.xml:672(para)
10603
msgid ""
10604
"Edit <filename>/etc/apparmor.d/usr.sbin.smbd</filename> adding information "
10605
"for <emphasis>[share]</emphasis> from the file server example:"
10606
msgstr ""
10607
"Edit <filename>/etc/apparmor.d/usr.sbin.smbd</filename> tambah informasi "
10608
"pada <emphasis>[share]</emphasis> dari contoh file server:"
10609
10610
#: serverguide/C/samba.xml:677(programlisting)
10611
#, no-wrap
10612
msgid ""
10613
"\n"
10614
" /srv/samba/share/ r,\n"
10615
" /srv/samba/share/** rwkix,\n"
10616
msgstr ""
10617
"\n"
10618
" /srv/samba/share/ r,\n"
10619
" /srv/samba/share/** rwkix,\n"
10620
10621
#: serverguide/C/samba.xml:682(para)
10622
msgid ""
10623
"Now place the profile into <emphasis>enforce</emphasis> and reload it:"
10624
msgstr ""
10625
10626
#: serverguide/C/samba.xml:687(command)
10627
msgid "sudo aa-enforce /usr/sbin/smbd"
10628
msgstr "sudo aa-enforce /usr/sbin/smbd"
10629
10630
#: serverguide/C/samba.xml:688(command)
10631
msgid "cat /etc/apparmor.d/usr.sbin.smbd | sudo apparmor_parser -r"
10632
msgstr "cat /etc/apparmor.d/usr.sbin.smbd | sudo apparmor_parser -r"
10633
10634
#: serverguide/C/samba.xml:691(para)
10635
msgid ""
10636
"You should now be able to read, write, and execute files in the shared "
10637
"directory as normal, and the <application>smbd</application> binary will "
10638
"have access to only the configured files and directories. Be sure to add "
10639
"entries for each directory you configure Samba to share. Also, any errors "
10640
"will be logged to <filename>/var/log/syslog</filename>."
10641
msgstr ""
10642
10643
#: serverguide/C/samba.xml:716(para) serverguide/C/samba.xml:1110(para)
10644
msgid ""
10645
"O'Reilly's <ulink "
10646
"url=\"http://www.oreilly.com/catalog/9780596007690/\">Using Samba</ulink> is "
10647
"also a good reference."
10648
msgstr ""
10649
10650
#: serverguide/C/samba.xml:722(para)
10651
msgid ""
10652
"<ulink url=\"http://samba.org/samba/docs/man/Samba-HOWTO-Collection/securing-"
10653
"samba.html\">Chapter 18</ulink> of the Samba HOWTO Collection is devoted to "
10654
"security."
10655
msgstr ""
10656
"<ulink url=\"http://samba.org/samba/docs/man/Samba-HOWTO-Collection/securing-"
10657
"samba.html\">Bab 18</ulink> dari Samba HOWTO Collection yang dikhususkan "
10658
"untuk keamanan."
10659
10660
#: serverguide/C/samba.xml:728(para)
10661
msgid ""
10662
"For more information on Samba and ACLs see the <ulink "
10663
"url=\"http://samba.org/samba/docs/man/Samba-HOWTO-"
10664
"Collection/AccessControls.html#id397568\">Samba ACLs page </ulink>."
10665
msgstr ""
10666
"Untuk informasi lebih mengenai Samba dan ACLs, lihat <ulink "
10667
"url=\"http://samba.org/samba/docs/man/Samba-HOWTO-"
10668
"Collection/AccessControls.html#id397568\">Halaman Samba ACLs </ulink>."
10669
10670
#: serverguide/C/samba.xml:744(title)
10671
msgid "As a Domain Controller"
10672
msgstr ""
10673
10674
#: serverguide/C/samba.xml:746(para)
10675
msgid ""
10676
"Although it cannot act as an Active Directory Primary Domain Controller "
10677
"(PDC), a Samba server can be configured to appear as a Windows NT4-style "
10678
"domain controller. A major advantage of this configuration is the ability to "
10679
"centralize user and machine credentials. Samba can also use multiple "
10680
"backends to store the user information."
10681
msgstr ""
10682
10683
#: serverguide/C/samba.xml:753(title)
10684
msgid "Primary Domain Controller"
10685
msgstr "Pengatur Domain Utama"
10686
10687
#: serverguide/C/samba.xml:755(para)
10688
msgid ""
10689
"This section covers configuring Samba as a Primary Domain Controller (PDC) "
10690
"using the default smbpasswd backend."
10691
msgstr ""
10692
10693
#: serverguide/C/samba.xml:762(para)
10694
msgid ""
10695
"First, install Samba, and <application>libpam-winbind</application> to sync "
10696
"the user accounts, by entering the following in a terminal prompt:"
10697
msgstr ""
10698
10699
#: serverguide/C/samba.xml:768(command) serverguide/C/samba.xml:1008(command)
10700
msgid "sudo apt install samba libpam-winbind"
10701
msgstr ""
10702
10703
#: serverguide/C/samba.xml:774(para)
10704
msgid ""
10705
"Next, configure Samba by editing <filename>/etc/samba/smb.conf</filename>. "
10706
"The <emphasis>security</emphasis> mode should be set to <emphasis "
10707
"role=\"italic\">user</emphasis>, and the <emphasis>workgroup</emphasis> "
10708
"should relate to your organization:"
10709
msgstr ""
10710
10711
#: serverguide/C/samba.xml:789(para)
10712
msgid ""
10713
"In the commented <quote>Domains</quote> section add or uncomment the "
10714
"following (the last line has been split to fit the format of this document):"
10715
msgstr ""
10716
10717
#: serverguide/C/samba.xml:793(programlisting)
10718
#, no-wrap
10719
msgid ""
10720
"\n"
10721
" domain logons = yes\n"
10722
" logon path = \\\\%N\\%U\\profile\n"
10723
" logon drive = H:\n"
10724
" logon home = \\\\%N\\%U\n"
10725
" logon script = logon.cmd\n"
10726
" add machine script = sudo /usr/sbin/useradd -N -g machines -c Machine -d\n"
10727
" /var/lib/samba -s /bin/false %u\n"
10728
msgstr ""
10729
"\n"
10730
" domain logons = yes\n"
10731
" logon path = \\\\%N\\%U\\profile\n"
10732
" logon drive = H:\n"
10733
" logon home = \\\\%N\\%U\n"
10734
" logon script = logon.cmd\n"
10735
" tambah machine script = sudo /usr/sbin/useradd -N -g machines -c Machine -"
10736
"d\n"
10737
" /var/lib/samba -s /bin/false %u\n"
10738
10739
#: serverguide/C/samba.xml:804(para)
10740
msgid ""
10741
"If you wish to not use <emphasis>Roaming Profiles</emphasis> leave the "
10742
"<emphasis>logon home</emphasis> and <emphasis>logon path</emphasis> options "
10743
"commented."
10744
msgstr ""
10745
10746
#: serverguide/C/samba.xml:812(para)
10747
msgid ""
10748
"<emphasis>domain logons:</emphasis> provides the netlogon service causing "
10749
"Samba to act as a domain controller."
10750
msgstr ""
10751
10752
#: serverguide/C/samba.xml:817(para)
10753
msgid ""
10754
"<emphasis>logon path:</emphasis> places the user's Windows profile into "
10755
"their home directory. It is also possible to configure a "
10756
"<emphasis>[profiles]</emphasis> share placing all profiles under a single "
10757
"directory."
10758
msgstr ""
10759
10760
#: serverguide/C/samba.xml:823(para)
10761
msgid ""
10762
"<emphasis>logon drive:</emphasis> specifies the home directory local path."
10763
msgstr ""
10764
10765
#: serverguide/C/samba.xml:828(para)
10766
msgid ""
10767
"<emphasis>logon home:</emphasis> specifies the home directory location."
10768
msgstr ""
10769
10770
#: serverguide/C/samba.xml:833(para)
10771
msgid ""
10772
"<emphasis>logon script:</emphasis> determines the script to be run locally "
10773
"once a user has logged in. The script needs to be placed in the "
10774
"<emphasis>[netlogon]</emphasis> share."
10775
msgstr ""
10776
10777
#: serverguide/C/samba.xml:839(para)
10778
msgid ""
10779
"<emphasis>add machine script:</emphasis> a script that will automatically "
10780
"create the <emphasis>Machine Trust Account</emphasis> needed for a "
10781
"workstation to join the domain."
10782
msgstr ""
10783
10784
#: serverguide/C/samba.xml:843(para)
10785
msgid ""
10786
"In this example the <emphasis>machines</emphasis> group will need to be "
10787
"created using the <application>addgroup</application> utility see <xref "
10788
"linkend=\"adding-deleting-users\"/> for details."
10789
msgstr ""
10790
10791
#: serverguide/C/samba.xml:854(para)
10792
msgid ""
10793
"Uncomment the <emphasis>[homes]</emphasis> share to allow the <emphasis "
10794
"role=\"italic\">logon home</emphasis> to be mapped:"
10795
msgstr ""
10796
10797
#: serverguide/C/samba.xml:859(programlisting)
10798
#, no-wrap
10799
msgid ""
10800
"\n"
10801
"[homes]\n"
10802
" comment = Home Directories\n"
10803
" browseable = no\n"
10804
" read only = no\n"
10805
" create mask = 0700\n"
10806
" directory mask = 0700\n"
10807
" valid users = %S\n"
10808
msgstr ""
10809
"\n"
10810
"[homes]\n"
10811
" comment = Home Directories\n"
10812
" browseable = no\n"
10813
" read only = no\n"
10814
" create mask = 0700\n"
10815
" directory mask = 0700\n"
10816
" valid users = %S\n"
10817
10818
#: serverguide/C/samba.xml:872(para)
10819
msgid ""
10820
"When configured as a domain controller a <emphasis>[netlogon]</emphasis> "
10821
"share needs to be configured. To enable the share, uncomment:"
10822
msgstr ""
10823
10824
#: serverguide/C/samba.xml:877(programlisting)
10825
#, no-wrap
10826
msgid ""
10827
"\n"
10828
"[netlogon]\n"
10829
" comment = Network Logon Service\n"
10830
" path = /srv/samba/netlogon\n"
10831
" guest ok = yes\n"
10832
" read only = yes\n"
10833
" share modes = no\n"
10834
msgstr ""
10835
"\n"
10836
"[netlogon]\n"
10837
" comment = Network Logon Service\n"
10838
" path = /srv/samba/netlogon\n"
10839
" guest ok = yes\n"
10840
" read only = yes\n"
10841
" share modes = no\n"
10842
10843
#: serverguide/C/samba.xml:887(para)
10844
msgid ""
10845
"The original <emphasis>netlogon</emphasis> share path is "
10846
"<filename>/home/samba/netlogon</filename>, but according to the Filesystem "
10847
"Hierarchy Standard (FHS), <ulink url=\"http://www.pathname.com/fhs/pub/fhs-"
10848
"2.3.html#SRVDATAFORSERVICESPROVIDEDBYSYSTEM\">/srv</ulink> is the correct "
10849
"location for site-specific data provided by the system."
10850
msgstr ""
10851
10852
#: serverguide/C/samba.xml:898(para)
10853
msgid ""
10854
"Now create the <filename role=\"directory\">netlogon</filename> directory, "
10855
"and an empty (for now) <filename>logon.cmd</filename> script file:"
10856
msgstr ""
10857
10858
#: serverguide/C/samba.xml:904(command)
10859
msgid "sudo mkdir -p /srv/samba/netlogon"
10860
msgstr "Copy text \t sudo mkdir -p /srv/samba/netlogon"
10861
10862
#: serverguide/C/samba.xml:905(command)
10863
msgid "sudo touch /srv/samba/netlogon/logon.cmd"
10864
msgstr "sudo touch /srv/samba/netlogon/logon.cmd"
10865
10866
#: serverguide/C/samba.xml:908(para)
10867
msgid ""
10868
"You can enter any normal Windows logon script commands in "
10869
"<filename>logon.cmd</filename> to customize the client's environment."
10870
msgstr ""
10871
10872
#: serverguide/C/samba.xml:916(para)
10873
msgid "Restart Samba to enable the new domain controller:"
10874
msgstr ""
10875
10876
#: serverguide/C/samba.xml:927(para)
10877
msgid ""
10878
"Lastly, there are a few additional commands needed to setup the appropriate "
10879
"rights."
10880
msgstr ""
10881
10882
#: serverguide/C/samba.xml:931(para)
10883
msgid ""
10884
"With <emphasis>root</emphasis> being disabled by default, in order to join a "
10885
"workstation to the domain, a system group needs to be mapped to the Windows "
10886
"<emphasis>Domain Admins</emphasis> group. Using the "
10887
"<application>net</application> utility, from a terminal enter:"
10888
msgstr ""
10889
10890
#: serverguide/C/samba.xml:938(command)
10891
msgid ""
10892
"sudo net groupmap add ntgroup=\"Domain Admins\" unixgroup=sysadmin rid=512 "
10893
"type=d"
10894
msgstr ""
10895
"sudo net groupmap add ntgroup=\"Domain Admins\" unixgroup=sysadmin rid=512 "
10896
"type=d"
10897
10898
#: serverguide/C/samba.xml:942(para)
10899
msgid ""
10900
"Change <emphasis role=\"italic\">sysadmin</emphasis> to whichever group you "
10901
"prefer. Also, the user used to join the domain needs to be a member of the "
10902
"<emphasis>sysadmin</emphasis> group, as well as a member of the system "
10903
"<emphasis>admin</emphasis> group. The <emphasis>admin</emphasis> group "
10904
"allows <application>sudo</application> use."
10905
msgstr ""
10906
10907
#: serverguide/C/samba.xml:948(para)
10908
msgid ""
10909
"If the user does not have Samba credentials yet, you can add them with the "
10910
"<application>smbpasswd</application> utility, change the "
10911
"<emphasis>sysadmin</emphasis> username appropriately: <screen>\n"
10912
"<command>sudo smbpasswd -a sysadmin</command>\n"
10913
"</screen>"
10914
msgstr ""
10915
10916
#: serverguide/C/samba.xml:958(para)
10917
msgid ""
10918
"Also, rights need to be explicitly provided to the <emphasis>Domain "
10919
"Admins</emphasis> group to allow the <emphasis>add machine script</emphasis> "
10920
"(and other admin functions) to work. This is achieved by executing:"
10921
msgstr ""
10922
10923
#: serverguide/C/samba.xml:963(command)
10924
msgid ""
10925
"net rpc rights grant -U sysadmin \"EXAMPLE\\Domain Admins\" "
10926
"SeMachineAccountPrivilege \\ SePrintOperatorPrivilege SeAddUsersPrivilege "
10927
"SeDiskOperatorPrivilege \\ SeRemoteShutdownPrivilege"
10928
msgstr ""
10929
10930
#: serverguide/C/samba.xml:971(para)
10931
msgid ""
10932
"You should now be able to join Windows clients to the Domain in the same "
10933
"manner as joining them to an NT4 domain running on a Windows server."
10934
msgstr ""
10935
10936
#: serverguide/C/samba.xml:981(title)
10937
msgid "Backup Domain Controller"
10938
msgstr ""
10939
10940
#: serverguide/C/samba.xml:983(para)
10941
msgid ""
10942
"With a Primary Domain Controller (PDC) on the network it is best to have a "
10943
"Backup Domain Controller (BDC) as well. This will allow clients to "
10944
"authenticate in case the PDC becomes unavailable."
10945
msgstr ""
10946
10947
#: serverguide/C/samba.xml:988(para)
10948
msgid ""
10949
"When configuring Samba as a BDC you need a way to sync account information "
10950
"with the PDC. There are multiple ways of accomplishing this "
10951
"<application>scp</application>, <application>rsync</application>, or by "
10952
"using <application>LDAP</application> as the <emphasis>passdb "
10953
"backend</emphasis>."
10954
msgstr ""
10955
10956
#: serverguide/C/samba.xml:994(para)
10957
msgid ""
10958
"Using LDAP is the most robust way to sync account information, because both "
10959
"domain controllers can use the same information in real time. However, "
10960
"setting up a LDAP server may be overly complicated for a small number of "
10961
"user and computer accounts. See <xref linkend=\"samba-ldap\"/> for details."
10962
msgstr ""
10963
10964
#: serverguide/C/samba.xml:1003(para)
10965
msgid ""
10966
"First, install <application>samba</application> and <application>libpam-"
10967
"winbind</application>. From a terminal enter:"
10968
msgstr ""
10969
10970
#: serverguide/C/samba.xml:1014(para)
10971
msgid ""
10972
"Now, edit <filename>/etc/samba/smb.conf</filename> and uncomment the "
10973
"following in the <emphasis>[global]</emphasis>:"
10974
msgstr ""
10975
10976
#: serverguide/C/samba.xml:1027(para)
10977
msgid "In the commented <emphasis>Domains</emphasis> uncomment or add:"
10978
msgstr ""
10979
10980
#: serverguide/C/samba.xml:1031(programlisting)
10981
#, no-wrap
10982
msgid ""
10983
"\n"
10984
" domain logons = yes\n"
10985
" domain master = no\n"
10986
msgstr ""
10987
10988
#: serverguide/C/samba.xml:1039(para)
10989
msgid ""
10990
"Make sure a user has rights to read the files in "
10991
"<filename>/var/lib/samba</filename>. For example, to allow users in the "
10992
"<emphasis>admin</emphasis> group to <application>scp</application> the "
10993
"files, enter:"
10994
msgstr ""
10995
10996
#: serverguide/C/samba.xml:1045(command)
10997
msgid "sudo chgrp -R admin /var/lib/samba"
10998
msgstr "sudo chgrp -R admin /var/lib/samba"
10999
11000
#: serverguide/C/samba.xml:1051(para)
11001
msgid ""
11002
"Next, sync the user accounts, using <application>scp</application> to copy "
11003
"the <filename>/var/lib/samba</filename> directory from the PDC:"
11004
msgstr ""
11005
11006
#: serverguide/C/samba.xml:1057(command)
11007
msgid "sudo scp -r username@pdc:/var/lib/samba /var/lib"
11008
msgstr "sudo scp -r username@pdc:/var/lib/samba /var/lib"
11009
11010
#: serverguide/C/samba.xml:1061(para)
11011
msgid ""
11012
"Replace <emphasis>username</emphasis> with a valid username and "
11013
"<emphasis>pdc</emphasis> with the hostname or IP Address of your actual PDC."
11014
msgstr ""
11015
11016
#: serverguide/C/samba.xml:1070(para)
11017
msgid "Finally, restart <application>samba</application>:"
11018
msgstr ""
11019
11020
#: serverguide/C/samba.xml:1081(para)
11021
msgid ""
11022
"You can test that your Backup Domain controller is working by stopping the "
11023
"Samba daemon on the PDC, then trying to login to a Windows client joined to "
11024
"the domain."
11025
msgstr ""
11026
11027
#: serverguide/C/samba.xml:1086(para)
11028
msgid ""
11029
"Another thing to keep in mind is if you have configured the <emphasis>logon "
11030
"home</emphasis> option as a directory on the PDC, and the PDC becomes "
11031
"unavailable, access to the user's <emphasis>Home</emphasis> drive will also "
11032
"be unavailable. For this reason it is best to configure the <emphasis>logon "
11033
"home</emphasis> to reside on a separate file server from the PDC and BDC."
11034
msgstr ""
11035
11036
#: serverguide/C/samba.xml:1116(para)
11037
msgid ""
11038
"<ulink url=\"http://samba.org/samba/docs/man/Samba-HOWTO-Collection/samba-"
11039
"pdc.html\">Chapter 4</ulink> of the Samba HOWTO Collection explains setting "
11040
"up a Primary Domain Controller."
11041
msgstr ""
11042
11043
#: serverguide/C/samba.xml:1122(para)
11044
msgid ""
11045
"<ulink url=\"http://us3.samba.org/samba/docs/man/Samba-HOWTO-"
11046
"Collection/samba-bdc.html\">Chapter 5</ulink> of the Samba HOWTO Collection "
11047
"explains setting up a Backup Domain Controller."
11048
msgstr ""
11049
11050
#: serverguide/C/samba.xml:1137(title)
11051
msgid "Active Directory Integration"
11052
msgstr ""
11053
11054
#: serverguide/C/samba.xml:1140(title)
11055
msgid "Accessing a Samba Share"
11056
msgstr ""
11057
11058
#: serverguide/C/samba.xml:1142(para)
11059
msgid ""
11060
"Another, use for Samba is to integrate into an existing Windows network. "
11061
"Once part of an Active Directory domain, Samba can provide file and print "
11062
"services to AD users."
11063
msgstr ""
11064
11065
#: serverguide/C/samba.xml:1147(para)
11066
msgid ""
11067
"The simplest way to join an AD domain is to use <application>Likewise-"
11068
"open</application>. For detailed instructions see the <ulink "
11069
"url=\"http://www.beyondtrust.com/Technical-"
11070
"Support/Downloads/files/pbiso/Manuals/ubuntu-active-directory.html\"> "
11071
"Likewise Open documentation</ulink>."
11072
msgstr ""
11073
11074
#: serverguide/C/samba.xml:1153(para)
11075
msgid ""
11076
"Once part of the Active Directory domain, enter the following command in the "
11077
"terminal prompt:"
11078
msgstr ""
11079
11080
#: serverguide/C/samba.xml:1158(command)
11081
msgid "sudo apt install samba cifs-utils smbclient"
11082
msgstr ""
11083
11084
#: serverguide/C/samba.xml:1161(para)
11085
msgid "Next, edit <filename>/etc/samba/smb.conf</filename> changing:"
11086
msgstr ""
11087
11088
#: serverguide/C/samba.xml:1165(programlisting)
11089
#, no-wrap
11090
msgid ""
11091
"\n"
11092
" workgroup = EXAMPLE\n"
11093
" ...\n"
11094
" security = ads\n"
11095
" realm = EXAMPLE.COM\n"
11096
" ...\n"
11097
" idmap backend = lwopen\n"
11098
" idmap uid = 50-9999999999\n"
11099
" idmap gid = 50-9999999999\n"
11100
msgstr ""
11101
11102
#: serverguide/C/samba.xml:1176(para)
11103
msgid ""
11104
"Restart <application>samba</application> for the new settings to take effect:"
11105
msgstr ""
11106
11107
#: serverguide/C/samba.xml:1184(para)
11108
msgid ""
11109
"You should now be able to access any <application>Samba</application> shares "
11110
"from a Windows client. However, be sure to give the appropriate AD users or "
11111
"groups access to the share directory. See <xref linkend=\"samba-fileprint-"
11112
"security\"/> for more details."
11113
msgstr ""
11114
11115
#: serverguide/C/samba.xml:1192(title)
11116
msgid "Accessing a Windows Share"
11117
msgstr ""
11118
11119
#: serverguide/C/samba.xml:1194(para)
11120
msgid ""
11121
"Now that the Samba server is part of the Active Directory domain you can "
11122
"access any Windows server shares:"
11123
msgstr ""
11124
11125
#: serverguide/C/samba.xml:1201(para)
11126
msgid ""
11127
"To mount a Windows file share enter the following in a terminal prompt:"
11128
msgstr ""
11129
11130
#: serverguide/C/samba.xml:1205(command)
11131
msgid "mount.cifs //fs01.example.com/share mount_point"
11132
msgstr ""
11133
11134
#: serverguide/C/samba.xml:1208(para)
11135
msgid ""
11136
"It is also possible to access shares on computers not part of an AD domain, "
11137
"but a username and password will need to be provided."
11138
msgstr ""
11139
11140
#: serverguide/C/samba.xml:1216(para)
11141
msgid ""
11142
"To mount the share during boot place an entry in "
11143
"<filename>/etc/fstab</filename>, for example:"
11144
msgstr ""
11145
11146
#: serverguide/C/samba.xml:1220(programlisting)
11147
#, no-wrap
11148
msgid ""
11149
"\n"
11150
"//192.168.0.5/share /mnt/windows cifs auto,username=steve,password=secret,rw "
11151
"0 0\n"
11152
msgstr ""
11153
11154
#: serverguide/C/samba.xml:1227(para)
11155
msgid ""
11156
"Another way to copy files from a Windows server is to use the "
11157
"<application>smbclient</application> utility. To list the files in a Windows "
11158
"share:"
11159
msgstr ""
11160
11161
#: serverguide/C/samba.xml:1233(command)
11162
msgid "smbclient //fs01.example.com/share -k -c \"ls\""
11163
msgstr ""
11164
11165
#: serverguide/C/samba.xml:1239(para)
11166
msgid "To copy a file from the share, enter:"
11167
msgstr ""
11168
11169
#: serverguide/C/samba.xml:1244(command)
11170
msgid "smbclient //fs01.example.com/share -k -c \"get file.txt\""
11171
msgstr ""
11172
11173
#: serverguide/C/samba.xml:1247(para)
11174
msgid ""
11175
"This will copy the <filename>file.txt</filename> into the current directory."
11176
msgstr ""
11177
11178
#: serverguide/C/samba.xml:1254(para)
11179
msgid "And to copy a file to the share:"
11180
msgstr ""
11181
11182
#: serverguide/C/samba.xml:1259(command)
11183
msgid "smbclient //fs01.example.com/share -k -c \"put /etc/hosts hosts\""
11184
msgstr ""
11185
11186
#: serverguide/C/samba.xml:1262(para)
11187
msgid ""
11188
"This will copy the <filename>/etc/hosts</filename> to "
11189
"<filename>//fs01.example.com/share/hosts</filename>."
11190
msgstr ""
11191
11192
#: serverguide/C/samba.xml:1269(para)
11193
msgid ""
11194
"The <emphasis>-c</emphasis> option used above allows you to execute the "
11195
"<application>smbclient</application> command all at once. This is useful for "
11196
"scripting and minor file operations. To enter the <emphasis>smb: \\"
11197
"></emphasis> prompt, a FTP like prompt where you can execute normal file "
11198
"and directory commands, simply execute:"
11199
msgstr ""
11200
11201
#: serverguide/C/samba.xml:1276(command)
11202
msgid "smbclient //fs01.example.com/share -k"
11203
msgstr ""
11204
11205
#: serverguide/C/samba.xml:1283(para)
11206
msgid ""
11207
"Replace all instances of <emphasis>fs01.example.com/share</emphasis>, "
11208
"<emphasis>//192.168.0.5/share</emphasis>, "
11209
"<emphasis>username=steve,password=secret</emphasis>, and "
11210
"<emphasis>file.txt</emphasis> with your server's IP, hostname, share name, "
11211
"file name, and an actual username and password with rights to the share."
11212
msgstr ""
11213
11214
#: serverguide/C/samba.xml:1294(para)
11215
msgid ""
11216
"For more <application>smbclient</application> options see the man page: "
11217
"<command>man smbclient</command>, also available <ulink "
11218
"url=\"http://manpages.ubuntu.com/manpages/xenial/en/man1/smbclient.1.html\">o"
11219
"nline</ulink>."
11220
msgstr ""
11221
11222
#: serverguide/C/samba.xml:1299(para)
11223
msgid ""
11224
"The <application>mount.cifs</application><ulink "
11225
"url=\"http://manpages.ubuntu.com/manpages/xenial/en/man8/mount.cifs.8.html\">"
11226
"man page</ulink> is also useful for more detailed information."
11227
msgstr ""
11228
11229
#: serverguide/C/reporting-bugs.xml:11(title)
11230
msgid "Appendix"
11231
msgstr ""
11232
11233
#: serverguide/C/reporting-bugs.xml:14(title)
11234
msgid "Reporting Bugs in Ubuntu Server Edition"
11235
msgstr ""
11236
11237
#: serverguide/C/reporting-bugs.xml:16(para)
11238
msgid ""
11239
"The Ubuntu Project, and thus Ubuntu Server, uses <ulink "
11240
"url=\"https://launchpad.net/\">Launchpad</ulink> as its bugtracker. In order "
11241
"to file a bug, you will need a Launchpad account. <ulink "
11242
"url=\"https://help.launchpad.net/YourAccount/NewAccount\">Create one "
11243
"here</ulink> if necessary."
11244
msgstr ""
11245
11246
#: serverguide/C/reporting-bugs.xml:23(title)
11247
msgid "Reporting Bugs With apport-cli"
11248
msgstr ""
11249
11250
#: serverguide/C/reporting-bugs.xml:25(para)
11251
msgid ""
11252
"The preferred way to report a bug is with the <application>apport-"
11253
"cli</application> command. It must be invoked on the machine affected by the "
11254
"bug because it collects information from the system on which it is being run "
11255
"and publishes it to the bug report on Launchpad. Getting that information to "
11256
"Launchpad can therefore be a challenge if the system is not running a "
11257
"desktop environment in order to use a browser (common with servers) or if it "
11258
"does not have Internet access. The steps to take in these situations are "
11259
"described below."
11260
msgstr ""
11261
11262
#: serverguide/C/reporting-bugs.xml:33(para)
11263
msgid ""
11264
"The commands <application>apport-cli</application> and <application>ubuntu-"
11265
"bug</application> should give the same results on a CLI server. The latter "
11266
"is actually a symlink to <application>apport-bug</application> which is "
11267
"intelligent enough to know whether a desktop environment is in use and will "
11268
"choose <application>apport-cli</application> if not. Since server systems "
11269
"tend to be CLI-only apport-cli was chosen from the outset in this guide."
11270
msgstr ""
11271
11272
#: serverguide/C/reporting-bugs.xml:40(para)
11273
msgid ""
11274
"Bug reports in Ubuntu need to be filed against a specific software package, "
11275
"so the name of the package (source package or program name/path) affected by "
11276
"the bug needs to be supplied to apport-cli:"
11277
msgstr ""
11278
11279
#: serverguide/C/reporting-bugs.xml:46(command)
11280
msgid "apport-cli PACKAGENAME"
11281
msgstr ""
11282
11283
#: serverguide/C/reporting-bugs.xml:50(para)
11284
msgid ""
11285
"See <xref linkend=\"package-management\"/> for more information about "
11286
"packages in Ubuntu."
11287
msgstr ""
11288
11289
#: serverguide/C/reporting-bugs.xml:55(para)
11290
msgid ""
11291
"Once apport-cli has finished gathering information you will be asked what to "
11292
"do with it. For instance, to report a bug in vim:"
11293
msgstr ""
11294
11295
#: serverguide/C/reporting-bugs.xml:61(command)
11296
msgid "apport-cli vim"
11297
msgstr ""
11298
11299
#: serverguide/C/reporting-bugs.xml:60(screen)
11300
#, no-wrap
11301
msgid ""
11302
"\n"
11303
"<placeholder-1/>\n"
11304
"\n"
11305
"*** Collecting problem information\n"
11306
"\n"
11307
"The collected information can be sent to the developers to improve the\n"
11308
"application. This might take a few minutes.\n"
11309
"...\n"
11310
"\n"
11311
"*** Send problem report to the developers?\n"
11312
"\n"
11313
"After the problem report has been sent, please fill out the form in the\n"
11314
"automatically opened web browser.\n"
11315
"\n"
11316
"What would you like to do? Your options are:\n"
11317
" S: Send report (2.8 KB)\n"
11318
" V: View report\n"
11319
" K: Keep report file for sending later or copying to somewhere else\n"
11320
" I: Cancel and ignore future crashes of this program version\n"
11321
" C: Cancel\n"
11322
"Please choose (S/V/K/I/C):\n"
11323
msgstr ""
11324
11325
#: serverguide/C/reporting-bugs.xml:83(para)
11326
msgid "The first three options are described below:"
11327
msgstr ""
11328
11329
#: serverguide/C/reporting-bugs.xml:90(para)
11330
msgid ""
11331
"<emphasis role=\"bold\">Send:</emphasis> submits the collected information "
11332
"to Launchpad as part of the process of filing a new bug report. You will be "
11333
"given the opportunity to describe the bug in your own words."
11334
msgstr ""
11335
11336
#: serverguide/C/reporting-bugs.xml:114(userinput) serverguide/C/backups.xml:858(userinput)
11337
#, no-wrap
11338
msgid "1"
11339
msgstr ""
11340
11341
#: serverguide/C/reporting-bugs.xml:96(screen)
11342
#, no-wrap
11343
msgid ""
11344
"\n"
11345
"\n"
11346
"*** Uploading problem information\n"
11347
"\n"
11348
"The collected information is being sent to the bug tracking system.\n"
11349
"This might take a few minutes.\n"
11350
"94%\n"
11351
"\n"
11352
"*** To continue, you must visit the following URL:\n"
11353
"\n"
11354
" https://bugs.launchpad.net/ubuntu/+source/vim/+filebug/09b2495a-e2ab-11e3-"
11355
"879b-68b5996a96c8?\n"
11356
"\n"
11357
"You can launch a browser now, or copy this URL into a browser on another "
11358
"computer.\n"
11359
"\n"
11360
"\n"
11361
"Choices:\n"
11362
" 1: Launch a browser now\n"
11363
" C: Cancel\n"
11364
"Please choose (1/C): <placeholder-1/>\n"
11365
msgstr ""
11366
11367
#: serverguide/C/reporting-bugs.xml:117(para)
11368
msgid ""
11369
"The browser that will be used when choosing '1' will be the one known on the "
11370
"system as <application>www-browser</application> via the <ulink "
11371
"url=\"http://manpages.ubuntu.com/manpages/en/man8/update-"
11372
"alternatives.8.html\"> Debian alternatives system</ulink>. Examples of text-"
11373
"based browsers to install include <application>links</application>, "
11374
"<application>elinks</application>, <application>lynx</application>, and "
11375
"<application>w3m</application>. You can also manually point an existing "
11376
"browser at the given URL."
11377
msgstr ""
11378
11379
#: serverguide/C/reporting-bugs.xml:128(para)
11380
msgid ""
11381
"<emphasis role=\"bold\">View:</emphasis> displays the collected information "
11382
"on the screen for review. This can be a lot of information. Press 'Enter' to "
11383
"scroll by screenful. Press 'q' to quit and return to the choice menu."
11384
msgstr ""
11385
11386
#: serverguide/C/reporting-bugs.xml:137(para)
11387
msgid ""
11388
"<emphasis role=\"bold\">Keep:</emphasis> writes the collected information to "
11389
"disk. The resulting file can be later used to file the bug report, typically "
11390
"after transferring it to another Ubuntu system."
11391
msgstr ""
11392
11393
#: serverguide/C/reporting-bugs.xml:150(userinput)
11394
#, no-wrap
11395
msgid "k"
11396
msgstr ""
11397
11398
#: serverguide/C/reporting-bugs.xml:143(screen)
11399
#, no-wrap
11400
msgid ""
11401
"\n"
11402
"What would you like to do? Your options are:\n"
11403
" S: Send report (2.8 KB)\n"
11404
" V: View report\n"
11405
" K: Keep report file for sending later or copying to somewhere else\n"
11406
" I: Cancel and ignore future crashes of this program version\n"
11407
" C: Cancel\n"
11408
"Please choose (S/V/K/I/C): <placeholder-1/>\n"
11409
"Problem report file: /tmp/apport.vim.1pg92p02.apport\n"
11410
msgstr ""
11411
11412
#: serverguide/C/reporting-bugs.xml:154(para)
11413
msgid ""
11414
"To report the bug, get the file onto an internet-enabled Ubuntu system and "
11415
"apply apport-cli to it. This will cause the menu to appear immediately (the "
11416
"information is already collected). You should then press 's' to send:"
11417
msgstr ""
11418
11419
#: serverguide/C/reporting-bugs.xml:161(command)
11420
msgid "apport-cli apport.vim.1pg92p02.apport"
11421
msgstr ""
11422
11423
#: serverguide/C/reporting-bugs.xml:164(para)
11424
msgid ""
11425
"To directly save a report to disk (without menus) you can do: <screen>\n"
11426
"<command>apport-cli vim --save apport.vim.test.apport</command>\n"
11427
"</screen> Report names should end in <emphasis>.apport</emphasis> ."
11428
msgstr ""
11429
11430
#: serverguide/C/reporting-bugs.xml:175(para)
11431
msgid ""
11432
"If this internet-enabled system is non-Ubuntu/Debian, apport-cli is not "
11433
"available so the bug will need to be created manually. An apport report is "
11434
"also not to be included as an attachment to a bug either so it is completely "
11435
"useless in this scenario."
11436
msgstr ""
11437
11438
#: serverguide/C/reporting-bugs.xml:189(title)
11439
msgid "Reporting Application Crashes"
11440
msgstr ""
11441
11442
#: serverguide/C/reporting-bugs.xml:191(para)
11443
msgid ""
11444
"The software package that provides the apport-cli utility, "
11445
"<application>apport</application>, can be configured to automatically "
11446
"capture the state of a crashed application. This is enabled by default (in "
11447
"<filename>/etc/default/apport</filename>)."
11448
msgstr ""
11449
11450
#: serverguide/C/reporting-bugs.xml:197(para)
11451
msgid ""
11452
"After an application crashes, if enabled, apport will store a crash report "
11453
"under <filename>/var/crash</filename>:"
11454
msgstr ""
11455
11456
#: serverguide/C/reporting-bugs.xml:201(screen)
11457
#, no-wrap
11458
msgid ""
11459
"\n"
11460
"-rw-r----- 1 peter whoopsie 150K Jul 24 16:17 _usr_lib_x86_64-linux-"
11461
"gnu_libmenu-cache2_libexec_menu-cached.1000.crash\n"
11462
msgstr ""
11463
11464
#: serverguide/C/reporting-bugs.xml:205(para)
11465
msgid ""
11466
"Use the <application>apport-cli</application> command without arguments to "
11467
"process any pending crash reports. It will offer to report them one by one."
11468
msgstr ""
11469
11470
#: serverguide/C/reporting-bugs.xml:211(command)
11471
msgid "apport-cli"
11472
msgstr ""
11473
11474
#: serverguide/C/reporting-bugs.xml:224(userinput)
11475
#, no-wrap
11476
msgid "s"
11477
msgstr ""
11478
11479
#: serverguide/C/reporting-bugs.xml:210(screen)
11480
#, no-wrap
11481
msgid ""
11482
"\n"
11483
"<placeholder-1/>\n"
11484
"\n"
11485
"*** Send problem report to the developers?\n"
11486
"\n"
11487
"After the problem report has been sent, please fill out the form in the\n"
11488
"automatically opened web browser.\n"
11489
"\n"
11490
"What would you like to do? Your options are:\n"
11491
" S: Send report (153.0 KB)\n"
11492
" V: View report\n"
11493
" K: Keep report file for sending later or copying to somewhere else\n"
11494
" I: Cancel and ignore future crashes of this program version\n"
11495
" C: Cancel\n"
11496
"Please choose (S/V/K/I/C): <placeholder-2/>\n"
11497
msgstr ""
11498
11499
#: serverguide/C/reporting-bugs.xml:227(para)
11500
msgid ""
11501
"If you send the report, as was done above, the prompt will be returned "
11502
"immediately and the <filename>/var/crash</filename> directory will then "
11503
"contain 2 extra files:"
11504
msgstr ""
11505
11506
#: serverguide/C/reporting-bugs.xml:232(screen)
11507
#, no-wrap
11508
msgid ""
11509
"\n"
11510
"-rw-r----- 1 peter whoopsie 150K Jul 24 16:17 _usr_lib_x86_64-linux-"
11511
"gnu_libmenu-cache2_libexec_menu-cached.1000.crash\n"
11512
"-rw-rw-r-- 1 peter whoopsie 0 Jul 24 16:37 _usr_lib_x86_64-linux-"
11513
"gnu_libmenu-cache2_libexec_menu-cached.1000.upload\n"
11514
"-rw------- 1 whoopsie whoopsie 0 Jul 24 16:37 _usr_lib_x86_64-linux-"
11515
"gnu_libmenu-cache2_libexec_menu-cached.1000.uploaded\n"
11516
msgstr ""
11517
11518
#: serverguide/C/reporting-bugs.xml:238(para)
11519
msgid ""
11520
"Sending in a crash report like this will not immediately result in the "
11521
"creation of a new public bug. The report will be made private on Launchpad, "
11522
"meaning that it will be visible to only a limited set of bug triagers. These "
11523
"triagers will then scan the report for possible private data before creating "
11524
"a public bug."
11525
msgstr ""
11526
11527
#: serverguide/C/reporting-bugs.xml:256(para)
11528
msgid ""
11529
"See the <ulink "
11530
"url=\"https://help.ubuntu.com/community/ReportingBugs\">Reporting "
11531
"Bugs</ulink> Ubuntu wiki page."
11532
msgstr ""
11533
11534
#: serverguide/C/reporting-bugs.xml:262(para)
11535
msgid ""
11536
"Also, the <ulink url=\"https://wiki.ubuntu.com/Apport\">Apport</ulink> page "
11537
"has some useful information. Though some of it pertains to using a GUI."
11538
msgstr ""
11539
11540
#: serverguide/C/remote-administration.xml:11(title)
11541
msgid "Remote Administration"
11542
msgstr ""
11543
11544
#: serverguide/C/remote-administration.xml:12(para)
11545
msgid ""
11546
"There are many ways to remotely administer a Linux server. This chapter will "
11547
"cover three of the most popular applications "
11548
"<application>OpenSSH</application>, <application>Puppet</application>, and "
11549
"<application>Zentyal</application>."
11550
msgstr ""
11551
11552
#: serverguide/C/remote-administration.xml:16(title)
11553
msgid "OpenSSH Server"
11554
msgstr "Server OpenSSH"
11555
11556
#: serverguide/C/remote-administration.xml:19(para)
11557
msgid ""
11558
"This section of the Ubuntu Server Guide introduces a powerful collection of "
11559
"tools for the remote control of, and transfer of data between, networked "
11560
"computers called <emphasis>OpenSSH</emphasis>. You will also learn about "
11561
"some of the configuration settings possible with the OpenSSH server "
11562
"application and how to change them on your Ubuntu system."
11563
msgstr ""
11564
11565
#: serverguide/C/remote-administration.xml:24(para)
11566
msgid ""
11567
"OpenSSH is a freely available version of the Secure Shell (SSH) protocol "
11568
"family of tools for remotely controlling, or transferring files between, "
11569
"computers. Traditional tools used to accomplish these functions, such as "
11570
"<application>telnet</application> or <application>rcp</application>, are "
11571
"insecure and transmit the user's password in cleartext when used. OpenSSH "
11572
"provides a server daemon and client tools to facilitate secure, encrypted "
11573
"remote control and file transfer operations, effectively replacing the "
11574
"legacy tools."
11575
msgstr ""
11576
11577
#: serverguide/C/remote-administration.xml:33(para)
11578
msgid ""
11579
"The OpenSSH server component, <application>sshd</application>, listens "
11580
"continuously for client connections from any of the client tools. When a "
11581
"connection request occurs, <application>sshd</application> sets up the "
11582
"correct connection depending on the type of client tool connecting. For "
11583
"example, if the remote computer is connecting with the "
11584
"<application>ssh</application> client application, the OpenSSH server sets "
11585
"up a remote control session after authentication. If a remote user connects "
11586
"to an OpenSSH server with <application>scp</application>, the OpenSSH server "
11587
"daemon initiates a secure copy of files between the server and client after "
11588
"authentication. OpenSSH can use many authentication methods, including plain "
11589
"password, public key, and <application>Kerberos</application> tickets."
11590
msgstr ""
11591
11592
#: serverguide/C/remote-administration.xml:47(para)
11593
msgid ""
11594
"Installation of the OpenSSH client and server applications is simple. To "
11595
"install the OpenSSH client applications on your Ubuntu system, use this "
11596
"command at a terminal prompt:"
11597
msgstr ""
11598
11599
#: serverguide/C/remote-administration.xml:53(command)
11600
msgid "sudo apt install openssh-client"
11601
msgstr ""
11602
11603
#: serverguide/C/remote-administration.xml:55(para)
11604
msgid ""
11605
"To install the OpenSSH server application, and related support files, use "
11606
"this command at a terminal prompt:"
11607
msgstr ""
11608
"Untuk menginstal aplikasi server OpenSSH, dan berkas lain yang dibutuhkan, "
11609
"gunakan perintah berikut pada terminal prompt:"
11610
11611
#: serverguide/C/remote-administration.xml:60(command)
11612
msgid "sudo apt install openssh-server"
11613
msgstr ""
11614
11615
#: serverguide/C/remote-administration.xml:62(para)
11616
msgid ""
11617
"The <application>openssh-server</application> package can also be selected "
11618
"to install during the Server Edition installation process."
11619
msgstr ""
11620
11621
#: serverguide/C/remote-administration.xml:69(para)
11622
msgid ""
11623
"You may configure the default behavior of the OpenSSH server application, "
11624
"<application>sshd</application>, by editing the file "
11625
"<filename>/etc/ssh/sshd_config</filename>. For information about the "
11626
"configuration directives used in this file, you may view the appropriate "
11627
"manual page with the following command, issued at a terminal prompt:"
11628
msgstr ""
11629
11630
#: serverguide/C/remote-administration.xml:77(command)
11631
msgid "man sshd_config"
11632
msgstr "man sshd_config"
11633
11634
#: serverguide/C/remote-administration.xml:79(para)
11635
msgid ""
11636
"There are many directives in the <application>sshd</application> "
11637
"configuration file controlling such things as communication settings, and "
11638
"authentication modes. The following are examples of configuration directives "
11639
"that can be changed by editing the <filename>/etc/ssh/sshd_config</filename> "
11640
"file."
11641
msgstr ""
11642
11643
#: serverguide/C/remote-administration.xml:86(para)
11644
msgid ""
11645
"Prior to editing the configuration file, you should make a copy of the "
11646
"original file and protect it from writing so you will have the original "
11647
"settings as a reference and to reuse as necessary."
11648
msgstr ""
11649
11650
#: serverguide/C/remote-administration.xml:90(para)
11651
msgid ""
11652
"Copy the <filename>/etc/ssh/sshd_config</filename> file and protect it from "
11653
"writing with the following commands, issued at a terminal prompt:"
11654
msgstr ""
11655
"Salin berkas <filename>/etc/ssh/sshd_config</filename> dan lindungi agar "
11656
"tidak dapat ditulis dengan perintah berikut, lakukan di dalam terminal:"
11657
11658
#: serverguide/C/remote-administration.xml:95(command)
11659
msgid "sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.original"
11660
msgstr "sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.original"
11661
11662
#: serverguide/C/remote-administration.xml:96(command)
11663
msgid "sudo chmod a-w /etc/ssh/sshd_config.original"
11664
msgstr "sudo chmod a-w /etc/ssh/sshd_config.original"
11665
11666
#: serverguide/C/remote-administration.xml:99(para)
11667
msgid ""
11668
"The following are examples of configuration directives you may change:"
11669
msgstr "Berikut ini adalah contoh bagian konfigurasi yang dapat Anda ubah:"
11670
11671
#: serverguide/C/remote-administration.xml:104(para)
11672
msgid ""
11673
"To set your OpenSSH to listen on TCP port 2222 instead of the default TCP "
11674
"port 22, change the Port directive as such:"
11675
msgstr ""
11676
"Untuk membuat OpenSSH listen pada port TCP 2222 bukan pada port TCP default "
11677
"22, ubah parameter Port seperti berikut:"
11678
11679
#: serverguide/C/remote-administration.xml:108(para)
11680
msgid "Port 2222"
11681
msgstr "Port 2222"
11682
11683
#: serverguide/C/remote-administration.xml:113(para)
11684
msgid ""
11685
"To have <application>sshd</application> allow public key-based login "
11686
"credentials, simply add or modify the line:"
11687
msgstr ""
11688
"Untuk membuat <application>sshd</application> mengizinkan login berdasarkan "
11689
"public key-based, cukup tambahkan atau modifikasi baris berikut:"
11690
11691
#: serverguide/C/remote-administration.xml:117(para)
11692
msgid "PubkeyAuthentication yes"
11693
msgstr "PubkeyAuthentication yes"
11694
11695
#: serverguide/C/remote-administration.xml:120(para)
11696
msgid "If the line is already present, then ensure it is not commented out."
11697
msgstr ""
11698
11699
#: serverguide/C/remote-administration.xml:125(para)
11700
msgid ""
11701
"To make your OpenSSH server display the contents of the "
11702
"<filename>/etc/issue.net</filename> file as a pre-login banner, simply add "
11703
"or modify the line:"
11704
msgstr ""
11705
11706
#: serverguide/C/remote-administration.xml:130(para)
11707
msgid "Banner /etc/issue.net"
11708
msgstr "Banner /etc/issue.net"
11709
11710
#: serverguide/C/remote-administration.xml:133(para)
11711
msgid "In the <filename>/etc/ssh/sshd_config</filename> file."
11712
msgstr ""
11713
11714
#: serverguide/C/remote-administration.xml:138(para)
11715
msgid ""
11716
"After making changes to the <filename>/etc/ssh/sshd_config</filename> file, "
11717
"save the file, and restart the <application>sshd</application> server "
11718
"application to effect the changes using the following command at a terminal "
11719
"prompt:"
11720
msgstr ""
11721
11722
#: serverguide/C/remote-administration.xml:147(para)
11723
msgid ""
11724
"Many other configuration directives for <application>sshd</application> are "
11725
"available to change the server application's behavior to fit your needs. Be "
11726
"advised, however, if your only method of access to a server is "
11727
"<application>ssh</application>, and you make a mistake in configuring "
11728
"<application>sshd</application> via the "
11729
"<filename>/etc/ssh/sshd_config</filename> file, you may find you are locked "
11730
"out of the server upon restarting it. Additionally, if an incorrect "
11731
"configuration directive is supplied, the <application>sshd</application> "
11732
"server may refuse to start, so be extra careful when editing this file on a "
11733
"remote server."
11734
msgstr ""
11735
11736
#: serverguide/C/remote-administration.xml:161(title)
11737
msgid "SSH Keys"
11738
msgstr ""
11739
11740
#: serverguide/C/remote-administration.xml:162(para)
11741
msgid ""
11742
"SSH <emphasis>keys</emphasis> allow authentication between two hosts without "
11743
"the need of a password. SSH key authentication uses two keys, a "
11744
"<emphasis>private</emphasis> key and a <emphasis>public</emphasis> key."
11745
msgstr ""
11746
11747
#: serverguide/C/remote-administration.xml:166(para)
11748
msgid "To generate the keys, from a terminal prompt enter:"
11749
msgstr ""
11750
11751
#: serverguide/C/remote-administration.xml:170(command)
11752
msgid "ssh-keygen -t rsa"
11753
msgstr ""
11754
11755
#: serverguide/C/remote-administration.xml:172(para)
11756
msgid ""
11757
"This will generate the keys using the <emphasis>RSA Algorithm</emphasis>. "
11758
"During the process you will be prompted for a password. Simply hit "
11759
"<emphasis>Enter</emphasis> when prompted to create the key."
11760
msgstr ""
11761
11762
#: serverguide/C/remote-administration.xml:176(para)
11763
msgid ""
11764
"By default the <emphasis>public</emphasis> key is saved in the file "
11765
"<filename>~/.ssh/id_rsa.pub</filename>, while "
11766
"<filename>~/.ssh/id_rsa</filename> is the <emphasis>private</emphasis> key. "
11767
"Now copy the <filename>id_rsa.pub</filename> file to the remote host and "
11768
"append it to <filename>~/.ssh/authorized_keys</filename> by entering:"
11769
msgstr ""
11770
11771
#: serverguide/C/remote-administration.xml:182(command)
11772
msgid "ssh-copy-id username@remotehost"
11773
msgstr ""
11774
11775
#: serverguide/C/remote-administration.xml:184(para)
11776
msgid ""
11777
"Finally, double check the permissions on the "
11778
"<filename>authorized_keys</filename> file, only the authenticated user "
11779
"should have read and write permissions. If the permissions are not correct "
11780
"change them by:"
11781
msgstr ""
11782
11783
#: serverguide/C/remote-administration.xml:189(command)
11784
msgid "chmod 600 .ssh/authorized_keys"
11785
msgstr ""
11786
11787
#: serverguide/C/remote-administration.xml:191(para)
11788
msgid ""
11789
"You should now be able to SSH to the host without being prompted for a "
11790
"password."
11791
msgstr ""
11792
11793
#: serverguide/C/remote-administration.xml:200(para)
11794
msgid ""
11795
"<ulink url=\"https://help.ubuntu.com/community/SSH\">Ubuntu Wiki SSH</ulink> "
11796
"page."
11797
msgstr ""
11798
11799
#: serverguide/C/remote-administration.xml:206(ulink)
11800
msgid "OpenSSH Website"
11801
msgstr "Situs Web OpenSSH"
11802
11803
#: serverguide/C/remote-administration.xml:211(ulink)
11804
msgid "Advanced OpenSSH Wiki Page"
11805
msgstr "Halaman Wiki OpenSSH Tingkat Lanjut"
11806
11807
#: serverguide/C/remote-administration.xml:219(title)
11808
msgid "Puppet"
11809
msgstr ""
11810
11811
#: serverguide/C/remote-administration.xml:221(para)
11812
msgid ""
11813
"<application>Puppet</application> is a cross platform framework enabling "
11814
"system administrators to perform common tasks using code. The code can do a "
11815
"variety of tasks from installing new software, to checking file permissions, "
11816
"or updating user accounts. <application>Puppet</application> is great not "
11817
"only during the initial installation of a system, but also throughout the "
11818
"system's entire life cycle. In most circumstances "
11819
"<application>puppet</application> will be used in a client/server "
11820
"configuration."
11821
msgstr ""
11822
11823
#: serverguide/C/remote-administration.xml:228(para)
11824
msgid ""
11825
"This section will cover installing and configuring "
11826
"<application>Puppet</application> in a client/server configuration. This "
11827
"simple example will demonstrate how to install "
11828
"<application>Apache</application> using <application>Puppet</application>."
11829
msgstr ""
11830
11831
#: serverguide/C/remote-administration.xml:234(title)
11832
msgid "Preconfiguration"
11833
msgstr ""
11834
11835
#: serverguide/C/remote-administration.xml:236(para)
11836
msgid ""
11837
"Prior to configuring <application>puppet</application> you may want to add a "
11838
"DNS <emphasis>CNAME</emphasis> record for "
11839
"<emphasis>puppet.example.com</emphasis>, where "
11840
"<emphasis>example.com</emphasis> is your domain. By default "
11841
"<application>Puppet</application> clients check DNS for puppet.example.com "
11842
"as the puppet server name, or <emphasis>Puppet Master</emphasis>. See <xref "
11843
"linkend=\"dns\"/> for more DNS details."
11844
msgstr ""
11845
11846
#: serverguide/C/remote-administration.xml:243(para)
11847
msgid ""
11848
"If you do not wish to use DNS, you can add entries to the server and client "
11849
"<filename>/etc/hosts</filename> file. For example, in the "
11850
"<application>Puppet</application> server's <filename>/etc/hosts</filename> "
11851
"file add:"
11852
msgstr ""
11853
11854
#: serverguide/C/remote-administration.xml:248(programlisting)
11855
#, no-wrap
11856
msgid ""
11857
"\n"
11858
"127.0.0.1 localhost.localdomain localhost puppet\n"
11859
"192.168.1.17 puppetclient.example.com puppetclient\n"
11860
msgstr ""
11861
11862
#: serverguide/C/remote-administration.xml:253(para)
11863
msgid ""
11864
"On each <application>Puppet</application> client, add an entry for the "
11865
"server:"
11866
msgstr ""
11867
11868
#: serverguide/C/remote-administration.xml:257(programlisting)
11869
#, no-wrap
11870
msgid ""
11871
"\n"
11872
"192.168.1.16 puppetmaster.example.com puppetmaster puppet\n"
11873
msgstr ""
11874
11875
#: serverguide/C/remote-administration.xml:262(para)
11876
msgid ""
11877
"Replace the example IP addresses and domain names above with your actual "
11878
"server and client addresses and domain names."
11879
msgstr ""
11880
11881
#: serverguide/C/remote-administration.xml:271(para)
11882
msgid ""
11883
"To install <application>Puppet</application>, in a terminal on the "
11884
"<emphasis>server</emphasis> enter:"
11885
msgstr ""
11886
11887
#: serverguide/C/remote-administration.xml:276(command)
11888
msgid "sudo apt install puppetmaster"
11889
msgstr ""
11890
11891
#: serverguide/C/remote-administration.xml:279(para)
11892
msgid "On the <emphasis>client</emphasis> machine, or machines, enter:"
11893
msgstr ""
11894
11895
#: serverguide/C/remote-administration.xml:284(command)
11896
msgid "sudo apt install puppet"
11897
msgstr ""
11898
11899
#: serverguide/C/remote-administration.xml:292(para)
11900
msgid "Create a folder path for the apache2 class:"
11901
msgstr ""
11902
11903
#: serverguide/C/remote-administration.xml:297(command)
11904
msgid "sudo mkdir -p /etc/puppet/modules/apache2/manifests"
11905
msgstr ""
11906
11907
#: serverguide/C/remote-administration.xml:300(para)
11908
msgid ""
11909
"Now setup some resources for <application>apache2</application>. Create a "
11910
"file <filename>/etc/puppet/modules/apache2/manifests/init.pp</filename> "
11911
"containing the following:"
11912
msgstr ""
11913
11914
#: serverguide/C/remote-administration.xml:306(programlisting)
11915
#, no-wrap
11916
msgid ""
11917
"\n"
11918
"class apache2 {\n"
11919
" package { 'apache2':\n"
11920
" ensure => installed,\n"
11921
" }\n"
11922
"\n"
11923
" service { 'apache2':\n"
11924
" ensure => true,\n"
11925
" enable => true,\n"
11926
" require => Package['apache2'],\n"
11927
" }\n"
11928
"}\n"
11929
msgstr ""
11930
11931
#: serverguide/C/remote-administration.xml:321(para)
11932
msgid ""
11933
"Next, create a node file <filename>/etc/puppet/manifests/site.pp</filename> "
11934
"with:"
11935
msgstr ""
11936
11937
#: serverguide/C/remote-administration.xml:325(programlisting)
11938
#, no-wrap
11939
msgid ""
11940
"\n"
11941
"node 'puppetclient.example.com' {\n"
11942
" include apache2\n"
11943
"}\n"
11944
msgstr ""
11945
11946
#: serverguide/C/remote-administration.xml:332(para)
11947
msgid ""
11948
"Replace <emphasis>puppetclient.example.com</emphasis> with your actual "
11949
"<application>Puppet</application> client's host name."
11950
msgstr ""
11951
11952
#: serverguide/C/remote-administration.xml:337(para)
11953
msgid ""
11954
"The final step for this simple <application>Puppet</application> server is "
11955
"to restart the daemon:"
11956
msgstr ""
11957
11958
#: serverguide/C/remote-administration.xml:342(command)
11959
msgid "sudo systemctl restart puppetmaster.service"
11960
msgstr ""
11961
11962
#: serverguide/C/remote-administration.xml:345(para)
11963
msgid ""
11964
"Now everything is configured on the <application>Puppet</application> "
11965
"server, it is time to configure the client."
11966
msgstr ""
11967
11968
#: serverguide/C/remote-administration.xml:349(para)
11969
msgid ""
11970
"First, configure the <application>Puppet</application> agent daemon to "
11971
"start. Edit <filename>/etc/default/puppet</filename>, changing "
11972
"<emphasis>START</emphasis> to yes:"
11973
msgstr ""
11974
11975
#: serverguide/C/remote-administration.xml:354(programlisting) serverguide/C/mail.xml:685(programlisting)
11976
#, no-wrap
11977
msgid ""
11978
"\n"
11979
"START=yes\n"
11980
msgstr ""
11981
11982
#: serverguide/C/remote-administration.xml:358(para)
11983
msgid "Then start the service:"
11984
msgstr ""
11985
11986
#: serverguide/C/remote-administration.xml:363(command)
11987
msgid "sudo systemctl start puppet.service"
11988
msgstr ""
11989
11990
#: serverguide/C/remote-administration.xml:366(para)
11991
msgid "View the client cert fingerprint"
11992
msgstr ""
11993
11994
#: serverguide/C/remote-administration.xml:371(command)
11995
msgid "sudo puppet agent --fingerprint"
11996
msgstr ""
11997
11998
#: serverguide/C/remote-administration.xml:375(para)
11999
msgid ""
12000
"Back on the <application>Puppet</application> server, view pending "
12001
"certificate signing requests:"
12002
msgstr ""
12003
12004
#: serverguide/C/remote-administration.xml:380(command)
12005
msgid "sudo puppet cert list"
12006
msgstr ""
12007
12008
#: serverguide/C/remote-administration.xml:383(para)
12009
msgid ""
12010
"On the <application>Puppet</application> server, verify the fingerprint of "
12011
"the client and sign puppetclient's cert:"
12012
msgstr ""
12013
12014
#: serverguide/C/remote-administration.xml:388(command)
12015
msgid "sudo puppet cert sign puppetclient.example.com"
12016
msgstr ""
12017
12018
#: serverguide/C/remote-administration.xml:391(para)
12019
msgid ""
12020
"On the <application>Puppet</application> client, run the puppet agent "
12021
"manually in the foreground. This step isn't strictly speaking necessary, but "
12022
"it is the best way to test and debug the puppet service."
12023
msgstr ""
12024
12025
#: serverguide/C/remote-administration.xml:397(command)
12026
msgid "sudo puppet agent --test"
12027
msgstr ""
12028
12029
#: serverguide/C/remote-administration.xml:400(para)
12030
msgid ""
12031
"Check <filename>/var/log/syslog</filename> on both hosts for any errors with "
12032
"the configuration. If all goes well the <application>apache2</application> "
12033
"package and it's dependencies will be installed on the "
12034
"<application>Puppet</application> client."
12035
msgstr ""
12036
12037
#: serverguide/C/remote-administration.xml:406(para)
12038
msgid ""
12039
"This example is <emphasis>very</emphasis> simple, and does not highlight "
12040
"many of <application>Puppet</application>'s features and benefits. For more "
12041
"information see <xref linkend=\"puppet-resources\"/>."
12042
msgstr ""
12043
12044
#: serverguide/C/remote-administration.xml:418(para)
12045
msgid ""
12046
"See the <ulink url=\"http://docs.puppetlabs.com/\">Official Puppet "
12047
"Documentation</ulink> web site."
12048
msgstr ""
12049
12050
#: serverguide/C/remote-administration.xml:423(para)
12051
msgid ""
12052
"See the <ulink url=\"http://forge.puppetlabs.com/\">Puppet forge</ulink>, "
12053
"online repository of puppet modules."
12054
msgstr ""
12055
12056
#: serverguide/C/remote-administration.xml:428(para)
12057
msgid ""
12058
"Also see <ulink url=\"http://www.apress.com/9781430230571\">Pro "
12059
"Puppet</ulink>."
12060
msgstr ""
12061
12062
#: serverguide/C/remote-administration.xml:438(title)
12063
msgid "Zentyal"
12064
msgstr ""
12065
12066
#: serverguide/C/remote-administration.xml:440(para)
12067
msgid ""
12068
"<application>Zentyal</application> is a Linux small business server that can "
12069
"be configured as a gateway, infrastructure manager, unified threat manager, "
12070
"office server, unified communication server or a combination of them. All "
12071
"network services managed by <application>Zentyal</application> are tightly "
12072
"integrated, automating most tasks. This saves time and helps to avoid errors "
12073
"in network configuration and administration. "
12074
"<application>Zentyal</application> is open source, released under the GNU "
12075
"General Public License (GPL) and runs on top of Ubuntu GNU/Linux."
12076
msgstr ""
12077
12078
#: serverguide/C/remote-administration.xml:451(para)
12079
msgid ""
12080
"<application>Zentyal</application> consists of a series of packages (usually "
12081
"one for each module) that provide a web interface to configure the different "
12082
"servers or services. The configuration is stored on a key-value "
12083
"<application>Redis</application> database, but users, groups, and domains-"
12084
"related configuration is on <application>OpenLDAP </application>. When you "
12085
"configure any of the available parameters through the web interface, final "
12086
"configuration files are overwritten using the configuration templates "
12087
"provided by the modules. The main advantage of using "
12088
"<application>Zentyal</application> is a unified, graphical user interface to "
12089
"configure all network services and high, out-of-the-box integration between "
12090
"them."
12091
msgstr ""
12092
12093
#: serverguide/C/remote-administration.xml:465(para)
12094
msgid ""
12095
"<application>Zentyal</application> publishes one major stable release once a "
12096
"year based on the latest Ubuntu LTS release."
12097
msgstr ""
12098
12099
#: serverguide/C/remote-administration.xml:473(para)
12100
msgid ""
12101
"If you would like to create a new user to access the "
12102
"<application>Zentyal</application> web interface, run: <screen>\n"
12103
"<command>sudo adduser username sudo</command>\n"
12104
"</screen>"
12105
msgstr ""
12106
12107
#: serverguide/C/remote-administration.xml:481(para)
12108
msgid ""
12109
"Add the <application>Zentyal</application> repository to your repository "
12110
"list: <screen>\n"
12111
"<command>sudo add-apt-repository \"deb http://archive.zentyal.org/zentyal "
12112
"3.5 main extra\"</command>\n"
12113
"</screen>"
12114
msgstr ""
12115
12116
#: serverguide/C/remote-administration.xml:488(para)
12117
msgid ""
12118
"Import the public keys from <application>Zentyal</application>: <screen>\n"
12119
"<command>sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys "
12120
"10E239FF</command>\n"
12121
"<command>wget -q http://keys.zentyal.org/zentyal-4.2-archive.asc -O- | sudo "
12122
"apt-key add -</command>\n"
12123
"</screen>"
12124
msgstr ""
12125
12126
#: serverguide/C/remote-administration.xml:496(para)
12127
msgid ""
12128
"Update your packages and install <application>Zentyal</application>: "
12129
"<screen>\n"
12130
"<command>sudo apt update</command>\n"
12131
"<command>sudo apt install zentyal</command>\n"
12132
"</screen> During installation you will be asked to set a root MySQL password "
12133
"and confirm port 443."
12134
msgstr ""
12135
12136
#: serverguide/C/remote-administration.xml:509(title)
12137
msgid "First steps"
12138
msgstr ""
12139
12140
#: serverguide/C/remote-administration.xml:511(para)
12141
msgid ""
12142
"Any system account belonging to the sudo group is allowed to log into the "
12143
"<application>Zentyal</application> web interface. The user created while "
12144
"installing Ubuntu Server will belong to the sudo group by default."
12145
msgstr ""
12146
12147
#: serverguide/C/remote-administration.xml:517(para)
12148
msgid ""
12149
"To access the <application>Zentyal</application> web interface, point a "
12150
"browser to https://localhost/ or to the IP address of your remote server. As "
12151
"<application>Zentyal</application> creates its own self-signed SSL "
12152
"certificate, you will have to accept a security exception on your browser. "
12153
"Log in with the same username and password used to log in to your server."
12154
msgstr ""
12155
12156
#: serverguide/C/remote-administration.xml:526(para)
12157
msgid ""
12158
"Once logged in you will see an overview of your server. Individual modules, "
12159
"such as Antivirus or Firewall, can be installed by simply clicking them and "
12160
"then clicking Install. Selecting server roles like Gateway or Infrastructure "
12161
"can be used to install multiple modules at once."
12162
msgstr ""
12163
12164
#: serverguide/C/remote-administration.xml:534(para)
12165
msgid ""
12166
"Modules can also be installed via the command line: <screen>\n"
12167
"<command>sudo apt install <zentyal-module></command>\n"
12168
"</screen> See the list of available modules below."
12169
msgstr ""
12170
12171
#: serverguide/C/remote-administration.xml:542(para)
12172
msgid ""
12173
"To enable a module, go to the Dashboard, then click Module Status. Click the "
12174
"check box for the module, then Save changes."
12175
msgstr ""
12176
12177
#: serverguide/C/remote-administration.xml:547(para)
12178
msgid ""
12179
"To configure any of the features of your installed modules, click the "
12180
"different sections on the left menu. When you make any changes, a red \"Save "
12181
"changes\" button appears in the upper right corner."
12182
msgstr ""
12183
12184
#: serverguide/C/remote-administration.xml:553(para)
12185
msgid ""
12186
"If you need to customize any configuration file or run certain actions "
12187
"(scripts or commands) to configure features not available on "
12188
"<application>Zentyal</application>, place the custom configuration file "
12189
"templates on /etc/zentyal/stubs/<module>/ and the hooks on "
12190
"/etc/zentyal/hooks/<module>.<action>. Read more about stubs and "
12191
"hooks <ulink "
12192
"url=\"https://wiki.zentyal.org/wiki/En/4.0/Appendix_B:_Development_and_advanc"
12193
"ed_configuration#Advanced_Service_Customization\">here</ulink>."
12194
msgstr ""
12195
12196
#: serverguide/C/remote-administration.xml:565(title)
12197
msgid "Modules"
12198
msgstr ""
12199
12200
#: serverguide/C/remote-administration.xml:572(para)
12201
msgid ""
12202
"zentyal-core & zentyal-common: the core of the "
12203
"<application>Zentyal</application> interface and the common libraries of the "
12204
"framework. Also includes the logs and events modules that give the "
12205
"administrator an interface to view the logs and generate events from them."
12206
msgstr ""
12207
12208
#: serverguide/C/remote-administration.xml:581(para)
12209
msgid ""
12210
"zentyal-network: manages the configuration of the network. From the "
12211
"interfaces (supporting static IP, DHCP, VLAN, bridges or PPPoE), to multiple "
12212
"gateways when having more than one Internet connection, load balancing and "
12213
"advanced routing, static routes or dynamic DNS."
12214
msgstr ""
12215
12216
#: serverguide/C/remote-administration.xml:589(para)
12217
msgid ""
12218
"zentyal-objects & zentyal-services: provide an abstraction level for "
12219
"network addresses (e.g. LAN instead of 192.168.1.0/24) and ports named as "
12220
"services (e.g. HTTP instead of 80/TCP)."
12221
msgstr ""
12222
12223
#: serverguide/C/remote-administration.xml:596(para)
12224
msgid ""
12225
"zentyal-firewall: configures the <application>iptables</application> rules "
12226
"to block forbiden connections, NAT and port redirections."
12227
msgstr ""
12228
12229
#: serverguide/C/remote-administration.xml:602(para)
12230
msgid ""
12231
"zentyal-ntp: installs the NTP daemon to keep server on time and allow "
12232
"network clients to synchronize their clocks against the server."
12233
msgstr ""
12234
12235
#: serverguide/C/remote-administration.xml:608(para)
12236
msgid ""
12237
"zentyal-dhcp: configures <application>ISC DHCP</application> server "
12238
"supporting network ranges, static leases and other advanced options like "
12239
"NTP, WINS, dynamic DNS updates and network boot with PXE."
12240
msgstr ""
12241
12242
#: serverguide/C/remote-administration.xml:615(para)
12243
msgid ""
12244
"zentyal-dns: brings <application>ISC Bind9</application> DNS server into "
12245
"your server for caching local queries as a forwarder or as an authoritative "
12246
"server for the configured domains. Allows to configure A, CNAME, MX, NS, TXT "
12247
"and SRV records."
12248
msgstr ""
12249
12250
#: serverguide/C/remote-administration.xml:623(para)
12251
msgid ""
12252
"zentyal-ca: integrates the management of a Certification Authority within "
12253
"Zentyal so users can use certificates to authenticate against the services, "
12254
"like with <application>OpenVPN</application>."
12255
msgstr ""
12256
12257
#: serverguide/C/remote-administration.xml:630(para)
12258
msgid ""
12259
"zentyal-openvpn: allows to configure multiple VPN servers and clients using "
12260
"<application>OpenVPN</application> with dynamic routing configuration using "
12261
"<application>Quagga</application>."
12262
msgstr ""
12263
12264
#: serverguide/C/remote-administration.xml:637(para)
12265
msgid ""
12266
"zentyal-users: provides an interface to configure and manage users and "
12267
"groups on <application>OpenLDAP</application>. Other services on Zentyal are "
12268
"authenticated against LDAP having a centralized users and groups management. "
12269
"It is also possible to synchronize users, passwords and groups from a "
12270
"<application>Microsoft Active Directory</application> domain."
12271
msgstr ""
12272
12273
#: serverguide/C/remote-administration.xml:647(para)
12274
msgid ""
12275
"zentyal-squid: configures <application>Squid</application> and "
12276
"<application>Dansguardian</application> for speeding up browsing thanks to "
12277
"the caching capabilities and content filtering."
12278
msgstr ""
12279
12280
#: serverguide/C/remote-administration.xml:654(para)
12281
msgid ""
12282
"zentyal-samba: allows <application>Samba</application> configuration and "
12283
"integration with existing LDAP. From the same interface you can define "
12284
"password policies, create shared resources and assign permissions."
12285
msgstr ""
12286
12287
#: serverguide/C/remote-administration.xml:662(para)
12288
msgid ""
12289
"zentyal-printers: integrates <application>CUPS</application> with "
12290
"<application>Samba</application> and allows not only to configure the "
12291
"printers but also give them permissions based on LDAP users and groups."
12292
msgstr ""
12293
12294
#: serverguide/C/remote-administration.xml:567(para)
12295
msgid ""
12296
"<application>Zentyal</application> 2.3 is available on Ubuntu 16.04 Universe "
12297
"repository. The modules available are: <placeholder-1/>"
12298
msgstr ""
12299
12300
#: serverguide/C/remote-administration.xml:673(para)
12301
msgid ""
12302
"Not present on Ubuntu Universe repositories, but on <ulink "
12303
"url=\"https://launchpad.net/~zentyal/\">Zentyal Team PPA</ulink> you will "
12304
"find these other modules:"
12305
msgstr ""
12306
12307
#: serverguide/C/remote-administration.xml:682(para)
12308
msgid ""
12309
"zentyal-antivirus: integrates <application>ClamAV</application> antivirus "
12310
"with other modules like the proxy, file sharing or mailfilter."
12311
msgstr ""
12312
12313
#: serverguide/C/remote-administration.xml:689(para)
12314
msgid ""
12315
"zentyal-asterisk: configures <application>Asterisk</application> to provide "
12316
"a simple PBX with LDAP based authentication."
12317
msgstr ""
12318
12319
#: serverguide/C/remote-administration.xml:695(para)
12320
msgid ""
12321
"zentyal-bwmonitor: allows to monitor bandwith usage of your LAN clients."
12322
msgstr ""
12323
12324
#: serverguide/C/remote-administration.xml:701(para)
12325
msgid ""
12326
"zentyal-captiveportal: integrates a captive portal with the firewall and "
12327
"LDAP users and groups."
12328
msgstr ""
12329
12330
#: serverguide/C/remote-administration.xml:707(para)
12331
msgid ""
12332
"zentyal-ebackup: allows to make scheduled backups of your server using the "
12333
"popular <application>duplicity</application> backup tool."
12334
msgstr ""
12335
12336
#: serverguide/C/remote-administration.xml:713(para)
12337
msgid "zentyal-ftp: configures a FTP server with LDAP based authentication."
12338
msgstr ""
12339
12340
#: serverguide/C/remote-administration.xml:718(para)
12341
msgid "zentyal-ids: integrates a network intrusion detection system."
12342
msgstr ""
12343
12344
#: serverguide/C/remote-administration.xml:723(para)
12345
msgid ""
12346
"zentyal-ipsec: allows to configure IPsec tunnels using "
12347
"<application>OpenSwan</application>."
12348
msgstr ""
12349
12350
#: serverguide/C/remote-administration.xml:729(para)
12351
msgid ""
12352
"zentyal-jabber: integrates <application>ejabberd</application> XMPP server "
12353
"with LDAP users and groups."
12354
msgstr ""
12355
12356
#: serverguide/C/remote-administration.xml:735(para)
12357
msgid ""
12358
"zentyal-thinclients: a <application>LTSP</application> based thin clients "
12359
"solution."
12360
msgstr ""
12361
12362
#: serverguide/C/remote-administration.xml:741(para)
12363
msgid ""
12364
"zentyal-mail: a full mail stack including <application>Postfix "
12365
"</application> and <application>Dovecot</application> with LDAP backend."
12366
msgstr ""
12367
12368
#: serverguide/C/remote-administration.xml:748(para)
12369
msgid ""
12370
"zentyal-mailfilter: configures <application>amavisd</application> with mail "
12371
"stack to filter spam and attached virus."
12372
msgstr ""
12373
12374
#: serverguide/C/remote-administration.xml:754(para)
12375
msgid ""
12376
"zentyal-monitor: integrates <application>collectd</application> to monitor "
12377
"server performance and running services."
12378
msgstr ""
12379
12380
#: serverguide/C/remote-administration.xml:760(para)
12381
msgid ""
12382
"zentyal-pptp: configures a <application>PPTP</application> VPN server."
12383
msgstr ""
12384
12385
#: serverguide/C/remote-administration.xml:765(para)
12386
msgid ""
12387
"zentyal-radius: integrates <application>FreeRADIUS</application> with LDAP "
12388
"users and groups."
12389
msgstr ""
12390
12391
#: serverguide/C/remote-administration.xml:771(para)
12392
msgid ""
12393
"zentyal-software: simple interface to manage installed "
12394
"<application>Zentyal</application> modules and system updates."
12395
msgstr ""
12396
12397
#: serverguide/C/remote-administration.xml:777(para)
12398
msgid ""
12399
"zentyal-trafficshaping: configures traffic limiting rules to do bandwidth "
12400
"throttling and improve latency."
12401
msgstr ""
12402
12403
#: serverguide/C/remote-administration.xml:783(para)
12404
msgid ""
12405
"zentyal-usercorner: allows users to edit their own LDAP attributes using a "
12406
"web browser."
12407
msgstr ""
12408
12409
#: serverguide/C/remote-administration.xml:789(para)
12410
msgid ""
12411
"zentyal-virt: simple interface to create and manage virtual machines based "
12412
"on <application>libvirt</application>."
12413
msgstr ""
12414
12415
#: serverguide/C/remote-administration.xml:795(para)
12416
msgid ""
12417
"zentyal-webmail: allows to access your mail using the popular "
12418
"<application>Roundcube</application> webmail."
12419
msgstr ""
12420
12421
#: serverguide/C/remote-administration.xml:801(para)
12422
msgid ""
12423
"zentyal-webserver: configures <application>Apache</application> webserver to "
12424
"host different sites on your machine."
12425
msgstr ""
12426
12427
#: serverguide/C/remote-administration.xml:807(para)
12428
msgid ""
12429
"zentyal-zarafa: integrates <application>Zarafa</application> groupware suite "
12430
"with <application>Zentyal</application> mail stack and LDAP."
12431
msgstr ""
12432
12433
#: serverguide/C/remote-administration.xml:821(para)
12434
msgid ""
12435
"<ulink url=\"http://doc.zentyal.org/\">Zentyal Official Documentation "
12436
"</ulink> page."
12437
msgstr ""
12438
12439
#: serverguide/C/remote-administration.xml:825(para)
12440
msgid ""
12441
"<ulink url=\"http://trac.zentyal.org/wiki/Documentation\">Zentyal Community "
12442
"Wiki</ulink>."
12443
msgstr ""
12444
12445
#: serverguide/C/remote-administration.xml:829(para)
12446
msgid ""
12447
"Visit the <ulink url=\"http://forum.zentyal.org/\">Zentyal forum </ulink> "
12448
"for community support, feedback, feature requests, etc."
12449
msgstr ""
12450
12451
#: serverguide/C/package-management.xml:11(title)
12452
msgid "Package Management"
12453
msgstr "Manajemen Paket"
12454
12455
#: serverguide/C/package-management.xml:12(para)
12456
msgid ""
12457
"Ubuntu features a comprehensive package management system for installing, "
12458
"upgrading, configuring, and removing software. In addition to providing "
12459
"access to an organized base of over 45,000 software packages for your Ubuntu "
12460
"computer, the package management facilities also feature dependency "
12461
"resolution capabilities and software update checking."
12462
msgstr ""
12463
12464
#: serverguide/C/package-management.xml:14(para)
12465
msgid ""
12466
"Several tools are available for interacting with Ubuntu's package management "
12467
"system, from simple command-line utilities which may be easily automated by "
12468
"system administrators, to a simple graphical interface which is easy to use "
12469
"by those new to Ubuntu."
12470
msgstr ""
12471
12472
#: serverguide/C/package-management.xml:19(para)
12473
msgid ""
12474
"Ubuntu's package management system is derived from the same system used by "
12475
"the Debian GNU/Linux distribution. The package files contain all of the "
12476
"necessary files, meta-data, and instructions to implement a particular "
12477
"functionality or software application on your Ubuntu computer."
12478
msgstr ""
12479
12480
#: serverguide/C/package-management.xml:22(para)
12481
msgid ""
12482
"Debian package files typically have the extension '.deb', and usually exist "
12483
"in <emphasis role=\"italics\">repositories</emphasis> which are collections "
12484
"of packages found on various media, such as CD-ROM discs, or online. "
12485
"Packages are normally in a pre-compiled binary format; thus installation is "
12486
"quick, and requires no compiling of software."
12487
msgstr ""
12488
12489
#: serverguide/C/package-management.xml:25(para)
12490
msgid ""
12491
"Many complex packages use <emphasis "
12492
"role=\"italics\">dependencies</emphasis>. Dependencies are additional "
12493
"packages required by the principal package in order to function properly. "
12494
"For example, the speech synthesis package "
12495
"<application>festival</application> depends upon the package "
12496
"<application>libasound2</application>, which is a package supplying the "
12497
"<application>ALSA</application> sound library needed for audio playback. In "
12498
"order for <application>festival</application> to function, it and all of its "
12499
"dependencies must be installed. The software management tools in Ubuntu will "
12500
"do this automatically."
12501
msgstr ""
12502
12503
#: serverguide/C/package-management.xml:30(title)
12504
msgid "dpkg"
12505
msgstr ""
12506
12507
#: serverguide/C/package-management.xml:32(para)
12508
msgid ""
12509
"<application>dpkg</application> is a package manager for "
12510
"<emphasis>Debian</emphasis>-based systems. It can install, remove, and build "
12511
"packages, but unlike other package management systems, it cannot "
12512
"automatically download and install packages or their dependencies. This "
12513
"section covers using <application>dpkg</application> to manage locally "
12514
"installed packages:"
12515
msgstr ""
12516
12517
#: serverguide/C/package-management.xml:41(para)
12518
msgid ""
12519
"To list all packages installed on the system, from a terminal prompt type:"
12520
msgstr ""
12521
12522
#: serverguide/C/package-management.xml:46(command)
12523
msgid "dpkg -l"
12524
msgstr ""
12525
12526
#: serverguide/C/package-management.xml:52(para)
12527
msgid ""
12528
"Depending on the amount of packages on your system, this can generate a "
12529
"large amount of output. Pipe the output through "
12530
"<application>grep</application> to see if a specific package is installed:"
12531
msgstr ""
12532
12533
#: serverguide/C/package-management.xml:58(command)
12534
msgid "dpkg -l | grep apache2"
12535
msgstr ""
12536
12537
#: serverguide/C/package-management.xml:61(para)
12538
msgid ""
12539
"Replace <emphasis>apache2</emphasis> with any package name, part of a "
12540
"package name, or other regular expression."
12541
msgstr ""
12542
12543
#: serverguide/C/package-management.xml:68(para)
12544
msgid ""
12545
"To list the files installed by a package, in this case the "
12546
"<application>ufw</application> package, enter:"
12547
msgstr ""
12548
12549
#: serverguide/C/package-management.xml:73(command)
12550
msgid "dpkg -L ufw"
12551
msgstr ""
12552
12553
#: serverguide/C/package-management.xml:79(para)
12554
msgid ""
12555
"If you are not sure which package installed a file, <application>dpkg -"
12556
"S</application> may be able to tell you. For example:"
12557
msgstr ""
12558
12559
#: serverguide/C/package-management.xml:85(command)
12560
msgid "dpkg -S /etc/host.conf"
12561
msgstr ""
12562
12563
#: serverguide/C/package-management.xml:86(computeroutput)
12564
#, no-wrap
12565
msgid "base-files: /etc/host.conf"
12566
msgstr ""
12567
12568
#: serverguide/C/package-management.xml:89(para)
12569
msgid ""
12570
"The output shows that the <filename>/etc/host.conf</filename> belongs to the "
12571
"<application>base-files</application> package."
12572
msgstr ""
12573
12574
#: serverguide/C/package-management.xml:94(para)
12575
msgid ""
12576
"Many files are automatically generated during the package install process, "
12577
"and even though they are on the filesystem, <command>dpkg -S</command> may "
12578
"not know which package they belong to."
12579
msgstr ""
12580
12581
#: serverguide/C/package-management.xml:103(para)
12582
msgid "You can install a local <emphasis>.deb</emphasis> file by entering:"
12583
msgstr ""
12584
12585
#: serverguide/C/package-management.xml:108(command)
12586
msgid "sudo dpkg -i zip_3.0-4_i386.deb"
12587
msgstr ""
12588
12589
#: serverguide/C/package-management.xml:111(para)
12590
msgid ""
12591
"Change <filename>zip_3.0-4_i386.deb</filename> to the actual file name of "
12592
"the local .deb file you wish to install."
12593
msgstr ""
12594
12595
#: serverguide/C/package-management.xml:118(para)
12596
msgid "Uninstalling a package can be accomplished by:"
12597
msgstr ""
12598
12599
#: serverguide/C/package-management.xml:123(command)
12600
msgid "sudo dpkg -r zip"
12601
msgstr ""
12602
12603
#: serverguide/C/package-management.xml:127(para)
12604
msgid ""
12605
"Uninstalling packages using <application>dpkg</application>, in most cases, "
12606
"is <emphasis>NOT</emphasis> recommended. It is better to use a package "
12607
"manager that handles dependencies to ensure that the system is in a "
12608
"consistent state. For example using <command>dpkg -r zip</command> will "
12609
"remove the <application>zip</application> package, but any packages that "
12610
"depend on it will still be installed and may no longer function correctly."
12611
msgstr ""
12612
12613
#: serverguide/C/package-management.xml:138(para)
12614
msgid ""
12615
"For more <application>dpkg</application> options see the man page: "
12616
"<command>man dpkg</command>."
12617
msgstr ""
12618
12619
#: serverguide/C/package-management.xml:144(title)
12620
msgid "Apt"
12621
msgstr ""
12622
12623
#: serverguide/C/package-management.xml:145(para)
12624
msgid ""
12625
"The <application>apt</application> command is a powerful command-line tool, "
12626
"which works with Ubuntu's <emphasis>Advanced Packaging Tool</emphasis> (APT) "
12627
"performing such functions as installation of new software packages, upgrade "
12628
"of existing software packages, updating of the package list index, and even "
12629
"upgrading the entire Ubuntu system."
12630
msgstr ""
12631
12632
#: serverguide/C/package-management.xml:148(para)
12633
msgid ""
12634
"Being a simple command-line tool, <application>apt</application> has "
12635
"numerous advantages over other package management tools available in Ubuntu "
12636
"for server administrators. Some of these advantages include ease of use over "
12637
"simple terminal connections (SSH), and the ability to be used in system "
12638
"administration scripts, which can in turn be automated by the "
12639
"<application>cron</application> scheduling utility."
12640
msgstr ""
12641
12642
#: serverguide/C/package-management.xml:155(para)
12643
msgid ""
12644
"<emphasis role=\"bold\">Install a Package</emphasis>: Installation of "
12645
"packages using the <application>apt</application> tool is quite simple. For "
12646
"example, to install the network scanner <application>nmap</application>, "
12647
"type the following: <screen>\n"
12648
"<command>sudo apt install nmap</command>\n"
12649
"</screen>"
12650
msgstr ""
12651
12652
#: serverguide/C/package-management.xml:163(para)
12653
msgid ""
12654
"<emphasis role=\"bold\">Remove a Package</emphasis>: Removal of a package "
12655
"(or packages) is also straightforward. To remove the package installed in "
12656
"the previous example, type the following: <screen>\n"
12657
"<command>sudo apt remove nmap</command>\n"
12658
"</screen>"
12659
msgstr ""
12660
12661
#: serverguide/C/package-management.xml:170(para)
12662
msgid ""
12663
"<emphasis role=\"bold\">Multiple Packages</emphasis>: You may specify "
12664
"multiple packages to be installed or removed, separated by spaces."
12665
msgstr ""
12666
"<emphasis role=\"bold\">Banyak Paket</emphasis>: Anda dapat sekaligus "
12667
"menginstal atau menghapus banyak paket, dengan dipisahkan oleh spasi."
12668
12669
#: serverguide/C/package-management.xml:173(para)
12670
msgid ""
12671
"Also, adding the <emphasis>--purge</emphasis> option to <command>apt "
12672
"remove</command> will remove the package configuration files as well. This "
12673
"may or may not be the desired effect, so use with caution."
12674
msgstr ""
12675
12676
#: serverguide/C/package-management.xml:179(para)
12677
msgid ""
12678
"<emphasis role=\"bold\">Update the Package Index</emphasis>: The APT package "
12679
"index is essentially a database of available packages from the repositories "
12680
"defined in the <filename>/etc/apt/sources.list</filename> file and in the "
12681
"<filename>/etc/apt/sources.list.d</filename> directory. To update the local "
12682
"package index with the latest changes made in the repositories, type the "
12683
"following: <screen>\n"
12684
"<command>sudo apt update</command>\n"
12685
"</screen>"
12686
msgstr ""
12687
12688
#: serverguide/C/package-management.xml:187(para)
12689
msgid ""
12690
"<emphasis role=\"bold\">Upgrade Packages</emphasis>: Over time, updated "
12691
"versions of packages currently installed on your computer may become "
12692
"available from the package repositories (for example security updates). To "
12693
"upgrade your system, first update your package index as outlined above, and "
12694
"then type: <screen>\n"
12695
"<command>sudo apt upgrade</command>\n"
12696
"</screen>"
12697
msgstr ""
12698
12699
#: serverguide/C/package-management.xml:193(para)
12700
msgid ""
12701
"For information on upgrading to a new Ubuntu release see <xref "
12702
"linkend=\"installing-upgrading\"/>."
12703
msgstr ""
12704
12705
#: serverguide/C/package-management.xml:151(para)
12706
msgid ""
12707
"Some examples of popular uses for the <application>apt</application> "
12708
"utility: <placeholder-1/>"
12709
msgstr ""
12710
12711
#: serverguide/C/package-management.xml:199(para)
12712
msgid ""
12713
"Actions of the <application>apt</application> command, such as installation "
12714
"and removal of packages, are logged in the /var/log/dpkg.log log file."
12715
msgstr ""
12716
12717
#: serverguide/C/package-management.xml:202(para)
12718
msgid ""
12719
"For further information about the use of <application>APT</application>, "
12720
"read the comprehensive <ulink url=\"http://www.debian.org/doc/user-"
12721
"manuals#apt-howto\">Debian APT User Manual</ulink> or type: <screen>\n"
12722
"<command>apt help</command>\n"
12723
"</screen>"
12724
msgstr ""
12725
12726
#: serverguide/C/package-management.xml:210(title)
12727
msgid "Aptitude"
12728
msgstr "Aptitude"
12729
12730
#: serverguide/C/package-management.xml:211(para)
12731
msgid ""
12732
"Launching <application>Aptitude</application> with no command-line options, "
12733
"will give you a menu-driven, text-based front-end to the <emphasis>Advanced "
12734
"Packaging Tool</emphasis> (APT) system. Many of the common package "
12735
"management functions, such as installation, removal, and upgrade, can be "
12736
"performed in <application>Aptitude</application> with single-key commands, "
12737
"which are typically lowercase letters."
12738
msgstr ""
12739
12740
#: serverguide/C/package-management.xml:214(para)
12741
msgid ""
12742
"<application>Aptitude</application> is best suited for use in a non-"
12743
"graphical terminal environment to ensure proper functioning of the command "
12744
"keys. You may start the menu-driven interface of "
12745
"<application>Aptitude</application> as a normal user by typing the following "
12746
"command at a terminal prompt: <screen>\n"
12747
"<command>sudo aptitude</command>\n"
12748
"</screen>"
12749
msgstr ""
12750
12751
#: serverguide/C/package-management.xml:220(para)
12752
msgid ""
12753
"When <application>Aptitude</application> starts, you will see a menu bar at "
12754
"the top of the screen and two panes below the menu bar. The top pane "
12755
"contains package categories, such as <emphasis>New Packages</emphasis> and "
12756
"<emphasis>Not Installed Packages</emphasis>. The bottom pane contains "
12757
"information related to the packages and package categories."
12758
msgstr ""
12759
12760
#: serverguide/C/package-management.xml:223(para)
12761
msgid ""
12762
"Using <application>Aptitude</application> for package management is "
12763
"relatively straightforward, and the user interface makes common tasks simple "
12764
"to perform. The following are examples of common package management "
12765
"functions as performed in <application>Aptitude</application>:"
12766
msgstr ""
12767
12768
#: serverguide/C/package-management.xml:227(para)
12769
msgid ""
12770
"<emphasis role=\"bold\">Install Packages</emphasis>: To install a package, "
12771
"locate the package via the <emphasis>Not Installed Packages</emphasis> "
12772
"package category, by using the keyboard arrow keys and the "
12773
"<keycap>ENTER</keycap> key. Highlight the desired package, then press the "
12774
"<keycap>+</keycap> key. The package entry should turn "
12775
"<emphasis>green</emphasis>, indicating that it has been marked for "
12776
"installation. Now press <keycap>g</keycap> to be presented with a summary of "
12777
"package actions. Press <keycap>g</keycap> again, and downloading and "
12778
"installation of the package will commence. When finished, press "
12779
"<keycap>ENTER</keycap>, to return to the menu."
12780
msgstr ""
12781
12782
#: serverguide/C/package-management.xml:237(para)
12783
msgid ""
12784
"<emphasis role=\"bold\">Remove Packages</emphasis>: To remove a package, "
12785
"locate the package via the <emphasis role=\"italics\">Installed "
12786
"Packages</emphasis> package category, by using the keyboard arrow keys and "
12787
"the <keycap>ENTER</keycap> key. Highlight the desired package you wish to "
12788
"remove, then press the <keycap>-</keycap> key. The package entry should turn "
12789
"<emphasis role=\"italics\">pink</emphasis>, indicating it has been marked "
12790
"for removal. Now press <keycap>g</keycap> to be presented with a summary of "
12791
"package actions. Press <keycap>g</keycap> again, and removal of the package "
12792
"will commence. When finished, press <keycap>ENTER</keycap>, to return to the "
12793
"menu."
12794
msgstr ""
12795
12796
#: serverguide/C/package-management.xml:247(para)
12797
msgid ""
12798
"<emphasis role=\"bold\">Update Package Index</emphasis>: To update the "
12799
"package index, simply press the <keycap>u</keycap> key. Updating of the "
12800
"package index will commence."
12801
msgstr ""
12802
12803
#: serverguide/C/package-management.xml:252(para)
12804
msgid ""
12805
"<emphasis role=\"bold\">Upgrade Packages</emphasis>: To upgrade packages, "
12806
"perform the update of the package index as detailed above, and then press "
12807
"the <keycap>U</keycap> key to mark all packages with updates. Now press "
12808
"<keycap>g</keycap> whereby you'll be presented with a summary of package "
12809
"actions. Press <keycap>g</keycap> again, and the download and installation "
12810
"will commence. When finished, press <keycap>ENTER</keycap>, to return to the "
12811
"menu."
12812
msgstr ""
12813
12814
#: serverguide/C/package-management.xml:263(para)
12815
msgid "<emphasis role=\"bold\">i</emphasis>: Installed package"
12816
msgstr "<emphasis role=\"bold\">i</emphasis>: Paket Terinstall"
12817
12818
#: serverguide/C/package-management.xml:268(para)
12819
msgid ""
12820
"<emphasis role=\"bold\">c</emphasis>: Package not installed, but package "
12821
"configuration remains on system"
12822
msgstr ""
12823
"<emphasis role=\"bold\">c</emphasis>: Paket tidak diinstal, tetapi "
12824
"konfigurasi paket tetap ada pada sisten"
12825
12826
#: serverguide/C/package-management.xml:272(para)
12827
msgid "<emphasis role=\"bold\">p</emphasis>: Purged from system"
12828
msgstr "<emphasis role=\"bold\">p</emphasis>: Bersihkan dari sistem"
12829
12830
#: serverguide/C/package-management.xml:276(para)
12831
msgid "<emphasis role=\"bold\">v</emphasis>: Virtual package"
12832
msgstr "<emphasis role=\"bold\">v</emphasis>: paket Maya"
12833
12834
#: serverguide/C/package-management.xml:280(para)
12835
msgid "<emphasis role=\"bold\">B</emphasis>: Broken package"
12836
msgstr "<emphasis role=\"bold\">B</emphasis>: paket Patah"
12837
12838
#: serverguide/C/package-management.xml:284(para)
12839
msgid ""
12840
"<emphasis role=\"bold\">u</emphasis>: Unpacked files, but package not yet "
12841
"configured"
12842
msgstr ""
12843
"<emphasis role=\"bold\">u</emphasis>: Berkas belum dibongkar, tetapi paket "
12844
"belum dikonfigurasi"
12845
12846
#: serverguide/C/package-management.xml:288(para)
12847
msgid ""
12848
"<emphasis role=\"bold\">C</emphasis>: Half-configured - Configuration failed "
12849
"and requires fix"
12850
msgstr ""
12851
"<emphasis role=\"bold\">C</emphasis>: Setengah terkonfigurasi - Konfigurasi "
12852
"gagal dan butuh perbaikan"
12853
12854
#: serverguide/C/package-management.xml:292(para)
12855
msgid ""
12856
"<emphasis role=\"bold\">H</emphasis>: Half-installed - Removal failed and "
12857
"requires fix"
12858
msgstr ""
12859
"<emphasis role=\"bold\">C</emphasis>: Setengah terkonfigurasi - Penghapusan "
12860
"gagal dan perlu perbaikan"
12861
12862
#: serverguide/C/package-management.xml:260(para)
12863
msgid ""
12864
"The first column of information displayed in the package list in the top "
12865
"pane, when actually viewing packages lists the current state of the package, "
12866
"and uses the following key to describe the state of the package: "
12867
"<placeholder-1/>"
12868
msgstr ""
12869
12870
#: serverguide/C/package-management.xml:298(para)
12871
msgid ""
12872
"To exit Aptitude, simply press the <keycap>q</keycap> key and confirm you "
12873
"wish to exit. Many other functions are available from the Aptitude menu by "
12874
"pressing the <keycap>F10</keycap> key."
12875
msgstr ""
12876
"Untuk keluar dari Aptitude, silahkan tekan tombol <keycap>q</keycap> dan "
12877
"konfirmasikan jika anda ingin keluar. Banyak fungsi yang tersedia pada menu "
12878
"Aptitude dengan menekan tombol <keycap>F10</keycap>"
12879
12880
#: serverguide/C/package-management.xml:301(title)
12881
msgid "Command Line Aptitude"
12882
msgstr ""
12883
12884
#: serverguide/C/package-management.xml:302(para)
12885
msgid ""
12886
"You can also use <application>Aptitude</application> as a command-line tool, "
12887
"similar to <application>apt</application>. To install the "
12888
"<application>nmap</application> package with all necessary dependencies, as "
12889
"in the <application>apt</application> example, you would use the following "
12890
"command: <screen>\n"
12891
"<command>sudo aptitude install nmap</command>\n"
12892
"</screen> To remove the same package, you would use the command: <screen>\n"
12893
"<command>sudo aptitude remove nmap</command>\n"
12894
"</screen> Consult the <application>man</application> pages for more details "
12895
"of command line options for <application>Aptitude</application>."
12896
msgstr ""
12897
12898
#: serverguide/C/package-management.xml:315(title)
12899
msgid "Automatic Updates"
12900
msgstr ""
12901
12902
#: serverguide/C/package-management.xml:317(para)
12903
msgid ""
12904
"The <application>unattended-upgrades</application> package can be used to "
12905
"automatically install updated packages, and can be configured to update all "
12906
"packages or just install security updates. First, install the package by "
12907
"entering the following in a terminal:"
12908
msgstr ""
12909
12910
#: serverguide/C/package-management.xml:323(command)
12911
msgid "sudo apt install unattended-upgrades"
12912
msgstr ""
12913
12914
#: serverguide/C/package-management.xml:326(para)
12915
msgid ""
12916
"To configure <application>unattended-upgrades</application>, edit "
12917
"<filename>/etc/apt/apt.conf.d/50unattended-upgrades</filename> and adjust "
12918
"the following to fit your needs:"
12919
msgstr ""
12920
12921
#: serverguide/C/package-management.xml:331(programlisting)
12922
#, no-wrap
12923
msgid ""
12924
"\n"
12925
"Unattended-Upgrade::Allowed-Origins {\n"
12926
" \"${distro_id}:${distro_codename}\";\n"
12927
" \"${distro_id}:${distro_codename}-security\";\n"
12928
"// \"${distro_id}:${distro_codename}-updates\";\n"
12929
"// \"${distro_id}:${distro_codename}-proposed\";\n"
12930
"// \"${distro_id}:${distro_codename}-backports\";\n"
12931
"};\n"
12932
msgstr ""
12933
12934
#: serverguide/C/package-management.xml:341(para)
12935
msgid ""
12936
"Certain packages can also be <emphasis>blacklisted</emphasis> and therefore "
12937
"will not be automatically updated. To blacklist a package, add it to the "
12938
"list:"
12939
msgstr ""
12940
12941
#: serverguide/C/package-management.xml:346(programlisting)
12942
#, no-wrap
12943
msgid ""
12944
"\n"
12945
"Unattended-Upgrade::Package-Blacklist {\n"
12946
"// \"vim\";\n"
12947
"// \"libc6\";\n"
12948
"// \"libc6-dev\";\n"
12949
"// \"libc6-i686\";\n"
12950
"};\n"
12951
msgstr ""
12952
12953
#: serverguide/C/package-management.xml:356(para)
12954
msgid ""
12955
"The double <emphasis><quote>//</quote></emphasis> serve as comments, so "
12956
"whatever follows \"//\" will not be evaluated."
12957
msgstr ""
12958
12959
#: serverguide/C/package-management.xml:361(para)
12960
msgid ""
12961
"To enable automatic updates, edit <filename>/etc/apt/apt.conf.d/20auto-"
12962
"upgrades</filename> and set the appropriate <application>apt</application> "
12963
"configuration options:"
12964
msgstr ""
12965
12966
#: serverguide/C/package-management.xml:365(programlisting)
12967
#, no-wrap
12968
msgid ""
12969
"\n"
12970
"APT::Periodic::Update-Package-Lists \"1\";\n"
12971
"APT::Periodic::Download-Upgradeable-Packages \"1\";\n"
12972
"APT::Periodic::AutocleanInterval \"7\";\n"
12973
"APT::Periodic::Unattended-Upgrade \"1\";\n"
12974
msgstr ""
12975
12976
#: serverguide/C/package-management.xml:372(para)
12977
msgid ""
12978
"The above configuration updates the package list, downloads, and installs "
12979
"available upgrades every day. The local download archive is cleaned every "
12980
"week. On servers upgraded to newer versions of Ubuntu, depending on your "
12981
"responses, the file listed above may not be there. In this case, creating a "
12982
"new file of this name should also work."
12983
msgstr ""
12984
12985
#: serverguide/C/package-management.xml:380(para)
12986
msgid ""
12987
"You can read more about <application>apt</application> Periodic "
12988
"configuration options in the <filename>/etc/cron.daily/apt</filename> script "
12989
"header."
12990
msgstr ""
12991
12992
#: serverguide/C/package-management.xml:385(para)
12993
msgid ""
12994
"The results of <application>unattended-upgrades</application> will be logged "
12995
"to <filename>/var/log/unattended-upgrades</filename>."
12996
msgstr ""
12997
12998
#: serverguide/C/package-management.xml:390(title)
12999
msgid "Notifications"
13000
msgstr ""
13001
13002
#: serverguide/C/package-management.xml:392(para)
13003
msgid ""
13004
"Configuring <emphasis>Unattended-Upgrade::Mail</emphasis> in "
13005
"<filename>/etc/apt/apt.conf.d/50unattended-upgrades</filename> will enable "
13006
"<application>unattended-upgrades</application> to email an administrator "
13007
"detailing any packages that need upgrading or have problems."
13008
msgstr ""
13009
13010
#: serverguide/C/package-management.xml:397(para)
13011
msgid ""
13012
"Another useful package is <application>apticron</application>. "
13013
"<application>apticron</application> will configure a "
13014
"<application>cron</application> job to email an administrator information "
13015
"about any packages on the system that have updates available, as well as a "
13016
"summary of changes in each package."
13017
msgstr ""
13018
13019
#: serverguide/C/package-management.xml:403(para)
13020
msgid ""
13021
"To install the <application>apticron</application> package, in a terminal "
13022
"enter:"
13023
msgstr ""
13024
13025
#: serverguide/C/package-management.xml:408(command)
13026
msgid "sudo apt install apticron"
13027
msgstr ""
13028
13029
#: serverguide/C/package-management.xml:411(para)
13030
msgid ""
13031
"Once the package is installed edit "
13032
"<filename>/etc/apticron/apticron.conf</filename>, to set the email address "
13033
"and other options:"
13034
msgstr ""
13035
13036
#: serverguide/C/package-management.xml:415(programlisting)
13037
#, no-wrap
13038
msgid ""
13039
"\n"
13040
"EMAIL=\"root@example.com\"\n"
13041
msgstr ""
13042
13043
#: serverguide/C/package-management.xml:424(para)
13044
msgid ""
13045
"Configuration of the <emphasis>Advanced Packaging Tool</emphasis> (APT) "
13046
"system repositories is stored in the "
13047
"<filename>/etc/apt/sources.list</filename> file and the "
13048
"<filename>/etc/apt/sources.list.d</filename> directory. An example of this "
13049
"file is referenced here, along with information on adding or removing "
13050
"repository references from the file."
13051
msgstr ""
13052
13053
#: serverguide/C/package-management.xml:429(para)
13054
msgid ""
13055
"You may edit the file to enable repositories or disable them. For example, "
13056
"to disable the requirement of inserting the Ubuntu CD-ROM whenever package "
13057
"operations occur, simply comment out the appropriate line for the CD-ROM, "
13058
"which appears at the top of the file:"
13059
msgstr ""
13060
"Anda dapat menyunting berkas tersebut untuk mengaktifkan atau menonaktifkan "
13061
"repositori. Sebagai contoh, untuk menonaktifkan keperluan akan CD-ROM Ubuntu "
13062
"setiap kali instalasi paket, silakan komentari baris yang memuat CD-ROM "
13063
"tersebut, biasanya ada dibagian atas berkas:"
13064
13065
#: serverguide/C/package-management.xml:434(screen)
13066
#, no-wrap
13067
msgid ""
13068
"\n"
13069
"# no more prompting for CD-ROM please\n"
13070
"# deb cdrom:[Ubuntu 16.04 _Xenial Xerus_ - Release i386 (20111013.1)]/ "
13071
"xenial main restricted\n"
13072
msgstr ""
13073
13074
#: serverguide/C/package-management.xml:440(title)
13075
msgid "Extra Repositories"
13076
msgstr "Gudang Tambahan"
13077
13078
#: serverguide/C/package-management.xml:441(para)
13079
msgid ""
13080
"In addition to the officially supported package repositories available for "
13081
"Ubuntu, there exist additional community-maintained repositories which add "
13082
"thousands more packages for potential installation. Two of the most popular "
13083
"are the <emphasis>Universe</emphasis> and <emphasis>Multiverse</emphasis> "
13084
"repositories. These repositories are not officially supported by Ubuntu, but "
13085
"because they are maintained by the community they generally provide packages "
13086
"which are safe for use with your Ubuntu computer."
13087
msgstr ""
13088
13089
#: serverguide/C/package-management.xml:444(para)
13090
msgid ""
13091
"Packages in the <emphasis>Multiverse</emphasis> repository often have "
13092
"licensing issues that prevent them from being distributed with a free "
13093
"operating system, and they may be illegal in your locality."
13094
msgstr ""
13095
13096
#: serverguide/C/package-management.xml:446(para)
13097
msgid ""
13098
"Be advised that neither the <emphasis>Universe</emphasis> or "
13099
"<emphasis>Multiverse</emphasis> repositories contain officially supported "
13100
"packages. In particular, there may not be security updates for these "
13101
"packages."
13102
msgstr ""
13103
13104
#: serverguide/C/package-management.xml:450(para)
13105
msgid ""
13106
"Many other package sources are available, sometimes even offering only one "
13107
"package, as in the case of package sources provided by the developer of a "
13108
"single application. You should always be very careful and cautious when "
13109
"using non-standard package sources, however. Research the source and "
13110
"packages carefully before performing any installation, as some package "
13111
"sources and their packages could render your system unstable or non-"
13112
"functional in some respects."
13113
msgstr ""
13114
13115
#: serverguide/C/package-management.xml:453(para)
13116
msgid ""
13117
"By default, the <emphasis>Universe</emphasis> and "
13118
"<emphasis>Multiverse</emphasis> repositories are enabled but if you would "
13119
"like to disable them edit <filename>/etc/apt/sources.list</filename> and "
13120
"comment the following lines:"
13121
msgstr ""
13122
13123
#: serverguide/C/package-management.xml:460(programlisting)
13124
#, no-wrap
13125
msgid ""
13126
"\n"
13127
"deb http://archive.ubuntu.com/ubuntu xenial universe multiverse\n"
13128
"deb-src http://archive.ubuntu.com/ubuntu xenial universe multiverse\n"
13129
"\n"
13130
"deb http://us.archive.ubuntu.com/ubuntu/ xenial universe\n"
13131
"deb-src http://us.archive.ubuntu.com/ubuntu/ xenial universe\n"
13132
"deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates universe\n"
13133
"deb-src http://us.archive.ubuntu.com/ubuntu/ xenial-updates universe\n"
13134
"\n"
13135
"deb http://us.archive.ubuntu.com/ubuntu/ xenial multiverse\n"
13136
"deb-src http://us.archive.ubuntu.com/ubuntu/ xenial multiverse\n"
13137
"deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates multiverse\n"
13138
"deb-src http://us.archive.ubuntu.com/ubuntu/ xenial-updates multiverse\n"
13139
"\n"
13140
"deb http://security.ubuntu.com/ubuntu xenial-security universe\n"
13141
"deb-src http://security.ubuntu.com/ubuntu xenial-security universe\n"
13142
"deb http://security.ubuntu.com/ubuntu xenial-security multiverse\n"
13143
"deb-src http://security.ubuntu.com/ubuntu xenial-security multiverse\n"
13144
msgstr ""
13145
13146
#: serverguide/C/package-management.xml:486(para)
13147
msgid ""
13148
"Most of the material covered in this chapter is available in "
13149
"<application>man</application> pages, many of which are available online."
13150
msgstr ""
13151
13152
#: serverguide/C/package-management.xml:493(para)
13153
msgid ""
13154
"The <ulink "
13155
"url=\"https://help.ubuntu.com/community/InstallingSoftware\">InstallingSoftwa"
13156
"re</ulink> Ubuntu wiki page has more information."
13157
msgstr ""
13158
13159
#: serverguide/C/package-management.xml:498(para)
13160
msgid ""
13161
"For more <application>dpkg</application> details see the <ulink "
13162
"url=\"http://manpages.ubuntu.com/manpages/xenial/en/man1/dpkg.1.html\">dpkg "
13163
"man page</ulink>."
13164
msgstr ""
13165
13166
#: serverguide/C/package-management.xml:504(para)
13167
msgid ""
13168
"The <ulink url=\"http://www.debian.org/doc/manuals/apt-howto/\">APT "
13169
"HOWTO</ulink> and <ulink "
13170
"url=\"http://manpages.ubuntu.com/manpages/xenial/en/man8/apt.8.html\">apt "
13171
"man page</ulink> contain useful information regarding "
13172
"<application>apt</application> usage."
13173
msgstr ""
13174
13175
#: serverguide/C/package-management.xml:511(para)
13176
msgid ""
13177
"See the <ulink "
13178
"url=\"http://manpages.ubuntu.com/manpages/xenial/man8/aptitude.8.html\">aptit"
13179
"ude man page</ulink> for more <application>aptitude</application> options."
13180
msgstr ""
13181
13182
#: serverguide/C/package-management.xml:517(para)
13183
msgid ""
13184
"The <ulink "
13185
"url=\"https://help.ubuntu.com/community/Repositories/Ubuntu\">Adding "
13186
"Repositories HOWTO (Ubuntu Wiki)</ulink> page contains more details on "
13187
"adding repositories."
13188
msgstr ""
13189
13190
#: serverguide/C/other-apps.xml:11(title)
13191
msgid "Other Useful Applications"
13192
msgstr ""
13193
13194
#: serverguide/C/other-apps.xml:13(para)
13195
msgid ""
13196
"There are many very useful applications developed by the Ubuntu Server Team, "
13197
"and others that are well integrated with Ubuntu Server Edition, that might "
13198
"not be well known. This chapter will showcase some useful applications that "
13199
"can make administering an Ubuntu server, or many Ubuntu servers, that much "
13200
"easier."
13201
msgstr ""
13202
13203
#: serverguide/C/other-apps.xml:21(title)
13204
msgid "pam_motd"
13205
msgstr ""
13206
13207
#: serverguide/C/other-apps.xml:23(para)
13208
msgid ""
13209
"When logging into an Ubuntu server you may have noticed the informative "
13210
"Message Of The Day (MOTD). This information is obtained and displayed using "
13211
"a couple of packages:"
13212
msgstr ""
13213
13214
#: serverguide/C/other-apps.xml:30(para)
13215
msgid ""
13216
"<emphasis>landscape-common:</emphasis> provides the core libraries of "
13217
"<application>landscape-client</application>, which is needed to manage "
13218
"systems with <ulink "
13219
"url=\"http://landscape.canonical.com/\">Landscape</ulink> (proprietary). Yet "
13220
"the package also includes the <application>landscape-sysinfo</application> "
13221
"utility which is responsible for displaying core system data involving cpu, "
13222
"memory, disk space, etc. For instance:"
13223
msgstr ""
13224
13225
#: serverguide/C/other-apps.xml:37(computeroutput)
13226
#, no-wrap
13227
msgid ""
13228
"\n"
13229
"\t System load: 0.0 Processes: 76\n"
13230
"\t Usage of /: 30.2% of 3.11GB Users logged in: 1\n"
13231
"\t Memory usage: 20% IP address for eth0: 10.153.107.115\n"
13232
"\t Swap usage: 0%\n"
13233
"\n"
13234
"\t Graph this data and manage this system at "
13235
"https://landscape.canonical.com/\n"
13236
msgstr ""
13237
13238
#: serverguide/C/other-apps.xml:48(para)
13239
msgid "You can run landscape-sysinfo manually at any time."
13240
msgstr ""
13241
13242
#: serverguide/C/other-apps.xml:55(para)
13243
msgid ""
13244
"<emphasis>update-notifier-common:</emphasis> provides information on "
13245
"available package updates, impending filesystem checks (fsck), and required "
13246
"reboots (e.g.: after a kernel upgrade)."
13247
msgstr ""
13248
13249
#: serverguide/C/other-apps.xml:61(para)
13250
msgid ""
13251
"<application>pam_motd</application> executes the scripts in "
13252
"<filename>/etc/update-motd.d</filename> in order based on the number "
13253
"prepended to the script. The output of the scripts is written to "
13254
"<filename>/var/run/motd</filename>, keeping the numerical order, then "
13255
"concatenated with <filename>/etc/motd.tail</filename>."
13256
msgstr ""
13257
13258
#: serverguide/C/other-apps.xml:67(para)
13259
msgid ""
13260
"You can add your own dynamic information to the MOTD. For example, to add "
13261
"local weather information:"
13262
msgstr ""
13263
13264
#: serverguide/C/other-apps.xml:73(para)
13265
msgid "First, install the <application>weather-util</application> package:"
13266
msgstr ""
13267
13268
#: serverguide/C/other-apps.xml:78(command)
13269
msgid "sudo apt install weather-util"
13270
msgstr ""
13271
13272
#: serverguide/C/other-apps.xml:83(para)
13273
msgid ""
13274
"The <application>weather</application> utility uses METAR data from the "
13275
"National Oceanic and Atmospheric Administration and forecasts from the "
13276
"National Weather Service. In order to find local information you will need "
13277
"the 4-character ICAO location indicator. This can be determined by browsing "
13278
"to the <ulink url=\"http://www.weather.gov/tg/siteloc.shtml\">National "
13279
"Weather Service</ulink> site."
13280
msgstr ""
13281
13282
#: serverguide/C/other-apps.xml:90(para)
13283
msgid ""
13284
"Although the National Weather Service is a United States government agency "
13285
"there are weather stations available world wide. However, local weather "
13286
"information for all locations outside the U.S. may not be available."
13287
msgstr ""
13288
13289
#: serverguide/C/other-apps.xml:96(para)
13290
msgid ""
13291
"Create <filename>/usr/local/bin/local-weather</filename>, a simple shell "
13292
"script to use <application>weather</application> with your local ICAO "
13293
"indicator:"
13294
msgstr ""
13295
13296
#: serverguide/C/other-apps.xml:101(programlisting)
13297
#, no-wrap
13298
msgid ""
13299
"\n"
13300
"#!/bin/sh\n"
13301
"#\n"
13302
"#\n"
13303
"# Prints the local weather information for the MOTD.\n"
13304
"#\n"
13305
"#\n"
13306
"\n"
13307
"# Replace KINT with your local weather station.\n"
13308
"# Local stations can be found here: http://www.weather.gov/tg/siteloc.shtml\n"
13309
"\n"
13310
"echo\n"
13311
"weather -i KINT\n"
13312
"echo\n"
13313
"\n"
13314
msgstr ""
13315
13316
#: serverguide/C/other-apps.xml:119(para)
13317
msgid "Make the script executable:"
13318
msgstr ""
13319
13320
#: serverguide/C/other-apps.xml:124(command)
13321
msgid "sudo chmod 755 /usr/local/bin/local-weather"
13322
msgstr ""
13323
13324
#: serverguide/C/other-apps.xml:128(para)
13325
msgid ""
13326
"Next, create a symlink to <filename>/etc/update-motd.d/98-local-"
13327
"weather</filename>:"
13328
msgstr ""
13329
13330
#: serverguide/C/other-apps.xml:133(command)
13331
msgid ""
13332
"sudo ln -s /usr/local/bin/local-weather /etc/update-motd.d/98-local-weather"
13333
msgstr ""
13334
13335
#: serverguide/C/other-apps.xml:137(para)
13336
msgid "Finally, exit the server and re-login to view the new MOTD."
13337
msgstr ""
13338
13339
#: serverguide/C/other-apps.xml:143(para)
13340
msgid ""
13341
"You should now be greeted with some useful information, and some information "
13342
"about the local weather that may not be quite so useful. Hopefully the "
13343
"<application>local-weather</application> example demonstrates the "
13344
"flexibility of <application>pam_motd</application>."
13345
msgstr ""
13346
13347
#: serverguide/C/other-apps.xml:156(para)
13348
msgid ""
13349
"See the <ulink "
13350
"url=\"http://manpages.ubuntu.com/manpages/xenial/en/man5/update-"
13351
"motd.5.html\">update-motd man page</ulink> for more options available to "
13352
"<application>update-motd</application>."
13353
msgstr ""
13354
13355
#: serverguide/C/other-apps.xml:163(para)
13356
msgid ""
13357
"The Debian Package of the Day <ulink "
13358
"url=\"http://debaday.debian.net/2007/10/04/weather-check-weather-conditions-"
13359
"and-forecasts-on-the-command-line/\">weather</ulink> article has more "
13360
"details about using the <application>weather</application>utility."
13361
msgstr ""
13362
13363
#: serverguide/C/other-apps.xml:178(title)
13364
msgid "etckeeper"
13365
msgstr ""
13366
13367
#: serverguide/C/other-apps.xml:180(para)
13368
msgid ""
13369
"<application>etckeeper</application> allows the contents of <filename "
13370
"role=\"directory\">/etc</filename> to be stored in a Version Control System "
13371
"(VCS) repository. It integrates with <application>APT</application> and "
13372
"automatically commits changes to <filename>/etc</filename> when packages are "
13373
"installed or upgraded. Placing <filename>/etc</filename> under version "
13374
"control is considered an industry best practice, and the goal of "
13375
"<application>etckeeper</application> is to make this process as painless as "
13376
"possible."
13377
msgstr ""
13378
13379
#: serverguide/C/other-apps.xml:188(para)
13380
msgid ""
13381
"Install <application>etckeeper</application> by entering the following in a "
13382
"terminal:"
13383
msgstr ""
13384
13385
#: serverguide/C/other-apps.xml:193(command)
13386
msgid "sudo apt install etckeeper"
13387
msgstr ""
13388
13389
#: serverguide/C/other-apps.xml:196(para)
13390
msgid ""
13391
"The main configuration file, "
13392
"<filename>/etc/etckeeper/etckeeper.conf</filename>, is fairly simple. The "
13393
"main option is which VCS to use and by default "
13394
"<application>etckeeper</application> is configured to use "
13395
"<application>Bazaar</application>. The repository is automatically "
13396
"initialized (and committed for the first time) during package installation. "
13397
"It is possible to undo this by entering the following command:"
13398
msgstr ""
13399
13400
#: serverguide/C/other-apps.xml:204(command)
13401
msgid "sudo etckeeper uninit"
13402
msgstr ""
13403
13404
#: serverguide/C/other-apps.xml:207(para)
13405
msgid ""
13406
"By default, etckeeper will commit uncommitted changes made to /etc daily. "
13407
"This can be disabled using the AVOID_DAILY_AUTOCOMMITS configuration option. "
13408
"It will also automatically commit changes before and after package "
13409
"installation. For a more precise tracking of changes, it is recommended to "
13410
"commit your changes manually, together with a commit message, using:"
13411
msgstr ""
13412
13413
#: serverguide/C/other-apps.xml:214(command)
13414
msgid "sudo etckeeper commit \"..Reason for configuration change..\""
13415
msgstr ""
13416
13417
#: serverguide/C/other-apps.xml:217(para)
13418
msgid "Using bzr's VCS commands you can view log information:"
13419
msgstr ""
13420
13421
#: serverguide/C/other-apps.xml:222(command)
13422
msgid "sudo bzr log /etc/passwd"
13423
msgstr ""
13424
13425
#: serverguide/C/other-apps.xml:225(para)
13426
msgid ""
13427
"To demonstrate the integration with the package management system (APT), "
13428
"install <application>postfix</application>:"
13429
msgstr ""
13430
13431
#: serverguide/C/other-apps.xml:230(command) serverguide/C/mail.xml:43(command)
13432
msgid "sudo apt install postfix"
13433
msgstr ""
13434
13435
#: serverguide/C/other-apps.xml:233(para)
13436
msgid ""
13437
"When the installation is finished, all the "
13438
"<application>postfix</application> configuration files should be committed "
13439
"to the repository:"
13440
msgstr ""
13441
13442
#: serverguide/C/other-apps.xml:239(computeroutput)
13443
#, no-wrap
13444
msgid ""
13445
"Committing to: /etc/\n"
13446
"added aliases.db\n"
13447
"modified group\n"
13448
"modified group-\n"
13449
"modified gshadow\n"
13450
"modified gshadow-\n"
13451
"modified passwd\n"
13452
"modified passwd-\n"
13453
"added postfix\n"
13454
"added resolvconf\n"
13455
"added rsyslog.d\n"
13456
"modified shadow\n"
13457
"modified shadow-\n"
13458
"added init.d/postfix\n"
13459
"added network/if-down.d/postfix\n"
13460
"added network/if-up.d/postfix\n"
13461
"added postfix/dynamicmaps.cf\n"
13462
"added postfix/main.cf\n"
13463
"added postfix/master.cf\n"
13464
"added postfix/post-install\n"
13465
"added postfix/postfix-files\n"
13466
"added postfix/postfix-script\n"
13467
"added postfix/sasl\n"
13468
"added ppp/ip-down.d\n"
13469
"added ppp/ip-down.d/postfix\n"
13470
"added ppp/ip-up.d/postfix\n"
13471
"added rc0.d/K20postfix\n"
13472
"added rc1.d/K20postfix\n"
13473
"added rc2.d/S20postfix\n"
13474
"added rc3.d/S20postfix\n"
13475
"added rc4.d/S20postfix\n"
13476
"added rc5.d/S20postfix\n"
13477
"added rc6.d/K20postfix\n"
13478
"added resolvconf/update-libc.d\n"
13479
"added resolvconf/update-libc.d/postfix\n"
13480
"added rsyslog.d/postfix.conf\n"
13481
"added ufw/applications.d/postfix\n"
13482
"Committed revision 2."
13483
msgstr ""
13484
13485
#: serverguide/C/other-apps.xml:279(para)
13486
msgid ""
13487
"For an example of how <application>etckeeper</application> tracks manual "
13488
"changes, add new a host to <filename>/etc/hosts</filename>. Using "
13489
"<application>bzr</application> you can see which files have been modified:"
13490
msgstr ""
13491
13492
#: serverguide/C/other-apps.xml:285(command)
13493
msgid "sudo bzr status /etc/"
13494
msgstr ""
13495
13496
#: serverguide/C/other-apps.xml:286(computeroutput)
13497
#, no-wrap
13498
msgid ""
13499
"modified:\n"
13500
" hosts"
13501
msgstr ""
13502
13503
#: serverguide/C/other-apps.xml:290(para)
13504
msgid "Now commit the changes:"
13505
msgstr ""
13506
13507
#: serverguide/C/other-apps.xml:295(command)
13508
msgid "sudo etckeeper commit \"added new host\""
13509
msgstr ""
13510
13511
#: serverguide/C/other-apps.xml:298(para)
13512
msgid ""
13513
"For more information on <application>bzr</application> see <xref "
13514
"linkend=\"bazaar\"/>."
13515
msgstr ""
13516
13517
#: serverguide/C/other-apps.xml:310(para)
13518
msgid ""
13519
"See the <ulink url=\"http://etckeeper.branchable.com/\">etckeeper</ulink> "
13520
"site for more details on using <application>etckeeper</application>."
13521
msgstr ""
13522
13523
#: serverguide/C/other-apps.xml:317(para)
13524
msgid ""
13525
"For the latest news and information about <application>bzr</application> see "
13526
"the <ulink url=\"http://bazaar-vcs.org/\">bzr</ulink> web site."
13527
msgstr ""
13528
13529
#: serverguide/C/other-apps.xml:329(title)
13530
msgid "Byobu"
13531
msgstr ""
13532
13533
#: serverguide/C/other-apps.xml:331(para)
13534
msgid ""
13535
"One of the most useful applications for any system administrator is an xterm "
13536
"multiplexor such as <application>screen</application> or "
13537
"<application>tmux</application>. It allows for the execution of multiple "
13538
"shells in one terminal. To make some of the advanced multiplexor features "
13539
"more user-friendly and provide some useful information about the system, the "
13540
"<application>byobu</application> package was created. It acts as a wrapper "
13541
"to these programs. By default Byobu uses tmux (if installed) but this can be "
13542
"changed by the user."
13543
msgstr ""
13544
13545
#: serverguide/C/other-apps.xml:338(para)
13546
msgid "Invoke it simply with:"
13547
msgstr ""
13548
13549
#: serverguide/C/other-apps.xml:343(command)
13550
msgid "byobu"
13551
msgstr ""
13552
13553
#: serverguide/C/other-apps.xml:346(para)
13554
msgid ""
13555
"Now bring up the configuration menu. By default this is done by pressing the "
13556
"<emphasis>F9</emphasis> key. This will allow you to:"
13557
msgstr ""
13558
13559
#: serverguide/C/other-apps.xml:351(para)
13560
msgid "View the Help menu"
13561
msgstr ""
13562
13563
#: serverguide/C/other-apps.xml:352(para)
13564
msgid "Change Byobu's background color"
13565
msgstr ""
13566
13567
#: serverguide/C/other-apps.xml:353(para)
13568
msgid "Change Byobu's foreground color"
13569
msgstr ""
13570
13571
#: serverguide/C/other-apps.xml:354(para)
13572
msgid "Toggle status notifications"
13573
msgstr ""
13574
13575
#: serverguide/C/other-apps.xml:355(para)
13576
msgid "Change the key binding set"
13577
msgstr ""
13578
13579
#: serverguide/C/other-apps.xml:356(para)
13580
msgid "Change the escape sequence"
13581
msgstr ""
13582
13583
#: serverguide/C/other-apps.xml:357(para)
13584
msgid "Create new windows"
13585
msgstr ""
13586
13587
#: serverguide/C/other-apps.xml:358(para)
13588
msgid "Manage the default windows"
13589
msgstr ""
13590
13591
#: serverguide/C/other-apps.xml:359(para)
13592
msgid "Byobu currently does not launch at login (toggle on)"
13593
msgstr ""
13594
13595
#: serverguide/C/other-apps.xml:362(para)
13596
msgid ""
13597
"The <emphasis>key bindings</emphasis> determine such things as the escape "
13598
"sequence, new window, change window, etc. There are two key binding sets to "
13599
"choose from <emphasis>f-keys</emphasis> and <emphasis>screen-escape-"
13600
"keys</emphasis>. If you wish to use the original key bindings choose the "
13601
"<emphasis>none</emphasis> set."
13602
msgstr ""
13603
13604
#: serverguide/C/other-apps.xml:368(para)
13605
msgid ""
13606
"<application>byobu</application> provides a menu which displays the Ubuntu "
13607
"release, processor information, memory information, and the time and date. "
13608
"The effect is similar to a desktop menu."
13609
msgstr ""
13610
13611
#: serverguide/C/other-apps.xml:373(para)
13612
msgid ""
13613
"Using the <emphasis>\"Byobu currently does not launch at login (toggle "
13614
"on)\"</emphasis> option will cause <application>byobu</application> to be "
13615
"executed any time a terminal is opened. Changes made to "
13616
"<application>byobu</application> are on a per user basis, and will not "
13617
"affect other users on the system."
13618
msgstr ""
13619
13620
#: serverguide/C/other-apps.xml:379(para)
13621
msgid ""
13622
"One difference when using byobu is the <emphasis>scrollback</emphasis> mode. "
13623
"Press the <emphasis>F7</emphasis> key to enter scrollback mode. Scrollback "
13624
"mode allows you to navigate past output using <emphasis>vi</emphasis> like "
13625
"commands. Here is a quick list of movement commands:"
13626
msgstr ""
13627
13628
#: serverguide/C/other-apps.xml:386(para)
13629
msgid "<emphasis>h</emphasis> - Move the cursor left by one character"
13630
msgstr ""
13631
13632
#: serverguide/C/other-apps.xml:387(para)
13633
msgid "<emphasis>j</emphasis> - Move the cursor down by one line"
13634
msgstr ""
13635
13636
#: serverguide/C/other-apps.xml:388(para)
13637
msgid "<emphasis>k</emphasis> - Move the cursor up by one line"
13638
msgstr ""
13639
13640
#: serverguide/C/other-apps.xml:389(para)
13641
msgid "<emphasis>l</emphasis> - Move the cursor right by one character"
13642
msgstr ""
13643
13644
#: serverguide/C/other-apps.xml:390(para)
13645
msgid "<emphasis>0</emphasis> - Move to the beginning of the current line"
13646
msgstr ""
13647
13648
#: serverguide/C/other-apps.xml:391(para)
13649
msgid "<emphasis>$</emphasis> - Move to the end of the current line"
13650
msgstr ""
13651
13652
#: serverguide/C/other-apps.xml:392(para)
13653
msgid ""
13654
"<emphasis>G</emphasis> - Moves to the specified line (defaults to the end of "
13655
"the buffer)"
13656
msgstr ""
13657
13658
#: serverguide/C/other-apps.xml:393(para)
13659
msgid "<emphasis>/</emphasis> - Search forward"
13660
msgstr ""
13661
13662
#: serverguide/C/other-apps.xml:394(para)
13663
msgid "<emphasis>?</emphasis> - Search backward"
13664
msgstr ""
13665
13666
#: serverguide/C/other-apps.xml:395(para)
13667
msgid ""
13668
"<emphasis>n</emphasis> - Moves to the next match, either forward or backward"
13669
msgstr ""
13670
13671
#: serverguide/C/other-apps.xml:403(para)
13672
msgid ""
13673
"For more information on <application>screen</application> see the <ulink "
13674
"url=\"http://www.gnu.org/software/screen/\">screen web site</ulink>."
13675
msgstr ""
13676
13677
#: serverguide/C/other-apps.xml:408(para)
13678
msgid ""
13679
"And the <ulink url=\"https://help.ubuntu.com/community/Screen\">Ubuntu Wiki "
13680
"screen</ulink> page."
13681
msgstr ""
13682
13683
#: serverguide/C/other-apps.xml:413(para)
13684
msgid ""
13685
"Also, see the <application>byobu</application><ulink "
13686
"url=\"https://launchpad.net/byobu\">project page</ulink> for more "
13687
"information."
13688
msgstr ""
13689
13690
#: serverguide/C/network-config.xml:12(para)
13691
msgid ""
13692
"Networks consist of two or more devices, such as computer systems, printers, "
13693
"and related equipment which are connected by either physical cabling or "
13694
"wireless links for the purpose of sharing and distributing information among "
13695
"the connected devices."
13696
msgstr ""
13697
13698
#: serverguide/C/network-config.xml:18(para)
13699
msgid ""
13700
"This section provides general and specific information pertaining to "
13701
"networking, including an overview of network concepts and detailed "
13702
"discussion of popular network protocols."
13703
msgstr ""
13704
13705
#: serverguide/C/network-config.xml:25(title)
13706
msgid "Network Configuration"
13707
msgstr "Konfigurasi Jaringan"
13708
13709
#: serverguide/C/network-config.xml:26(para)
13710
msgid ""
13711
"Ubuntu ships with a number of graphical utilities to configure your network "
13712
"devices. This document is geared toward server administrators and will focus "
13713
"on managing your network on the command line."
13714
msgstr ""
13715
"Ubuntu berisi sejumlah program dengan tampilan grafis untuk "
13716
"mengkonfigurasikan perangkat network anda. Dokumen ini ditujukan bagi server "
13717
"administrator dan berfokus pada pengelolaan network anda dengan menggunakan "
13718
"command line"
13719
13720
#: serverguide/C/network-config.xml:33(title)
13721
msgid "Ethernet Interfaces"
13722
msgstr ""
13723
13724
#: serverguide/C/network-config.xml:34(para)
13725
msgid ""
13726
"Ethernet interfaces are identified by the system using the naming convention "
13727
"of <emphasis role=\"italix\">ethX</emphasis>, where <emphasis "
13728
"role=\"italic\">X</emphasis> represents a numeric value. The first Ethernet "
13729
"interface is typically identified as <emphasis "
13730
"role=\"italic\">eth0</emphasis>, the second as <emphasis "
13731
"role=\"italic\">eth1</emphasis>, and all others should move up in numerical "
13732
"order."
13733
msgstr ""
13734
13735
#: serverguide/C/network-config.xml:44(title)
13736
msgid "Identify Ethernet Interfaces"
13737
msgstr ""
13738
13739
#: serverguide/C/network-config.xml:45(para)
13740
msgid ""
13741
"To quickly identify all available Ethernet interfaces, you can use the "
13742
"<application>ifconfig</application> command as shown below."
13743
msgstr ""
13744
13745
#: serverguide/C/network-config.xml:50(command)
13746
msgid "ifconfig -a | grep eth"
13747
msgstr ""
13748
13749
#: serverguide/C/network-config.xml:51(computeroutput)
13750
#, no-wrap
13751
msgid "eth0 Link encap:Ethernet HWaddr 00:15:c5:4a:16:5a"
13752
msgstr ""
13753
13754
#: serverguide/C/network-config.xml:53(para)
13755
msgid ""
13756
"Another application that can help identify all network interfaces available "
13757
"to your system is the <application>lshw</application> command. In the "
13758
"example below, <application>lshw</application> shows a single Ethernet "
13759
"interface with the logical name of <emphasis role=\"italic\">eth0</emphasis> "
13760
"along with bus information, driver details and all supported capabilities."
13761
msgstr ""
13762
13763
#: serverguide/C/network-config.xml:60(command)
13764
msgid "sudo lshw -class network"
13765
msgstr ""
13766
13767
#: serverguide/C/network-config.xml:61(computeroutput)
13768
#, no-wrap
13769
msgid ""
13770
" *-network\n"
13771
" description: Ethernet interface\n"
13772
" product: BCM4401-B0 100Base-TX\n"
13773
" vendor: Broadcom Corporation\n"
13774
" physical id: 0\n"
13775
" bus info: pci@0000:03:00.0\n"
13776
" logical name: eth0\n"
13777
" version: 02\n"
13778
" serial: 00:15:c5:4a:16:5a\n"
13779
" size: 10MB/s\n"
13780
" capacity: 100MB/s\n"
13781
" width: 32 bits\n"
13782
" clock: 33MHz\n"
13783
" capabilities: (snipped for brevity)\n"
13784
" configuration: (snipped for brevity)\n"
13785
" resources: irq:17 memory:ef9fe000-ef9fffff"
13786
msgstr ""
13787
13788
#: serverguide/C/network-config.xml:81(title)
13789
msgid "Ethernet Interface Logical Names"
13790
msgstr ""
13791
13792
#: serverguide/C/network-config.xml:82(para)
13793
msgid ""
13794
"Interface logical names are configured in the file "
13795
"<filename>/etc/udev/rules.d/70-persistent-net.rules.</filename> If you would "
13796
"like control which interface receives a particular logical name, find the "
13797
"line matching the interfaces physical MAC address and modify the value of "
13798
"<emphasis role=\"italic\">NAME=ethX</emphasis> to the desired logical name. "
13799
"Reboot the system to commit your changes."
13800
msgstr ""
13801
13802
#: serverguide/C/network-config.xml:93(title)
13803
msgid "Ethernet Interface Settings"
13804
msgstr ""
13805
13806
#: serverguide/C/network-config.xml:94(para)
13807
msgid ""
13808
"<application>ethtool</application> is a program that displays and changes "
13809
"Ethernet card settings such as auto-negotiation, port speed, duplex mode, "
13810
"and Wake-on-LAN. It is not installed by default, but is available for "
13811
"installation in the repositories."
13812
msgstr ""
13813
13814
#: serverguide/C/network-config.xml:100(command)
13815
msgid "sudo apt install ethtool"
13816
msgstr ""
13817
13818
#: serverguide/C/network-config.xml:102(para)
13819
msgid ""
13820
"The following is an example of how to view supported features and configured "
13821
"settings of an Ethernet interface."
13822
msgstr ""
13823
13824
#: serverguide/C/network-config.xml:107(command)
13825
msgid "sudo ethtool eth0"
13826
msgstr ""
13827
13828
#: serverguide/C/network-config.xml:108(computeroutput)
13829
#, no-wrap
13830
msgid ""
13831
"Settings for eth0:\n"
13832
" Supported ports: [ TP ]\n"
13833
" Supported link modes: 10baseT/Half 10baseT/Full \n"
13834
" 100baseT/Half 100baseT/Full \n"
13835
" 1000baseT/Half 1000baseT/Full \n"
13836
" Supports auto-negotiation: Yes\n"
13837
" Advertised link modes: 10baseT/Half 10baseT/Full \n"
13838
" 100baseT/Half 100baseT/Full \n"
13839
" 1000baseT/Half 1000baseT/Full \n"
13840
" Advertised auto-negotiation: Yes\n"
13841
" Speed: 1000Mb/s\n"
13842
" Duplex: Full\n"
13843
" Port: Twisted Pair\n"
13844
" PHYAD: 1\n"
13845
" Transceiver: internal\n"
13846
" Auto-negotiation: on\n"
13847
" Supports Wake-on: g\n"
13848
" Wake-on: d\n"
13849
" Current message level: 0x000000ff (255)\n"
13850
" Link detected: yes"
13851
msgstr ""
13852
13853
#: serverguide/C/network-config.xml:129(para)
13854
msgid ""
13855
"Changes made with the <application>ethtool</application> command are "
13856
"temporary and will be lost after a reboot. If you would like to retain "
13857
"settings, simply add the desired <application>ethtool</application> command "
13858
"to a <emphasis role=\"italic\">pre-up</emphasis> statement in the interface "
13859
"configuration file <filename>/etc/network/interfaces</filename>."
13860
msgstr ""
13861
13862
#: serverguide/C/network-config.xml:135(para)
13863
msgid ""
13864
"The following is an example of how the interface identified as <emphasis "
13865
"role=\"italic\">eth0</emphasis> could be permanently configured with a port "
13866
"speed of 1000Mb/s running in full duplex mode."
13867
msgstr ""
13868
13869
#: serverguide/C/network-config.xml:139(programlisting)
13870
#, no-wrap
13871
msgid ""
13872
"\n"
13873
"auto eth0\n"
13874
"iface eth0 inet static\n"
13875
"pre-up /sbin/ethtool -s eth0 speed 1000 duplex full\n"
13876
msgstr ""
13877
13878
#: serverguide/C/network-config.xml:145(para)
13879
msgid ""
13880
"Although the example above shows the interface configured to use the "
13881
"<emphasis role=\"italic\">static</emphasis> method, it actually works with "
13882
"other methods as well, such as DHCP. The example is meant to demonstrate "
13883
"only proper placement of the <emphasis role=\"italic\">pre-up</emphasis> "
13884
"statement in relation to the rest of the interface configuration."
13885
msgstr ""
13886
13887
#: serverguide/C/network-config.xml:157(title)
13888
msgid "IP Addressing"
13889
msgstr ""
13890
13891
#: serverguide/C/network-config.xml:158(para)
13892
msgid ""
13893
"The following section describes the process of configuring your systems IP "
13894
"address and default gateway needed for communicating on a local area network "
13895
"and the Internet."
13896
msgstr ""
13897
13898
#: serverguide/C/network-config.xml:165(title)
13899
msgid "Temporary IP Address Assignment"
13900
msgstr ""
13901
13902
#: serverguide/C/network-config.xml:166(para)
13903
msgid ""
13904
"For temporary network configurations, you can use standard commands such as "
13905
"<application>ip</application>, <application>ifconfig</application> and "
13906
"<application>route</application>, which are also found on most other "
13907
"GNU/Linux operating systems. These commands allow you to configure settings "
13908
"which take effect immediately, however they are not persistent and will be "
13909
"lost after a reboot."
13910
msgstr ""
13911
13912
#: serverguide/C/network-config.xml:174(para)
13913
msgid ""
13914
"To temporarily configure an IP address, you can use the "
13915
"<application>ifconfig</application> command in the following manner. Just "
13916
"modify the IP address and subnet mask to match your network requirements."
13917
msgstr ""
13918
13919
#: serverguide/C/network-config.xml:180(command)
13920
msgid "sudo ifconfig eth0 10.0.0.100 netmask 255.255.255.0"
13921
msgstr ""
13922
13923
#: serverguide/C/network-config.xml:182(para)
13924
msgid ""
13925
"To verify the IP address configuration of <application>eth0</application>, "
13926
"you can use the <application>ifconfig</application> command in the following "
13927
"manner."
13928
msgstr ""
13929
13930
#: serverguide/C/network-config.xml:187(command)
13931
msgid "ifconfig eth0"
13932
msgstr ""
13933
13934
#: serverguide/C/network-config.xml:188(computeroutput)
13935
#, no-wrap
13936
msgid ""
13937
"eth0 Link encap:Ethernet HWaddr 00:15:c5:4a:16:5a \n"
13938
" inet addr:10.0.0.100 Bcast:10.0.0.255 Mask:255.255.255.0\n"
13939
" inet6 addr: fe80::215:c5ff:fe4a:165a/64 Scope:Link\n"
13940
" UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1\n"
13941
" RX packets:466475604 errors:0 dropped:0 overruns:0 frame:0\n"
13942
" TX packets:403172654 errors:0 dropped:0 overruns:0 carrier:0\n"
13943
" collisions:0 txqueuelen:1000 \n"
13944
" RX bytes:2574778386 (2.5 GB) TX bytes:1618367329 (1.6 GB)\n"
13945
" Interrupt:16"
13946
msgstr ""
13947
13948
#: serverguide/C/network-config.xml:198(para)
13949
msgid ""
13950
"To configure a default gateway, you can use the "
13951
"<application>route</application> command in the following manner. Modify the "
13952
"default gateway address to match your network requirements."
13953
msgstr ""
13954
13955
#: serverguide/C/network-config.xml:204(command)
13956
msgid "sudo route add default gw 10.0.0.1 eth0"
13957
msgstr ""
13958
13959
#: serverguide/C/network-config.xml:206(para)
13960
msgid ""
13961
"To verify your default gateway configuration, you can use the "
13962
"<application>route</application> command in the following manner."
13963
msgstr ""
13964
13965
#: serverguide/C/network-config.xml:211(command)
13966
msgid "route -n"
13967
msgstr ""
13968
13969
#: serverguide/C/network-config.xml:212(computeroutput)
13970
#, no-wrap
13971
msgid ""
13972
"Kernel IP routing table\n"
13973
"Destination Gateway Genmask Flags Metric Ref Use "
13974
"Iface\n"
13975
"10.0.0.0 0.0.0.0 255.255.255.0 U 1 0 0 "
13976
"eth0\n"
13977
"0.0.0.0 10.0.0.1 0.0.0.0 UG 0 0 0 eth0"
13978
msgstr ""
13979
13980
#: serverguide/C/network-config.xml:217(para)
13981
msgid ""
13982
"If you require DNS for your temporary network configuration, you can add DNS "
13983
"server IP addresses in the file <filename>/etc/resolv.conf</filename>. In "
13984
"general, editing <filename>/etc/resolv.conf</filename> directly is not "
13985
"recommanded, but this is a temporary and non-persistent configuration. The "
13986
"example below shows how to enter two DNS servers to "
13987
"<filename>/etc/resolv.conf</filename>, which should be changed to servers "
13988
"appropriate for your network. A more lengthy description of the proper "
13989
"persistent way to do DNS client configuration is in a following section."
13990
msgstr ""
13991
13992
#: serverguide/C/network-config.xml:226(programlisting)
13993
#, no-wrap
13994
msgid ""
13995
"\n"
13996
"nameserver 8.8.8.8\n"
13997
"nameserver 8.8.4.4\n"
13998
msgstr ""
13999
14000
#: serverguide/C/network-config.xml:230(para)
14001
msgid ""
14002
"If you no longer need this configuration and wish to purge all IP "
14003
"configuration from an interface, you can use the "
14004
"<application>ip</application> command with the flush option as shown below."
14005
msgstr ""
14006
14007
#: serverguide/C/network-config.xml:236(command)
14008
msgid "ip addr flush eth0"
14009
msgstr ""
14010
14011
#: serverguide/C/network-config.xml:239(para)
14012
msgid ""
14013
"Flushing the IP configuration using the <application>ip</application> "
14014
"command does not clear the contents of "
14015
"<filename>/etc/resolv.conf</filename>. You must remove or modify those "
14016
"entries manually, or re-boot which should also cause "
14017
"<filename>/etc/resolv.conf</filename>, which is actually now a symlink to "
14018
"<filename>/run/resolvconf/resolv.conf</filename>, to be re-written."
14019
msgstr ""
14020
14021
#: serverguide/C/network-config.xml:249(title)
14022
msgid "Dynamic IP Address Assignment (DHCP Client)"
14023
msgstr ""
14024
14025
#: serverguide/C/network-config.xml:250(para)
14026
msgid ""
14027
"To configure your server to use DHCP for dynamic address assignment, add the "
14028
"<emphasis role=\"italic\">dhcp</emphasis> method to the inet address family "
14029
"statement for the appropriate interface in the file "
14030
"<filename>/etc/network/interfaces</filename>. The example below assumes you "
14031
"are configuring your first Ethernet interface identified as <emphasis "
14032
"role=\"italic\">eth0</emphasis>."
14033
msgstr ""
14034
14035
#: serverguide/C/network-config.xml:257(programlisting)
14036
#, no-wrap
14037
msgid ""
14038
"\n"
14039
"auto eth0\n"
14040
"iface eth0 inet dhcp\n"
14041
msgstr ""
14042
14043
#: serverguide/C/network-config.xml:261(para)
14044
msgid ""
14045
"By adding an interface configuration as shown above, you can manually enable "
14046
"the interface through the <application>ifup</application> command which "
14047
"initiates the DHCP process via <application>dhclient</application>."
14048
msgstr ""
14049
14050
#: serverguide/C/network-config.xml:267(command) serverguide/C/network-config.xml:302(command)
14051
msgid "sudo ifup eth0"
14052
msgstr ""
14053
14054
#: serverguide/C/network-config.xml:269(para)
14055
msgid ""
14056
"To manually disable the interface, you can use the "
14057
"<application>ifdown</application> command, which in turn will initiate the "
14058
"DHCP release process and shut down the interface."
14059
msgstr ""
14060
14061
#: serverguide/C/network-config.xml:275(command) serverguide/C/network-config.xml:309(command)
14062
msgid "sudo ifdown eth0"
14063
msgstr ""
14064
14065
#: serverguide/C/network-config.xml:280(title)
14066
msgid "Static IP Address Assignment"
14067
msgstr ""
14068
14069
#: serverguide/C/network-config.xml:281(para)
14070
msgid ""
14071
"To configure your system to use a static IP address assignment, add the "
14072
"<emphasis role=\"italic\">static</emphasis> method to the inet address "
14073
"family statement for the appropriate interface in the file "
14074
"<filename>/etc/network/interfaces</filename>. The example below assumes you "
14075
"are configuring your first Ethernet interface identified as <emphasis "
14076
"role=\"italic\">eth0</emphasis>. Change the <emphasis "
14077
"role=\"italic\">address</emphasis>, <emphasis "
14078
"role=\"italic\">netmask</emphasis>, and <emphasis "
14079
"role=\"italic\">gateway</emphasis> values to meet the requirements of your "
14080
"network."
14081
msgstr ""
14082
14083
#: serverguide/C/network-config.xml:290(programlisting)
14084
#, no-wrap
14085
msgid ""
14086
"\n"
14087
"auto eth0\n"
14088
"iface eth0 inet static\n"
14089
"address 10.0.0.100\n"
14090
"netmask 255.255.255.0\n"
14091
"gateway 10.0.0.1\n"
14092
msgstr ""
14093
14094
#: serverguide/C/network-config.xml:297(para)
14095
msgid ""
14096
"By adding an interface configuration as shown above, you can manually enable "
14097
"the interface through the <application>ifup</application> command."
14098
msgstr ""
14099
14100
#: serverguide/C/network-config.xml:304(para)
14101
msgid ""
14102
"To manually disable the interface, you can use the "
14103
"<application>ifdown</application> command."
14104
msgstr ""
14105
14106
#: serverguide/C/network-config.xml:314(title)
14107
msgid "Loopback Interface"
14108
msgstr ""
14109
14110
#: serverguide/C/network-config.xml:315(para)
14111
msgid ""
14112
"The loopback interface is identified by the system as <emphasis "
14113
"role=\"italic\">lo</emphasis> and has a default IP address of 127.0.0.1. It "
14114
"can be viewed using the ifconfig command."
14115
msgstr ""
14116
14117
#: serverguide/C/network-config.xml:320(command)
14118
msgid "ifconfig lo"
14119
msgstr ""
14120
14121
#: serverguide/C/network-config.xml:321(computeroutput)
14122
#, no-wrap
14123
msgid ""
14124
"lo Link encap:Local Loopback \n"
14125
" inet addr:127.0.0.1 Mask:255.0.0.0\n"
14126
" inet6 addr: ::1/128 Scope:Host\n"
14127
" UP LOOPBACK RUNNING MTU:16436 Metric:1\n"
14128
" RX packets:2718 errors:0 dropped:0 overruns:0 frame:0\n"
14129
" TX packets:2718 errors:0 dropped:0 overruns:0 carrier:0\n"
14130
" collisions:0 txqueuelen:0 \n"
14131
" RX bytes:183308 (183.3 KB) TX bytes:183308 (183.3 KB)"
14132
msgstr ""
14133
14134
#: serverguide/C/network-config.xml:330(para)
14135
msgid ""
14136
"By default, there should be two lines in "
14137
"<filename>/etc/network/interfaces</filename> responsible for automatically "
14138
"configuring your loopback interface. It is recommended that you keep the "
14139
"default settings unless you have a specific purpose for changing them. An "
14140
"example of the two default lines are shown below."
14141
msgstr ""
14142
14143
#: serverguide/C/network-config.xml:336(programlisting)
14144
#, no-wrap
14145
msgid ""
14146
"\n"
14147
"auto lo\n"
14148
"iface lo inet loopback\n"
14149
msgstr ""
14150
14151
#: serverguide/C/network-config.xml:345(title)
14152
msgid "Name Resolution"
14153
msgstr ""
14154
14155
#: serverguide/C/network-config.xml:346(para)
14156
msgid ""
14157
"Name resolution as it relates to IP networking is the process of mapping IP "
14158
"addresses to hostnames, making it easier to identify resources on a network. "
14159
"The following section will explain how to properly configure your system for "
14160
"name resolution using DNS and static hostname records."
14161
msgstr ""
14162
14163
#: serverguide/C/network-config.xml:354(title)
14164
msgid "DNS Client Configuration"
14165
msgstr ""
14166
14167
#: serverguide/C/network-config.xml:366(programlisting)
14168
#, no-wrap
14169
msgid ""
14170
"\n"
14171
"/etc/resolv.conf -> ../run/resolvconf/resolv.conf\n"
14172
msgstr ""
14173
14174
#: serverguide/C/network-config.xml:355(para)
14175
msgid ""
14176
"Traditionally, the file <filename>/etc/resolv.conf</filename> was a static "
14177
"configuration file that rarely needed to be changed or automatically changed "
14178
"via DCHP client hooks. Nowadays, a computer can switch from one network to "
14179
"another quite often and the <emphasis>resolvconf</emphasis> framework is now "
14180
"being used to track these changes and update the resolver's configuration "
14181
"automatically. It acts as an intermediary between programs that supply "
14182
"nameserver information and applications that need nameserver information. "
14183
"Resolvconf gets populated with information by a set of hook scripts related "
14184
"to network interface configuration. The most notable difference for the user "
14185
"is that any change manually done to <filename>/etc/resolv.conf</filename> "
14186
"will be lost as it gets overwritten each time something triggers resolvconf. "
14187
"Instead, resolvconf uses DHCP client hooks, and "
14188
"<filename>/etc/network/interfaces</filename> to generate a list of "
14189
"nameservers and domains to put in <filename>/etc/resolv.conf</filename>, "
14190
"which is now a symlink: <placeholder-1/> To configure the resolver, add the "
14191
"IP addresses of the nameservers that are appropriate for your network in the "
14192
"file <filename>/etc/network/interfaces</filename>. You can also add an "
14193
"optional DNS suffix search-lists to match your network domain names. For "
14194
"each other valid resolv.conf configuration option, you can include, in the "
14195
"stanza, one line beginning with that option name with a <emphasis "
14196
"role=\"bold\">dns-</emphasis> prefix. The resulting file might look like the "
14197
"following:"
14198
msgstr ""
14199
14200
#: serverguide/C/network-config.xml:377(programlisting)
14201
#, no-wrap
14202
msgid ""
14203
"\n"
14204
"iface eth0 inet static\n"
14205
" address 192.168.3.3\n"
14206
" netmask 255.255.255.0\n"
14207
" gateway 192.168.3.1\n"
14208
" dns-search example.com\n"
14209
" dns-nameservers 192.168.3.45 192.168.8.10\n"
14210
msgstr ""
14211
14212
#: serverguide/C/network-config.xml:386(para)
14213
msgid ""
14214
"The <emphasis role=\"italic\">search</emphasis> option can also be used with "
14215
"multiple domain names so that DNS queries will be appended in the order in "
14216
"which they are entered. For example, your network may have multiple sub-"
14217
"domains to search; a parent domain of <emphasis "
14218
"role=\"italic\">example.com</emphasis>, and two sub-domains, <emphasis "
14219
"role=\"italic\">sales.example.com</emphasis> and <emphasis "
14220
"role=\"italic\">dev.example.com</emphasis>."
14221
msgstr ""
14222
14223
#: serverguide/C/network-config.xml:393(para)
14224
msgid ""
14225
"If you have multiple domains you wish to search, your configuration might "
14226
"look like the following:"
14227
msgstr ""
14228
14229
#: serverguide/C/network-config.xml:397(programlisting)
14230
#, no-wrap
14231
msgid ""
14232
"\n"
14233
"iface eth0 inet static\n"
14234
" address 192.168.3.3\n"
14235
" netmask 255.255.255.0\n"
14236
" gateway 192.168.3.1\n"
14237
" dns-search example.com sales.example.com dev.example.com\n"
14238
" dns-nameservers 192.168.3.45 192.168.8.10\n"
14239
msgstr ""
14240
14241
#: serverguide/C/network-config.xml:406(para)
14242
msgid ""
14243
"If you try to ping a host with the name of <emphasis "
14244
"role=\"italic\">server1</emphasis>, your system will automatically query DNS "
14245
"for its Fully Qualified Domain Name (FQDN) in the following order:"
14246
msgstr ""
14247
14248
#: serverguide/C/network-config.xml:413(para)
14249
msgid "server1<emphasis role=\"bold\">.example.com</emphasis>"
14250
msgstr ""
14251
14252
#: serverguide/C/network-config.xml:418(para)
14253
msgid "server1<emphasis role=\"bold\">.sales.example.com</emphasis>"
14254
msgstr ""
14255
14256
#: serverguide/C/network-config.xml:423(para)
14257
msgid "server1<emphasis role=\"bold\">.dev.example.com</emphasis>"
14258
msgstr ""
14259
14260
#: serverguide/C/network-config.xml:428(para)
14261
msgid ""
14262
"If no matches are found, the DNS server will provide a result of <emphasis "
14263
"role=\"italic\">notfound</emphasis> and the DNS query will fail."
14264
msgstr ""
14265
14266
#: serverguide/C/network-config.xml:435(title)
14267
msgid "Static Hostnames"
14268
msgstr ""
14269
14270
#: serverguide/C/network-config.xml:436(para)
14271
msgid ""
14272
"Static hostnames are locally defined hostname-to-IP mappings located in the "
14273
"file <filename>/etc/hosts</filename>. Entries in the "
14274
"<filename>hosts</filename> file will have precedence over DNS by default. "
14275
"This means that if your system tries to resolve a hostname and it matches an "
14276
"entry in /etc/hosts, it will not attempt to look up the record in DNS. In "
14277
"some configurations, especially when Internet access is not required, "
14278
"servers that communicate with a limited number of resources can be "
14279
"conveniently set to use static hostnames instead of DNS."
14280
msgstr ""
14281
14282
#: serverguide/C/network-config.xml:443(para)
14283
msgid ""
14284
"The following is an example of a <filename>hosts</filename> file where a "
14285
"number of local servers have been identified by simple hostnames, aliases "
14286
"and their equivalent Fully Qualified Domain Names (FQDN's)."
14287
msgstr ""
14288
14289
#: serverguide/C/network-config.xml:447(programlisting)
14290
#, no-wrap
14291
msgid ""
14292
"\n"
14293
"127.0.0.1\tlocalhost\n"
14294
"127.0.1.1\tubuntu-server\n"
14295
"10.0.0.11\tserver1 server1.example.com vpn\n"
14296
"10.0.0.12\tserver2 server2.example.com mail\n"
14297
"10.0.0.13\tserver3 server3.example.com www\n"
14298
"10.0.0.14\tserver4 server4.example.com file\n"
14299
msgstr ""
14300
14301
#: serverguide/C/network-config.xml:456(para)
14302
msgid ""
14303
"In the above example, notice that each of the servers have been given "
14304
"aliases in addition to their proper names and FQDN's. <emphasis "
14305
"role=\"italic\">Server1</emphasis> has been mapped to the name <emphasis "
14306
"role=\"italic\">vpn</emphasis>, <emphasis role=\"italic\">server2</emphasis> "
14307
"is referred to as <emphasis role=\"italic\">mail</emphasis>, <emphasis "
14308
"role=\"italic\">server3</emphasis> as <emphasis "
14309
"role=\"italic\">www</emphasis>, and <emphasis "
14310
"role=\"italic\">server4</emphasis> as <emphasis "
14311
"role=\"italic\">file</emphasis>."
14312
msgstr ""
14313
14314
#: serverguide/C/network-config.xml:468(title)
14315
msgid "Name Service Switch Configuration"
14316
msgstr ""
14317
14318
#: serverguide/C/network-config.xml:469(para)
14319
msgid ""
14320
"The order in which your system selects a method of resolving hostnames to IP "
14321
"addresses is controlled by the Name Service Switch (NSS) configuration file "
14322
"<filename>/etc/nsswitch.conf</filename>. As mentioned in the previous "
14323
"section, typically static hostnames defined in the systems "
14324
"<filename>/etc/hosts</filename> file have precedence over names resolved "
14325
"from DNS. The following is an example of the line responsible for this order "
14326
"of hostname lookups in the file <filename>/etc/nsswitch.conf</filename>."
14327
msgstr ""
14328
14329
#: serverguide/C/network-config.xml:477(programlisting)
14330
#, no-wrap
14331
msgid ""
14332
"\n"
14333
"hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4\n"
14334
msgstr ""
14335
14336
#: serverguide/C/network-config.xml:483(para)
14337
msgid ""
14338
"<emphasis role=\"bold\">files</emphasis> first tries to resolve static "
14339
"hostnames located in <filename>/etc/hosts</filename>."
14340
msgstr ""
14341
14342
#: serverguide/C/network-config.xml:489(para)
14343
msgid ""
14344
"<emphasis role=\"bold\">mdns4_minimal</emphasis> attempts to resolve the "
14345
"name using Multicast DNS."
14346
msgstr ""
14347
14348
#: serverguide/C/network-config.xml:494(para)
14349
msgid ""
14350
"<emphasis role=\"bold\">[NOTFOUND=return]</emphasis> means that any response "
14351
"of <emphasis role=\"italic\">notfound</emphasis> by the preceding <emphasis "
14352
"role=\"italic\">mdns4_minimal</emphasis> process should be treated as "
14353
"authoritative and that the system should not try to continue hunting for an "
14354
"answer."
14355
msgstr ""
14356
14357
#: serverguide/C/network-config.xml:502(para)
14358
msgid ""
14359
"<emphasis role=\"bold\">dns</emphasis> represents a legacy unicast DNS query."
14360
msgstr ""
14361
14362
#: serverguide/C/network-config.xml:507(para)
14363
msgid ""
14364
"<emphasis role=\"bold\">mdns4</emphasis> represents a Multicast DNS query."
14365
msgstr ""
14366
14367
#: serverguide/C/network-config.xml:513(para)
14368
msgid ""
14369
"To modify the order of the above mentioned name resolution methods, you can "
14370
"simply change the <emphasis role=\"italic\">hosts:</emphasis> string to the "
14371
"value of your choosing. For example, if you prefer to use legacy Unicast DNS "
14372
"versus Multicast DNS, you can change the string in "
14373
"<filename>/etc/nsswitch.conf</filename> as shown below."
14374
msgstr ""
14375
14376
#: serverguide/C/network-config.xml:520(programlisting)
14377
#, no-wrap
14378
msgid ""
14379
"\n"
14380
"hosts: files dns [NOTFOUND=return] mdns4_minimal mdns4\n"
14381
msgstr ""
14382
14383
#: serverguide/C/network-config.xml:527(title)
14384
msgid "Bridging"
14385
msgstr ""
14386
14387
#: serverguide/C/network-config.xml:529(para)
14388
msgid ""
14389
"Bridging multiple interfaces is a more advanced configuration, but is very "
14390
"useful in multiple scenarios. One scenario is setting up a bridge with "
14391
"multiple network interfaces, then using a firewall to filter traffic between "
14392
"two network segments. Another scenario is using bridge on a system with one "
14393
"interface to allow virtual machines direct access to the outside network. "
14394
"The following example covers the latter scenario."
14395
msgstr ""
14396
14397
#: serverguide/C/network-config.xml:536(para)
14398
msgid ""
14399
"Before configuring a bridge you will need to install the <application>bridge-"
14400
"utils</application> package. To install the package, in a terminal enter:"
14401
msgstr ""
14402
14403
#: serverguide/C/network-config.xml:545(para)
14404
msgid ""
14405
"Next, configure the bridge by editing "
14406
"<filename>/etc/network/interfaces</filename>:"
14407
msgstr ""
14408
14409
#: serverguide/C/network-config.xml:549(programlisting)
14410
#, no-wrap
14411
msgid ""
14412
"\n"
14413
"auto lo\n"
14414
"iface lo inet loopback\n"
14415
"\n"
14416
"auto br0\n"
14417
"iface br0 inet static\n"
14418
" address 192.168.0.10\n"
14419
" network 192.168.0.0\n"
14420
" netmask 255.255.255.0\n"
14421
" broadcast 192.168.0.255\n"
14422
" gateway 192.168.0.1\n"
14423
" bridge_ports eth0\n"
14424
" bridge_fd 9\n"
14425
" bridge_hello 2\n"
14426
" bridge_maxage 12\n"
14427
" bridge_stp off\n"
14428
msgstr ""
14429
14430
#: serverguide/C/network-config.xml:568(para)
14431
msgid "Enter the appropriate values for your physical interface and network."
14432
msgstr ""
14433
14434
#: serverguide/C/network-config.xml:573(para)
14435
msgid "Now bring up the bridge:"
14436
msgstr ""
14437
14438
#: serverguide/C/network-config.xml:578(command)
14439
msgid "sudo ifup br0"
14440
msgstr ""
14441
14442
#: serverguide/C/network-config.xml:580(para)
14443
msgid ""
14444
"The new bridge interface should now be up and running. The "
14445
"<application>brctl</application> provides useful information about the state "
14446
"of the bridge, controls which interfaces are part of the bridge, etc. See "
14447
"<command>man brctl</command> for more information."
14448
msgstr ""
14449
14450
#: serverguide/C/network-config.xml:596(para)
14451
msgid ""
14452
"The <ulink url=\"https://help.ubuntu.com/community/Network\">Ubuntu Wiki "
14453
"Network page</ulink> has links to articles covering more advanced network "
14454
"configuration."
14455
msgstr ""
14456
14457
#: serverguide/C/network-config.xml:602(para)
14458
msgid ""
14459
"The <ulink "
14460
"url=\"http://manpages.ubuntu.com/manpages/man8/resolvconf.8.html\">resolvconf"
14461
" man page</ulink> has more information on resolvconf."
14462
msgstr ""
14463
14464
#: serverguide/C/network-config.xml:608(para)
14465
msgid ""
14466
"The <ulink "
14467
"url=\"http://manpages.ubuntu.com/manpages/man5/interfaces.5.html\">interfaces"
14468
" man page</ulink> has details on more options for "
14469
"<filename>/etc/network/interfaces</filename>."
14470
msgstr ""
14471
14472
#: serverguide/C/network-config.xml:614(para)
14473
msgid ""
14474
"The <ulink "
14475
"url=\"http://manpages.ubuntu.com/manpages/man8/dhclient.8.html\">dhclient "
14476
"man page</ulink> has details on more options for configuring DHCP client "
14477
"settings."
14478
msgstr ""
14479
14480
#: serverguide/C/network-config.xml:620(para)
14481
msgid ""
14482
"For more information on DNS client configuration see the <ulink "
14483
"url=\"http://manpages.ubuntu.com/manpages/man5/resolver.5.html\">resolver "
14484
"man page</ulink>. Also, Chapter 6 of O'Reilly's <ulink "
14485
"url=\"http://oreilly.com/catalog/linag2/book/ch06.html\">Linux Network "
14486
"Administrator's Guide</ulink> is a good source of resolver and name service "
14487
"configuration information."
14488
msgstr ""
14489
14490
#: serverguide/C/network-config.xml:628(para)
14491
msgid ""
14492
"For more information on <emphasis>bridging</emphasis> see the <ulink "
14493
"url=\"http://manpages.ubuntu.com/manpages/man8/brctl.8.html\">brctl man "
14494
"page</ulink> and the Linux Foundation's <ulink "
14495
"url=\"http://www.linuxfoundation.org/collaborate/workgroups/networking/bridge"
14496
"\">Networking-Bridge</ulink> page."
14497
msgstr ""
14498
14499
#: serverguide/C/network-config.xml:639(title)
14500
msgid "TCP/IP"
14501
msgstr "TCP/IP"
14502
14503
#: serverguide/C/network-config.xml:640(para)
14504
msgid ""
14505
"The Transmission Control Protocol and Internet Protocol (TCP/IP) is a "
14506
"standard set of protocols developed in the late 1970s by the Defense "
14507
"Advanced Research Projects Agency (DARPA) as a means of communication "
14508
"between different types of computers and computer networks. TCP/IP is the "
14509
"driving force of the Internet, and thus it is the most popular set of "
14510
"network protocols on Earth."
14511
msgstr ""
14512
14513
#: serverguide/C/network-config.xml:648(title)
14514
msgid "TCP/IP Introduction"
14515
msgstr "Pengenalan TCP/IP"
14516
14517
#: serverguide/C/network-config.xml:649(para)
14518
msgid ""
14519
"The two protocol components of TCP/IP deal with different aspects of "
14520
"computer networking. <emphasis>Internet Protocol</emphasis>, the \"IP\" of "
14521
"TCP/IP is a connectionless protocol which deals only with network packet "
14522
"routing using the <emphasis role=\"italics\">IP Datagram</emphasis> as the "
14523
"basic unit of networking information. The IP Datagram consists of a header "
14524
"followed by a message. The <emphasis> Transmission Control "
14525
"Protocol</emphasis> is the \"TCP\" of TCP/IP and enables network hosts to "
14526
"establish connections which may be used to exchange data streams. TCP also "
14527
"guarantees that the data between connections is delivered and that it "
14528
"arrives at one network host in the same order as sent from another network "
14529
"host."
14530
msgstr ""
14531
14532
#: serverguide/C/network-config.xml:662(title)
14533
msgid "TCP/IP Configuration"
14534
msgstr "Konfigurasi TCP/IP"
14535
14536
#: serverguide/C/network-config.xml:663(para)
14537
msgid ""
14538
"The TCP/IP protocol configuration consists of several elements which must be "
14539
"set by editing the appropriate configuration files, or deploying solutions "
14540
"such as the Dynamic Host Configuration Protocol (DHCP) server which in turn, "
14541
"can be configured to provide the proper TCP/IP configuration settings to "
14542
"network clients automatically. These configuration values must be set "
14543
"correctly in order to facilitate the proper network operation of your Ubuntu "
14544
"system."
14545
msgstr ""
14546
14547
#: serverguide/C/network-config.xml:675(para)
14548
msgid ""
14549
"<emphasis role=\"bold\">IP address</emphasis> The IP address is a unique "
14550
"identifying string expressed as four decimal numbers ranging from zero (0) "
14551
"to two-hundred and fifty-five (255), separated by periods, with each of the "
14552
"four numbers representing eight (8) bits of the address for a total length "
14553
"of thirty-two (32) bits for the whole address. This format is called "
14554
"<emphasis>dotted quad notation</emphasis>."
14555
msgstr ""
14556
14557
#: serverguide/C/network-config.xml:685(para)
14558
msgid ""
14559
"<emphasis role=\"bold\">Netmask</emphasis> The Subnet Mask (or simply, "
14560
"<emphasis>netmask</emphasis>) is a local bit mask, or set of flags which "
14561
"separate the portions of an IP address significant to the network from the "
14562
"bits significant to the <emphasis>subnetwork</emphasis>. For example, in a "
14563
"Class C network, the standard netmask is 255.255.255.0 which masks the first "
14564
"three bytes of the IP address and allows the last byte of the IP address to "
14565
"remain available for specifying hosts on the subnetwork."
14566
msgstr ""
14567
14568
#: serverguide/C/network-config.xml:696(para)
14569
msgid ""
14570
"<emphasis role=\"bold\">Network Address</emphasis> The Network Address "
14571
"represents the bytes comprising the network portion of an IP address. For "
14572
"example, the host 12.128.1.2 in a Class A network would use 12.0.0.0 as the "
14573
"network address, where twelve (12) represents the first byte of the IP "
14574
"address, (the network part) and zeroes (0) in all of the remaining three "
14575
"bytes to represent the potential host values. A network host using the "
14576
"private IP address 192.168.1.100 would in turn use a Network Address of "
14577
"192.168.1.0, which specifies the first three bytes of the Class C 192.168.1 "
14578
"network and a zero (0) for all the possible hosts on the network."
14579
msgstr ""
14580
14581
#: serverguide/C/network-config.xml:709(para)
14582
msgid ""
14583
"<emphasis role=\"bold\">Broadcast Address</emphasis> The Broadcast Address "
14584
"is an IP address which allows network data to be sent simultaneously to all "
14585
"hosts on a given subnetwork rather than specifying a particular host. The "
14586
"standard general broadcast address for IP networks is 255.255.255.255, but "
14587
"this broadcast address cannot be used to send a broadcast message to every "
14588
"host on the Internet because routers block it. A more appropriate broadcast "
14589
"address is set to match a specific subnetwork. For example, on the private "
14590
"Class C IP network, 192.168.1.0, the broadcast address is 192.168.1.255. "
14591
"Broadcast messages are typically produced by network protocols such as the "
14592
"Address Resolution Protocol (ARP) and the Routing Information Protocol (RIP)."
14593
msgstr ""
14594
14595
#: serverguide/C/network-config.xml:722(para)
14596
msgid ""
14597
"<emphasis role=\"bold\">Gateway Address</emphasis> A Gateway Address is the "
14598
"IP address through which a particular network, or host on a network, may be "
14599
"reached. If one network host wishes to communicate with another network "
14600
"host, and that host is not located on the same network, then a "
14601
"<emphasis>gateway</emphasis> must be used. In many cases, the Gateway "
14602
"Address will be that of a router on the same network, which will in turn "
14603
"pass traffic on to other networks or hosts, such as Internet hosts. The "
14604
"value of the Gateway Address setting must be correct, or your system will "
14605
"not be able to reach any hosts beyond those on the same network."
14606
msgstr ""
14607
14608
#: serverguide/C/network-config.xml:733(para)
14609
msgid ""
14610
"<emphasis role=\"bold\">Nameserver Address</emphasis> Nameserver Addresses "
14611
"represent the IP addresses of Domain Name Service (DNS) systems, which "
14612
"resolve network hostnames into IP addresses. There are three levels of "
14613
"Nameserver Addresses, which may be specified in order of precedence: The "
14614
"<emphasis>Primary</emphasis> Nameserver, the <emphasis>Secondary</emphasis> "
14615
"Nameserver, and the <emphasis>Tertiary</emphasis> Nameserver. In order for "
14616
"your system to be able to resolve network hostnames into their corresponding "
14617
"IP addresses, you must specify valid Nameserver Addresses which you are "
14618
"authorized to use in your system's TCP/IP configuration. In many cases these "
14619
"addresses can and will be provided by your network service provider, but "
14620
"many free and publicly accessible nameservers are available for use, such as "
14621
"the Level3 (Verizon) servers with IP addresses from 4.2.2.1 to 4.2.2.6."
14622
msgstr ""
14623
14624
#: serverguide/C/network-config.xml:747(para)
14625
msgid ""
14626
"The IP address, Netmask, Network Address, Broadcast Address, Gateway "
14627
"Address, and Nameserver Addresses are typically specified via the "
14628
"appropriate directives in the file "
14629
"<filename>/etc/network/interfaces</filename>. For more information, view the "
14630
"system manual page for <filename>interfaces</filename>, with the following "
14631
"command typed at a terminal prompt:"
14632
msgstr ""
14633
14634
#: serverguide/C/network-config.xml:754(para)
14635
msgid ""
14636
"Access the system manual page for <filename>interfaces</filename> with the "
14637
"following command:"
14638
msgstr ""
14639
"Jalanan perintah berikut untuk mengakses sistem halaman manual untuk "
14640
"<filename>interfaces</filename>:"
14641
14642
#: serverguide/C/network-config.xml:759(command)
14643
msgid "man interfaces"
14644
msgstr "man interfaces"
14645
14646
#: serverguide/C/network-config.xml:671(para)
14647
msgid ""
14648
"The common configuration elements of TCP/IP and their purposes are as "
14649
"follows: <placeholder-1/>"
14650
msgstr ""
14651
"Komponen-komponen umum konfigurasi TCP/IP dan kegunaannya adalah sebagai "
14652
"berikut: <placeholder-1/>"
14653
14654
#: serverguide/C/network-config.xml:767(title)
14655
msgid "IP Routing"
14656
msgstr "Routing IP"
14657
14658
#: serverguide/C/network-config.xml:768(para)
14659
msgid ""
14660
"IP routing is a means of specifying and discovering paths in a TCP/IP "
14661
"network along which network data may be sent. Routing uses a set of "
14662
"<emphasis>routing tables</emphasis> to direct the forwarding of network data "
14663
"packets from their source to the destination, often via many intermediary "
14664
"network nodes known as <emphasis>routers</emphasis>. There are two primary "
14665
"forms of IP routing: <emphasis>Static Routing</emphasis> and "
14666
"<emphasis>Dynamic Routing.</emphasis>"
14667
msgstr ""
14668
14669
#: serverguide/C/network-config.xml:777(para)
14670
msgid ""
14671
"Static routing involves manually adding IP routes to the system's routing "
14672
"table, and this is usually done by manipulating the routing table with the "
14673
"<application>route</application> command. Static routing enjoys many "
14674
"advantages over dynamic routing, such as simplicity of implementation on "
14675
"smaller networks, predictability (the routing table is always computed in "
14676
"advance, and thus the route is precisely the same each time it is used), and "
14677
"low overhead on other routers and network links due to the lack of a dynamic "
14678
"routing protocol. However, static routing does present some disadvantages as "
14679
"well. For example, static routing is limited to small networks and does not "
14680
"scale well. Static routing also fails completely to adapt to network outages "
14681
"and failures along the route due to the fixed nature of the route."
14682
msgstr ""
14683
14684
#: serverguide/C/network-config.xml:787(para)
14685
msgid ""
14686
"Dynamic routing depends on large networks with multiple possible IP routes "
14687
"from a source to a destination and makes use of special routing protocols, "
14688
"such as the Router Information Protocol (RIP), which handle the automatic "
14689
"adjustments in routing tables that make dynamic routing possible. Dynamic "
14690
"routing has several advantages over static routing, such as superior "
14691
"scalability and the ability to adapt to failures and outages along network "
14692
"routes. Additionally, there is less manual configuration of the routing "
14693
"tables, since routers learn from one another about their existence and "
14694
"available routes. This trait also eliminates the possibility of introducing "
14695
"mistakes in the routing tables via human error. Dynamic routing is not "
14696
"perfect, however, and presents disadvantages such as heightened complexity "
14697
"and additional network overhead from router communications, which does not "
14698
"immediately benefit the end users, but still consumes network bandwidth."
14699
msgstr ""
14700
14701
#: serverguide/C/network-config.xml:801(title)
14702
msgid "TCP and UDP"
14703
msgstr "TCP dan UDP"
14704
14705
#: serverguide/C/network-config.xml:802(para)
14706
msgid ""
14707
"TCP is a connection-based protocol, offering error correction and guaranteed "
14708
"delivery of data via what is known as <emphasis>flow control</emphasis>. "
14709
"Flow control determines when the flow of a data stream needs to be stopped, "
14710
"and previously sent data packets should to be re-sent due to problems such "
14711
"as <emphasis>collisions</emphasis>, for example, thus ensuring complete and "
14712
"accurate delivery of the data. TCP is typically used in the exchange of "
14713
"important information such as database transactions."
14714
msgstr ""
14715
14716
#: serverguide/C/network-config.xml:810(para)
14717
msgid ""
14718
"The User Datagram Protocol (UDP), on the other hand, is a "
14719
"<emphasis>connectionless</emphasis> protocol which seldom deals with the "
14720
"transmission of important data because it lacks flow control or any other "
14721
"method to ensure reliable delivery of the data. UDP is commonly used in such "
14722
"applications as audio and video streaming, where it is considerably faster "
14723
"than TCP due to the lack of error correction and flow control, and where the "
14724
"loss of a few packets is not generally catastrophic."
14725
msgstr ""
14726
14727
#: serverguide/C/network-config.xml:820(title)
14728
msgid "ICMP"
14729
msgstr "ICMP"
14730
14731
#: serverguide/C/network-config.xml:821(para)
14732
msgid ""
14733
"The Internet Control Messaging Protocol (ICMP) is an extension to the "
14734
"Internet Protocol (IP) as defined in the Request For Comments (RFC) #792 and "
14735
"supports network packets containing control, error, and informational "
14736
"messages. ICMP is used by such network applications as the "
14737
"<application>ping</application> utility, which can determine the "
14738
"availability of a network host or device. Examples of some error messages "
14739
"returned by ICMP which are useful to both network hosts and devices such as "
14740
"routers, include <emphasis>Destination Unreachable</emphasis> and "
14741
"<emphasis>Time Exceeded</emphasis>."
14742
msgstr ""
14743
14744
#: serverguide/C/network-config.xml:831(title)
14745
msgid "Daemons"
14746
msgstr "Daemons"
14747
14748
#: serverguide/C/network-config.xml:832(para)
14749
msgid ""
14750
"Daemons are special system applications which typically execute continuously "
14751
"in the background and await requests for the functions they provide from "
14752
"other applications. Many daemons are network-centric; that is, a large "
14753
"number of daemons executing in the background on an Ubuntu system may "
14754
"provide network-related functionality. Some examples of such network daemons "
14755
"include the <emphasis>Hyper Text Transport Protocol Daemon</emphasis> "
14756
"(httpd), which provides web server functionality; the <emphasis>Secure SHell "
14757
"Daemon</emphasis> (sshd), which provides secure remote login shell and file "
14758
"transfer capabilities; and the <emphasis>Internet Message Access Protocol "
14759
"Daemon</emphasis> (imapd), which provides E-Mail services."
14760
msgstr ""
14761
14762
#: serverguide/C/network-config.xml:847(para)
14763
msgid ""
14764
"There are man pages for <ulink "
14765
"url=\"http://manpages.ubuntu.com/manpages/xenial/en/man7/tcp.7.html\">TCP</ul"
14766
"ink> and <ulink "
14767
"url=\"http://manpages.ubuntu.com/manpages/xenial/man7/ip.7.html\">IP</ulink> "
14768
"that contain more useful information."
14769
msgstr ""
14770
14771
#: serverguide/C/network-config.xml:853(para)
14772
msgid ""
14773
"Also, see the <ulink "
14774
"url=\"http://www.redbooks.ibm.com/abstracts/gg243376.html\">TCP/IP Tutorial "
14775
"and Technical Overview</ulink> IBM Redbook."
14776
msgstr ""
14777
14778
#: serverguide/C/network-config.xml:859(para)
14779
msgid ""
14780
"Another resource is O'Reilly's <ulink "
14781
"url=\"http://oreilly.com/catalog/9780596002978/\">TCP/IP Network "
14782
"Administration</ulink>."
14783
msgstr ""
14784
14785
#: serverguide/C/network-config.xml:868(title)
14786
msgid "Dynamic Host Configuration Protocol (DHCP)"
14787
msgstr "Dynamic Host Configuration Protocol (DHCP)"
14788
14789
#: serverguide/C/network-config.xml:869(para)
14790
msgid ""
14791
"The Dynamic Host Configuration Protocol (DHCP) is a network service that "
14792
"enables host computers to be automatically assigned settings from a server "
14793
"as opposed to manually configuring each network host. Computers configured "
14794
"to be DHCP clients have no control over the settings they receive from the "
14795
"DHCP server, and the configuration is transparent to the computer's user."
14796
msgstr ""
14797
14798
#: serverguide/C/network-config.xml:876(para)
14799
msgid ""
14800
"The most common settings provided by a DHCP server to DHCP clients include:"
14801
msgstr ""
14802
"Pengaturan umum yang di sediakan oleh server DHCP kepada klient DHCP "
14803
"termasuk:"
14804
14805
#: serverguide/C/network-config.xml:881(para)
14806
msgid "IP address and netmask"
14807
msgstr ""
14808
14809
#: serverguide/C/network-config.xml:884(para)
14810
msgid "IP address of the default-gateway to use"
14811
msgstr ""
14812
14813
#: serverguide/C/network-config.xml:887(para)
14814
msgid "IP adresses of the DNS servers to use"
14815
msgstr ""
14816
14817
#: serverguide/C/network-config.xml:890(para)
14818
msgid ""
14819
"However, a DHCP server can also supply configuration properties such as:"
14820
msgstr ""
14821
"Akan tetapi, server DHCP juga dapat menyediakan properti konfigurasi seperti:"
14822
14823
#: serverguide/C/network-config.xml:895(para)
14824
msgid "Host Name"
14825
msgstr "Host Name"
14826
14827
#: serverguide/C/network-config.xml:898(para)
14828
msgid "Domain Name"
14829
msgstr "Nama Domain"
14830
14831
#: serverguide/C/network-config.xml:901(para)
14832
msgid "Time Server"
14833
msgstr "Time Server"
14834
14835
#: serverguide/C/network-config.xml:907(para)
14836
msgid ""
14837
"The advantage of using DHCP is that changes to the network, for example a "
14838
"change in the address of the DNS server, need only be changed at the DHCP "
14839
"server, and all network hosts will be reconfigured the next time their DHCP "
14840
"clients poll the DHCP server. As an added advantage, it is also easier to "
14841
"integrate new computers into the network, as there is no need to check for "
14842
"the availability of an IP address. Conflicts in IP address allocation are "
14843
"also reduced."
14844
msgstr ""
14845
14846
#: serverguide/C/network-config.xml:915(para)
14847
msgid ""
14848
"A DHCP server can provide configuration settings using the following methods:"
14849
msgstr ""
14850
14851
#: serverguide/C/network-config.xml:920(term)
14852
msgid "Manual allocation (MAC address)"
14853
msgstr ""
14854
14855
#: serverguide/C/network-config.xml:922(para)
14856
msgid ""
14857
"This method entails using DHCP to identify the unique hardware address of "
14858
"each network card connected to the network and then continually supplying a "
14859
"constant configuration each time the DHCP client makes a request to the DHCP "
14860
"server using that network device. This ensures that a particular address is "
14861
"assigned automatically to that network card, based on it's MAC address."
14862
msgstr ""
14863
14864
#: serverguide/C/network-config.xml:933(term)
14865
msgid "Dynamic allocation (address pool)"
14866
msgstr ""
14867
14868
#: serverguide/C/network-config.xml:935(para)
14869
msgid ""
14870
"In this method, the DHCP server will assign an IP address from a pool of "
14871
"addresses (sometimes also called a range or scope) for a period of time or "
14872
"lease, that is configured on the server or until the client informs the "
14873
"server that it doesn't need the address anymore. This way, the clients will "
14874
"be receiving their configuration properties dynamically and on a \"first "
14875
"come, first served\" basis. When a DHCP client is no longer on the network "
14876
"for a specified period, the configuration is expired and released back to "
14877
"the address pool for use by other DHCP Clients. This way, an address can be "
14878
"leased or used for a period of time. After this period, the client has to "
14879
"renegociate the lease with the server to maintain use of the address."
14880
msgstr ""
14881
14882
#: serverguide/C/network-config.xml:949(term)
14883
msgid "Automatic allocation"
14884
msgstr ""
14885
14886
#: serverguide/C/network-config.xml:951(para)
14887
msgid ""
14888
"Using this method, the DHCP automatically assigns an IP address permanently "
14889
"to a device, selecting it from a pool of available addresses. Usually DHCP "
14890
"is used to assign a temporary address to a client, but a DHCP server can "
14891
"allow an infinite lease time."
14892
msgstr ""
14893
14894
#: serverguide/C/network-config.xml:959(para)
14895
msgid ""
14896
"The last two methods can be considered \"automatic\" because in each case "
14897
"the DHCP server assigns an address with no extra intervention needed. The "
14898
"only difference between them is in how long the IP address is leased, in "
14899
"other words whether a client's address varies over time. Ubuntu is shipped "
14900
"with both DHCP server and client. The server is "
14901
"<application>dhcpd</application> (dynamic host configuration protocol "
14902
"daemon). The client provided with Ubuntu is "
14903
"<application>dhclient</application> and should be installed on all computers "
14904
"required to be automatically configured. Both programs are easy to install "
14905
"and configure and will be automatically started at system boot."
14906
msgstr ""
14907
14908
#: serverguide/C/network-config.xml:974(para)
14909
msgid ""
14910
"At a terminal prompt, enter the following command to install "
14911
"<application>dhcpd</application>:"
14912
msgstr ""
14913
"Dalam terminal promp, masukkan perintah berikut untuk menginstall "
14914
"<application>dhcpd</application>:"
14915
14916
#: serverguide/C/network-config.xml:979(command)
14917
msgid "sudo apt install isc-dhcp-server"
14918
msgstr ""
14919
14920
#: serverguide/C/network-config.xml:981(para)
14921
msgid ""
14922
"You will probably need to change the default configuration by editing "
14923
"/etc/dhcp/dhcpd.conf to suit your needs and particular configuration."
14924
msgstr ""
14925
14926
#: serverguide/C/network-config.xml:985(para)
14927
msgid ""
14928
"You also may need to edit /etc/default/isc-dhcp-server to specify the "
14929
"interfaces dhcpd should listen to."
14930
msgstr ""
14931
14932
#: serverguide/C/network-config.xml:989(para)
14933
msgid ""
14934
"NOTE: dhcpd's messages are being sent to syslog. Look there for diagnostics "
14935
"messages."
14936
msgstr ""
14937
14938
#: serverguide/C/network-config.xml:996(para)
14939
msgid ""
14940
"The error message the installation ends with might be a little confusing, "
14941
"but the following steps will help you configure the service:"
14942
msgstr ""
14943
14944
#: serverguide/C/network-config.xml:1000(para)
14945
msgid ""
14946
"Most commonly, what you want to do is assign an IP address randomly. This "
14947
"can be done with settings as follows:"
14948
msgstr ""
14949
14950
#: serverguide/C/network-config.xml:1004(programlisting)
14951
#, no-wrap
14952
msgid ""
14953
"\n"
14954
"# minimal sample /etc/dhcp/dhcpd.conf\n"
14955
"default-lease-time 600;\n"
14956
"max-lease-time 7200;\n"
14957
"\n"
14958
"subnet 192.168.1.0 netmask 255.255.255.0 {\n"
14959
" range 192.168.1.150 192.168.1.200;\n"
14960
" option routers 192.168.1.254;\n"
14961
" option domain-name-servers 192.168.1.1, 192.168.1.2;\n"
14962
" option domain-name \"mydomain.example\";\n"
14963
"} \n"
14964
msgstr ""
14965
14966
#: serverguide/C/network-config.xml:1016(para)
14967
msgid ""
14968
"This will result in the DHCP server giving clients an IP address from the "
14969
"range 192.168.1.150-192.168.1.200. It will lease an IP address for 600 "
14970
"seconds if the client doesn't ask for a specific time frame. Otherwise the "
14971
"maximum (allowed) lease will be 7200 seconds. The server will also "
14972
"\"advise\" the client to use 192.168.1.254 as the default-gateway and "
14973
"192.168.1.1 and 192.168.1.2 as its DNS servers."
14974
msgstr ""
14975
14976
#: serverguide/C/network-config.xml:1024(para)
14977
msgid ""
14978
"After changing the config file you have to restart the "
14979
"<application>dhcpd</application>:"
14980
msgstr ""
14981
14982
#: serverguide/C/network-config.xml:1029(command)
14983
msgid "sudo systemctl restart isc-dhcp-server.service"
14984
msgstr ""
14985
14986
#: serverguide/C/network-config.xml:1037(para)
14987
msgid ""
14988
"The <ulink url=\"https://help.ubuntu.com/community/dhcp3-server\">dhcp3-"
14989
"server Ubuntu Wiki</ulink> page has more information."
14990
msgstr ""
14991
14992
#: serverguide/C/network-config.xml:1042(para)
14993
msgid ""
14994
"For more <filename>/etc/dhcp/dhcpd.conf</filename> options see the <ulink "
14995
"url=\"http://manpages.ubuntu.com/manpages/xenial/en/man5/dhcpd.conf.5.html\">"
14996
"dhcpd.conf man page</ulink>."
14997
msgstr ""
14998
14999
#: serverguide/C/network-config.xml:1049(ulink)
15000
msgid "ISC dhcp-server"
15001
msgstr ""
15002
15003
#: serverguide/C/network-config.xml:1058(title)
15004
msgid "Time Synchronisation"
15005
msgstr ""
15006
15007
#: serverguide/C/network-config.xml:1059(para)
15008
msgid ""
15009
"NTP is a TCP/IP protocol for synchronising time over a network. Basically a "
15010
"client requests the current time from a server, and uses it to set its own "
15011
"clock."
15012
msgstr ""
15013
"NTP ada TPC/IP protocol untuk sinkronisasi waktu melalui jaringan. Secara "
15014
"mendasar dari sisi klien meminta nilai waktu di server, dan diset di "
15015
"komputer sisi klien."
15016
15017
#: serverguide/C/network-config.xml:1062(para)
15018
msgid ""
15019
"Behind this simple description, there is a lot of complexity - there are "
15020
"tiers of NTP servers, with the tier one NTP servers connected to atomic "
15021
"clocks, and tier two and three servers spreading the load of actually "
15022
"handling requests across the Internet. Also the client software is a lot "
15023
"more complex than you might think - it has to factor out communication "
15024
"delays, and adjust the time in a way that does not upset all the other "
15025
"processes that run on the server. But luckily all that complexity is hidden "
15026
"from you!"
15027
msgstr ""
15028
15029
#: serverguide/C/network-config.xml:1065(para)
15030
msgid ""
15031
"Ubuntu by default uses <emphasis>timedatectl / timesyncd</emphasis> to "
15032
"synchronize time and users can optionally use ntpd to serve network time "
15033
"info."
15034
msgstr ""
15035
15036
#: serverguide/C/network-config.xml:1070(title)
15037
msgid "Synchronizing your systems time"
15038
msgstr ""
15039
15040
#: serverguide/C/network-config.xml:1071(para)
15041
msgid ""
15042
"Starting with Ubuntu 16.04 <emphasis>timedatectl / timesyncd</emphasis> "
15043
"(which are part of systemd) replace most of <emphasis>ntpdate / "
15044
"ntp</emphasis>."
15045
msgstr ""
15046
15047
#: serverguide/C/network-config.xml:1074(para)
15048
msgid ""
15049
"<application>timesyncd</application> is available by default and replaces "
15050
"not only <application>ntpdate</application>, but also the client portion of "
15051
"<application>ntpd</application>. So on top of the one-shot action that "
15052
"<application>ntpdate</application> provided on boot and network activation, "
15053
"now <application>timesyncd</application> by default regularly checks and "
15054
"keeps your local time in sync. It also stores time updates locally, so that "
15055
"after reboots monotonically advances if applicable."
15056
msgstr ""
15057
15058
#: serverguide/C/network-config.xml:1079(para)
15059
msgid ""
15060
"If <application>ntpdate / ntp</application> are installed "
15061
"<application>timedatectl</application> steps back to let you keep your old "
15062
"setup. That shall ensure that no two time syncing services are fighting and "
15063
"also to retain any kind of old behaviour/config that you had through an "
15064
"upgrade. But it also implies that on an upgrade from a former release "
15065
"ntp/ntpdate might still be installed and therefore renders the new systemd "
15066
"based services disabled."
15067
msgstr ""
15068
15069
#: serverguide/C/network-config.xml:1084(para)
15070
msgid ""
15071
"<application>ntpdate</application> is considered deprecated in favour of "
15072
"<application>timedatectl</application> and thereby no more installed by "
15073
"default."
15074
msgstr ""
15075
15076
#: serverguide/C/network-config.xml:1089(title)
15077
msgid "Configuring timedatectl and timesyncd"
15078
msgstr ""
15079
15080
#: serverguide/C/network-config.xml:1090(para)
15081
msgid ""
15082
"The current status of time and time configuration via "
15083
"<application>timedatectl</application> and "
15084
"<application>timesyncd</application> can be checked with "
15085
"<command>timedatectl status</command>."
15086
msgstr ""
15087
15088
#: serverguide/C/network-config.xml:1093(screen)
15089
#, no-wrap
15090
msgid ""
15091
"\n"
15092
"$ timedatectl status\n"
15093
" Local time: Mo 2017-06-26 12:16:16 CEST\n"
15094
" Universal time: Mo 2017-06-26 10:16:16 UTC\n"
15095
" RTC time: Mo 2017-06-26 10:16:16\n"
15096
" Time zone: Europe/Berlin (CEST, +0200)\n"
15097
" Network time on: yes\n"
15098
"NTP synchronized: yes\n"
15099
" RTC in local TZ: no\n"
15100
msgstr ""
15101
15102
#: serverguide/C/network-config.xml:1103(para)
15103
msgid ""
15104
"Via <application>timedatectl</application> an admin can control the "
15105
"timezone, how the system clock should relate to the hwclock and if permanent "
15106
"synronization should be enabled or not. See <command>man "
15107
"timedatectl</command> for more details."
15108
msgstr ""
15109
15110
#: serverguide/C/network-config.xml:1107(para)
15111
msgid ""
15112
"timesyncd itself is still a normal service, so you can check its status also "
15113
"more in detail via. <screen>\n"
15114
"$ systemctl status systemd-timesyncd\n"
15115
". systemd-timesyncd.service - Network Time Synchronization\n"
15116
" Loaded: loaded (/lib/systemd/system/systemd-timesyncd.service; enabled; "
15117
"vendor preset: enabled)\n"
15118
" Drop-In: /lib/systemd/system/systemd-timesyncd.service.d\n"
15119
" |_disable-with-time-daemon.conf\n"
15120
" Active: active (running) since Mo 2017-06-26 11:12:19 CEST; 30min ago\n"
15121
" Docs: man:systemd-timesyncd.service(8)\n"
15122
" Main PID: 12379 (systemd-timesyn)\n"
15123
" Status: \"Synchronized to time server [2001:67c:1560:8003::c8]:123 "
15124
"(ntp.ubuntu.com).\"\n"
15125
" Tasks: 2\n"
15126
" Memory: 424.0K\n"
15127
" CPU: 12ms\n"
15128
" CGroup: /system.slice/systemd-timesyncd.service\n"
15129
" |_12379 /lib/systemd/systemd-timesyncd\n"
15130
"\n"
15131
"Jun 26 11:12:19 lap systemd[1]: Starting Network Time Synchronization...\n"
15132
"Jun 26 11:12:19 lap systemd[1]: Started Network Time Synchronization.\n"
15133
"Jun 26 11:12:19 lap systemd-timesyncd[12379]: Synchronized to time server "
15134
"[2001:67c:1560:8003::c8]:123 (ntp.ubuntu.com).\n"
15135
"</screen>"
15136
msgstr ""
15137
15138
#: serverguide/C/network-config.xml:1130(para)
15139
msgid ""
15140
"The nameserver to fetch time for <application>timedatectl</application> and "
15141
"<application>timesyncd</application> from can be specified in "
15142
"<filename>/etc/systemd/timesyncd.conf</filename> and additional config files "
15143
"can be stored in <filename>/etc/systemd/timesyncd.conf.d/</filename>. The "
15144
"entries for NTP= and FallbackNTP= are space separated lists."
15145
msgstr ""
15146
15147
#: serverguide/C/network-config.xml:1139(title)
15148
msgid "Serving NTP"
15149
msgstr ""
15150
15151
#: serverguide/C/network-config.xml:1140(para)
15152
msgid ""
15153
"If on top of synchronizing your system you also want to serve NTP "
15154
"information you need an ntp server. The most classic and supported one is "
15155
"<application>ntpd</application>, but it is also very old so there also are "
15156
"<application>openntpd</application> and <application>chrony</application> as "
15157
"alternatives available in the archive."
15158
msgstr ""
15159
15160
#: serverguide/C/network-config.xml:1145(title)
15161
msgid "ntpd"
15162
msgstr "ntpd"
15163
15164
#: serverguide/C/network-config.xml:1146(para)
15165
msgid ""
15166
"The ntp daemon ntpd calculates the drift of your system clock and "
15167
"continuously adjusts it, so there are no large corrections that could lead "
15168
"to inconsistent logs for instance. The cost is a little processing power and "
15169
"memory, but for a modern server this is negligible."
15170
msgstr ""
15171
15172
#: serverguide/C/network-config.xml:1154(para)
15173
msgid "To install ntpd, from a terminal prompt enter:"
15174
msgstr ""
15175
15176
#: serverguide/C/network-config.xml:1158(command)
15177
msgid "sudo apt install ntp"
15178
msgstr ""
15179
15180
#: serverguide/C/network-config.xml:1165(para)
15181
msgid ""
15182
"Edit <filename>/etc/ntp.conf</filename> to add/remove server lines. By "
15183
"default these servers are configured:"
15184
msgstr ""
15185
15186
#: serverguide/C/network-config.xml:1170(programlisting)
15187
#, no-wrap
15188
msgid ""
15189
"\n"
15190
"# Use servers from the NTP Pool Project. Approved by Ubuntu Technical Board\n"
15191
"# on 2011-02-08 (LP: #104525). See http://www.pool.ntp.org/join.html for\n"
15192
"# more information.\n"
15193
"server 0.ubuntu.pool.ntp.org\n"
15194
"server 1.ubuntu.pool.ntp.org\n"
15195
"server 2.ubuntu.pool.ntp.org\n"
15196
"server 3.ubuntu.pool.ntp.org\n"
15197
msgstr ""
15198
15199
#: serverguide/C/network-config.xml:1180(para)
15200
msgid ""
15201
"After changing the config file you have to reload the "
15202
"<application>ntpd</application>:"
15203
msgstr ""
15204
15205
#: serverguide/C/network-config.xml:1185(command)
15206
msgid "sudo systemctl reload ntp.service"
15207
msgstr ""
15208
15209
#: serverguide/C/network-config.xml:1187(para)
15210
msgid ""
15211
"Of the pool number 2.ubuntu.pool.ntp.org as well as ntp.ubuntu.com also "
15212
"support ipv6 if needed. If one needs to force ipv6 there also is "
15213
"ipv6.ntp.ubuntu.com which is not configured by default."
15214
msgstr ""
15215
15216
#: serverguide/C/network-config.xml:1195(title)
15217
msgid "View status"
15218
msgstr ""
15219
15220
#: serverguide/C/network-config.xml:1196(para)
15221
msgid "Use ntpq to see more info:"
15222
msgstr ""
15223
15224
#: serverguide/C/network-config.xml:1200(command)
15225
msgid "# sudo ntpq -p"
15226
msgstr ""
15227
15228
#: serverguide/C/network-config.xml:1201(computeroutput)
15229
#, no-wrap
15230
msgid ""
15231
" remote refid st t when poll reach delay offset "
15232
"jitter\n"
15233
"============================================================================="
15234
"=\n"
15235
"+stratum2-2.NTP. 129.70.130.70 2 u 5 64 377 68.461 -44.274 "
15236
"110.334\n"
15237
"+ntp2.m-online.n 212.18.1.106 2 u 5 64 377 54.629 -27.318 "
15238
"78.882\n"
15239
"*145.253.66.170 .DCFa. 1 u 10 64 377 83.607 -30.159 "
15240
"68.343\n"
15241
"+stratum2-3.NTP. 129.70.130.70 2 u 5 64 357 68.795 -68.168 "
15242
"104.612\n"
15243
"+europium.canoni 193.79.237.14 2 u 63 64 337 81.534 -67.968 "
15244
"92.792"
15245
msgstr ""
15246
15247
#: serverguide/C/network-config.xml:1213(title)
15248
msgid "PPS Support"
15249
msgstr ""
15250
15251
#: serverguide/C/network-config.xml:1214(para)
15252
msgid ""
15253
"Since 16.04 ntp supports PPS discipline which can be used to augment ntp "
15254
"with local timesources for better accuracy. For more details on "
15255
"configuration see the external pps ressource listed below."
15256
msgstr ""
15257
15258
#: serverguide/C/network-config.xml:1227(para)
15259
msgid ""
15260
"See the <ulink url=\"https://help.ubuntu.com/community/UbuntuTime\">Ubuntu "
15261
"Time</ulink> wiki page for more information."
15262
msgstr ""
15263
15264
#: serverguide/C/network-config.xml:1233(ulink)
15265
msgid "ntp.org, home of the Network Time Protocol project"
15266
msgstr ""
15267
15268
#: serverguide/C/network-config.xml:1238(ulink)
15269
msgid "Freedesktop.org info on timedatectl"
15270
msgstr ""
15271
15272
#: serverguide/C/network-config.xml:1243(ulink)
15273
msgid "Freedesktop.org info on systemd-timesyncd service"
15274
msgstr ""
15275
15276
#: serverguide/C/network-config.xml:1248(ulink)
15277
msgid "ntp.org faq on configuring PPS"
15278
msgstr ""
15279
15280
#: serverguide/C/network-config.xml:1257(title)
15281
msgid "Data Plane Development Kit"
15282
msgstr ""
15283
15284
#: serverguide/C/network-config.xml:1258(para)
15285
msgid ""
15286
"The DPDK is a set of libraries and drivers for fast packet processing and "
15287
"runs mostly in Linux userland. It is a set of libraries that provide the so "
15288
"called \"Environment Abstraction Layer\" (EAL). The EAL hides the details of "
15289
"the environment and provides a standard programming interface. Common use "
15290
"cases are around special solutions for instance network function "
15291
"virtualization and advanced high-throughput network switching. The DPDK uses "
15292
"a run-to-completion model for fast data plane performance and accesses "
15293
"devices via polling to eliminate the latency of interrupt processing at the "
15294
"tradeoff of higher cpu consumption. It was designed to run on any "
15295
"processors. The first supported CPU was Intel x86 and it is now extended to "
15296
"IBM Power 8, EZchip TILE-Gx and ARM."
15297
msgstr ""
15298
15299
#: serverguide/C/network-config.xml:1269(para)
15300
msgid ""
15301
"Ubuntu currently supports DPDK version 2.2 and provides some infrastructure "
15302
"to ease its usability."
15303
msgstr ""
15304
15305
#: serverguide/C/network-config.xml:1274(title)
15306
msgid "Prerequisites"
15307
msgstr ""
15308
15309
#: serverguide/C/network-config.xml:1275(para)
15310
msgid ""
15311
"This package is currently compiled for the lowest possible CPU requirements. "
15312
"Which still requires at least SSE3 to be supported by the CPU."
15313
msgstr ""
15314
15315
#: serverguide/C/network-config.xml:1278(para)
15316
msgid ""
15317
"The list of upstream DPDK supported network cards can be found at <ulink "
15318
"url=\"http://dpdk.org/doc/nics\">supported NICs</ulink>. But a lot of those "
15319
"are disabled by default in the upstream Project as they are not yet in a "
15320
"stable state. The subset of network cards that DPDK has enabled in the "
15321
"package as available in Ubuntu 16.04 is:"
15322
msgstr ""
15323
15324
#: serverguide/C/network-config.xml:1283(para)
15325
msgid "Intel"
15326
msgstr ""
15327
15328
#: serverguide/C/network-config.xml:1288(para)
15329
msgid ""
15330
"<ulink url=\"http://dpdk.org/doc/guides/nics/e1000em.html\">e1000</ulink> "
15331
"(82540, 82545, 82546)"
15332
msgstr ""
15333
15334
#: serverguide/C/network-config.xml:1291(para)
15335
msgid ""
15336
"<ulink "
15337
"url=\"http://dpdk.org/browse/dpdk/tree/drivers/net/e1000/\">e1000e</ulink> "
15338
"(82571..82574, 82583, ICH8..ICH10, PCH..PCH2)"
15339
msgstr ""
15340
15341
#: serverguide/C/network-config.xml:1294(para)
15342
msgid ""
15343
"<ulink "
15344
"url=\"http://dpdk.org/browse/dpdk/tree/drivers/net/e1000/\">igb</ulink> "
15345
"(82575..82576, 82580, I210, I211, I350, I354, DH89xx)"
15346
msgstr ""
15347
15348
#: serverguide/C/network-config.xml:1297(para)
15349
msgid ""
15350
"<ulink url=\"http://dpdk.org/doc/guides/nics/ixgbe.html\">ixgbe</ulink> "
15351
"(82598..82599, X540, X550)"
15352
msgstr ""
15353
15354
#: serverguide/C/network-config.xml:1300(para)
15355
msgid ""
15356
"<ulink "
15357
"url=\"http://dpdk.org/browse/dpdk/tree/drivers/net/i40e/\">i40e</ulink> "
15358
"(X710, XL710, X722)"
15359
msgstr ""
15360
15361
#: serverguide/C/network-config.xml:1303(para)
15362
msgid ""
15363
"<ulink url=\"http://dpdk.org/doc/guides/nics/fm10k.html\">fm10k</ulink> "
15364
"(FM10420)"
15365
msgstr ""
15366
15367
#: serverguide/C/network-config.xml:1306(para)
15368
msgid "Chelsio"
15369
msgstr ""
15370
15371
#: serverguide/C/network-config.xml:1311(para)
15372
msgid ""
15373
"<ulink url=\"http://dpdk.org/doc/guides/nics/cxgbe.html\">cxgbe</ulink> "
15374
"(Terminator 5)"
15375
msgstr ""
15376
15377
#: serverguide/C/network-config.xml:1314(para)
15378
msgid "Cisco"
15379
msgstr ""
15380
15381
#: serverguide/C/network-config.xml:1319(para)
15382
msgid ""
15383
"<ulink "
15384
"url=\"http://dpdk.org/browse/dpdk/tree/drivers/net/enic\">enic</ulink> (UCS "
15385
"Virtual Interface Card)"
15386
msgstr ""
15387
15388
#: serverguide/C/network-config.xml:1322(para) serverguide/C/network-config.xml:1347(para)
15389
msgid "Paravirtualization"
15390
msgstr ""
15391
15392
#: serverguide/C/network-config.xml:1327(para)
15393
msgid ""
15394
"<ulink url=\"http://dpdk.org/doc/guides/nics/virtio.html\">virtio-"
15395
"net</ulink> (QEMU)"
15396
msgstr ""
15397
15398
#: serverguide/C/network-config.xml:1330(ulink)
15399
msgid "vmxnet3"
15400
msgstr ""
15401
15402
#: serverguide/C/network-config.xml:1333(para) serverguide/C/network-config.xml:1355(para)
15403
msgid "Others"
15404
msgstr ""
15405
15406
#: serverguide/C/network-config.xml:1338(para)
15407
msgid ""
15408
"<ulink "
15409
"url=\"http://dpdk.org/browse/dpdk/tree/drivers/net/af_packet\">af_packet</uli"
15410
"nk> (Linux AF_PACKET socket)"
15411
msgstr ""
15412
15413
#: serverguide/C/network-config.xml:1341(para)
15414
msgid ""
15415
"<ulink url=\"http://dpdk.org/doc/guides/nics/pcap_ring.html#rings-based-"
15416
"pmd\">ring</ulink> (memory)"
15417
msgstr ""
15418
15419
#: serverguide/C/network-config.xml:1344(para)
15420
msgid ""
15421
"On top it experimentally enables the following two PMD drivers as they "
15422
"represent (virtual) devices that are very accessible to end users."
15423
msgstr ""
15424
15425
#: serverguide/C/network-config.xml:1352(para)
15426
msgid ""
15427
"<ulink url=\"http://dpdk.org/doc/guides/xen/pkt_switch.html#xen-pmd-frontend-"
15428
"prerequisites\">xenvirt</ulink> (Xen)"
15429
msgstr ""
15430
15431
#: serverguide/C/network-config.xml:1360(para)
15432
msgid ""
15433
"<ulink url=\"http://dpdk.org/doc/guides/nics/pcap_ring.html#libpcap-based-"
15434
"pmd\">pcap</ulink> (file or kernel driver)"
15435
msgstr ""
15436
15437
#: serverguide/C/network-config.xml:1363(para)
15438
msgid ""
15439
"Cards have to be unassigned from their kernel driver and instead be assigned "
15440
"to uio_pci_generic of vfio-pci. uio_pci_generic is older and usually getting "
15441
"to work more easily."
15442
msgstr ""
15443
15444
#: serverguide/C/network-config.xml:1367(para)
15445
msgid ""
15446
"The newer vfio-pci requires that you activate the following kernel "
15447
"parameters to enable iommu."
15448
msgstr ""
15449
15450
#: serverguide/C/network-config.xml:1370(programlisting)
15451
#, no-wrap
15452
msgid ""
15453
"\n"
15454
"iommu=pt intel_iommu=on\n"
15455
"\t\t "
15456
msgstr ""
15457
15458
#: serverguide/C/network-config.xml:1373(para)
15459
msgid ""
15460
"On top for vfio-pci you then have to configure and assign the iommu groups "
15461
"accordingly."
15462
msgstr ""
15463
15464
#: serverguide/C/network-config.xml:1376(para)
15465
msgid ""
15466
"Note: In virtio based environment it is enough to \"unassign\" devices from "
15467
"the kernel driver. Without that DPDK will reject to use the device to avoid "
15468
"issues with kernel and DPDK working on the device at the same time. Since "
15469
"DPDK can work directly on virtio devices it is not required to assign e.g. "
15470
"uio_pci_generic to those devices."
15471
msgstr ""
15472
15473
#: serverguide/C/network-config.xml:1381(para)
15474
msgid ""
15475
"Manual configuration and status checks can be done via sysfs or with the "
15476
"tool dpdk_nic_bind"
15477
msgstr ""
15478
15479
#: serverguide/C/network-config.xml:1384(programlisting)
15480
#, no-wrap
15481
msgid ""
15482
"\n"
15483
"dpdk_nic_bind --help\n"
15484
"\n"
15485
"Usage:\n"
15486
"------\n"
15487
"\n"
15488
" dpdk_nic_bind [options] DEVICE1 DEVICE2 ....\n"
15489
"\n"
15490
" where DEVICE1, DEVICE2 etc, are specified via PCI "
15491
"\"domain:bus:slot.func\" syntax\n"
15492
" or \"bus:slot.func\" syntax. For devices bound to Linux kernel drivers, "
15493
"they may\n"
15494
" also be referred to by Linux interface name e.g. eth0, eth1, em0, em1, "
15495
"etc.\n"
15496
"\n"
15497
" Options:\n"
15498
" --help, --usage:\n"
15499
" Display usage information and quit\n"
15500
"\n"
15501
" -s, --status:\n"
15502
" Print the current status of all known network interfaces.\n"
15503
" For each device, it displays the PCI domain, bus, slot and "
15504
"function,\n"
15505
" along with a text description of the device. Depending upon "
15506
"whether the\n"
15507
" device is being used by a kernel driver, the igb_uio driver, or "
15508
"no\n"
15509
" driver, other relevant information will be displayed:\n"
15510
" * the Linux interface name e.g. if=eth0\n"
15511
" * the driver being used e.g. drv=igb_uio\n"
15512
" * any suitable drivers not currently using that device\n"
15513
" e.g. unused=igb_uio\n"
15514
" NOTE: if this flag is passed along with a bind/unbind option, the "
15515
"status\n"
15516
" display will always occur after the other operations have taken "
15517
"place.\n"
15518
"\n"
15519
" -b driver, --bind=driver:\n"
15520
" Select the driver to use or \"none\" to unbind the device\n"
15521
"\n"
15522
" -u, --unbind:\n"
15523
" Unbind a device (Equivalent to \"-b none\")\n"
15524
"\n"
15525
" --force:\n"
15526
" By default, devices which are used by Linux - as indicated by "
15527
"having\n"
15528
" routes in the routing table - cannot be modified. Using the --"
15529
"force\n"
15530
" flag overrides this behavior, allowing active links to be "
15531
"forcibly\n"
15532
" unbound.\n"
15533
" WARNING: This can lead to loss of network connection and should "
15534
"be used\n"
15535
" with caution.\n"
15536
"\n"
15537
" Examples:\n"
15538
" ---------\n"
15539
"\n"
15540
" To display current device status:\n"
15541
" dpdk_nic_bind --status\n"
15542
"\n"
15543
" To bind eth1 from the current driver and move to use igb_uio\n"
15544
" dpdk_nic_bind --bind=igb_uio eth1\n"
15545
"\n"
15546
" To unbind 0000:01:00.0 from using any driver\n"
15547
" dpdk_nic_bind -u 0000:01:00.0\n"
15548
"\n"
15549
" To bind 0000:02:00.0 and 0000:02:00.1 to the ixgbe kernel driver\n"
15550
" dpdk_nic_bind -b ixgbe 02:00.0 02:00.\n"
15551
msgstr ""
15552
15553
#: serverguide/C/network-config.xml:1445(title)
15554
msgid "DPDK Device configuration"
15555
msgstr ""
15556
15557
#: serverguide/C/network-config.xml:1446(para)
15558
msgid ""
15559
"The package <emphasis>dpdk</emphasis> provides init scripts that ease "
15560
"configuration of device assignment and huge pages. It also makes them "
15561
"persistent accross reboots."
15562
msgstr ""
15563
15564
#: serverguide/C/network-config.xml:1450(para)
15565
msgid ""
15566
"The following is an example of the file /etc/dpdk/interfaces configuring two "
15567
"ports of a network card. One with uio_pci_generic and the other one with "
15568
"vfio-pci"
15569
msgstr ""
15570
15571
#: serverguide/C/network-config.xml:1454(programlisting)
15572
#, no-wrap
15573
msgid ""
15574
"\n"
15575
"# <bus> Currently only \"pci\" is supported\n"
15576
"# <id> Device ID on the specified bus\n"
15577
"# <driver> Driver to bind against (vfio-pci or uio_pci_generic)\n"
15578
"#\n"
15579
"# Be aware that the two DPDK compatible drivers uio_pci_generic and vfio-pci "
15580
"are\n"
15581
"# part of linux-image-extra-<VERSION> package.\n"
15582
"# This package is not always installed by default - for example in cloud-"
15583
"images.\n"
15584
"# So please install it in case you run into missing module issues.\n"
15585
"#\n"
15586
"# <bus> <id> <driver>\n"
15587
"pci 0000:04:00.0 uio_pci_generic\n"
15588
"pci 0000:04:00.1 vfio-pci\n"
15589
"\t\t "
15590
msgstr ""
15591
15592
#: serverguide/C/network-config.xml:1468(para)
15593
msgid ""
15594
"Cards are identified by their PCI-ID. If you are unsure you might use the "
15595
"tool dpdk_nic_bind to show the current available devices and the drivers "
15596
"they are assigned to."
15597
msgstr ""
15598
15599
#: serverguide/C/network-config.xml:1472(command)
15600
msgid "dpdk_nic_bind --status"
15601
msgstr ""
15602
15603
#: serverguide/C/network-config.xml:1473(computeroutput)
15604
#, no-wrap
15605
msgid ""
15606
"\n"
15607
"Network devices using DPDK-compatible driver\n"
15608
"============================================\n"
15609
"0000:04:00.0 'Ethernet Controller 10-Gigabit X540-AT2' drv=uio_pci_generic "
15610
"unused=ixgbe\n"
15611
"\n"
15612
"Network devices using kernel driver\n"
15613
"===================================\n"
15614
"0000:02:00.0 'NetXtreme BCM5719 Gigabit Ethernet PCIe' if=eth0 drv=tg3 "
15615
"unused=uio_pci_generic *Active*\n"
15616
"0000:02:00.1 'NetXtreme BCM5719 Gigabit Ethernet PCIe' if=eth1 drv=tg3 "
15617
"unused=uio_pci_generic \n"
15618
"0000:02:00.2 'NetXtreme BCM5719 Gigabit Ethernet PCIe' if=eth2 drv=tg3 "
15619
"unused=uio_pci_generic \n"
15620
"0000:02:00.3 'NetXtreme BCM5719 Gigabit Ethernet PCIe' if=eth3 drv=tg3 "
15621
"unused=uio_pci_generic \n"
15622
"0000:04:00.1 'Ethernet Controller 10-Gigabit X540-AT2' if=eth5 drv=ixgbe "
15623
"unused=uio_pci_generic \n"
15624
"\n"
15625
"Other network devices\n"
15626
"=====================\n"
15627
"<none>\n"
15628
msgstr ""
15629
15630
#: serverguide/C/network-config.xml:1494(title)
15631
msgid "DPDK HugePage configuration"
15632
msgstr ""
15633
15634
#: serverguide/C/network-config.xml:1495(para)
15635
msgid ""
15636
"DPDK makes heavy use of huge pages to eliminate pressure on the TLB. "
15637
"Therefore hugepages have to be configured in your system."
15638
msgstr ""
15639
15640
#: serverguide/C/network-config.xml:1499(para)
15641
msgid ""
15642
"The <emphasis>dpdk</emphasis> package has a config file and scripts that try "
15643
"to ease hugepage configuration for DPDK in the form of "
15644
"<emphasis>/etc/dpdk/dpdk.conf</emphasis>. If you have more consumers of "
15645
"hugepages than just DPDK in your system or very special requirements how "
15646
"your hugepages are going to be set up you likely want to allocate/control "
15647
"them by yourself. If not this can be a great simplification to get DPDK "
15648
"configured for your needs."
15649
msgstr ""
15650
15651
#: serverguide/C/network-config.xml:1504(para)
15652
msgid "Here an example configuring 1024 Hugepages of 2M each and 4 1G pages."
15653
msgstr ""
15654
15655
#: serverguide/C/network-config.xml:1507(programlisting)
15656
#, no-wrap
15657
msgid ""
15658
"\n"
15659
"NR_2M_PAGES=1024\n"
15660
"NR_1G_PAGES=4\n"
15661
"\t\t "
15662
msgstr ""
15663
15664
#: serverguide/C/network-config.xml:1511(para)
15665
msgid ""
15666
"As shown this supports configuring 2M and the larger 1G hugepages (or a mix "
15667
"of both). It will make sure there are proper hugetlbfs mountpoints for DPDK "
15668
"to find both sizes no matter what your default huge page size is. The config "
15669
"file itself holds more details on certain corner cases and a few hints if "
15670
"you want to allocate hugepages manually via a kernel parameter."
15671
msgstr ""
15672
15673
#: serverguide/C/network-config.xml:1516(para)
15674
msgid ""
15675
"It depends on your needs which size you want - 1G pages are certainly more "
15676
"effective regarding TLB pressure. But there were reports of them fragmenting "
15677
"inside the DPDK memory alloactions. Also it can be harder to grab enough "
15678
"free space to set up a certain amount of 1G pages later in the lifecycle of "
15679
"a system."
15680
msgstr ""
15681
15682
#: serverguide/C/network-config.xml:1524(title)
15683
msgid "Compile DPDK Applications"
15684
msgstr ""
15685
15686
#: serverguide/C/network-config.xml:1525(para)
15687
msgid ""
15688
"Currently there are not a lot consumers of the DPDK library that are stable "
15689
"and released. OpenVswitch-DPDK being an exception to that (see below), but "
15690
"in general it is very likely that you might want / have to compile an app "
15691
"against the library."
15692
msgstr ""
15693
15694
#: serverguide/C/network-config.xml:1529(para)
15695
msgid ""
15696
"You will often find guides that tell you to fetch the DPDK sources, build "
15697
"them to your needs and eventually build your application based on DPDK by "
15698
"setting values RTE_* for the build system. Since Ubunutu provides an already "
15699
"compiled DPDK for you can can skip all that. To simplify setting the proper "
15700
"variables you can source the file /usr/share/dpdk/dpdk-sdk-env.sh before "
15701
"building your application. Here an excerpt building the l2fwd example "
15702
"application delivered with the dpdk-doc package."
15703
msgstr ""
15704
15705
#: serverguide/C/network-config.xml:1535(programlisting)
15706
#, no-wrap
15707
msgid ""
15708
"\n"
15709
"sudo apt-get install dpdk-dev libdpdk-dev\n"
15710
". /usr/share/dpdk/dpdk-sdk-env.sh\n"
15711
"make -C /usr/share/dpdk/examples/l2fwd\n"
15712
"\t\t "
15713
msgstr ""
15714
15715
#: serverguide/C/network-config.xml:1540(para)
15716
msgid ""
15717
"Depending on what you build it might be a good addition to install all of "
15718
"DPDK build dependencies before the make."
15719
msgstr ""
15720
15721
#: serverguide/C/network-config.xml:1543(programlisting)
15722
#, no-wrap
15723
msgid ""
15724
"\n"
15725
"sudo apt-get install build-dep dpdk\n"
15726
"\t\t "
15727
msgstr ""
15728
15729
#: serverguide/C/network-config.xml:1549(title)
15730
msgid "OpenVswitch-DPDK"
15731
msgstr ""
15732
15733
#: serverguide/C/network-config.xml:1550(para)
15734
msgid ""
15735
"Being a library it doesn't do a lot on its own, so it depends on emerging "
15736
"projects making use of it. One consumer of the library that already is "
15737
"bundled in the Ubuntu 16.04 release is OpenVswitch with DPDK support in the "
15738
"package openvswitch-switch-dpdk."
15739
msgstr ""
15740
15741
#: serverguide/C/network-config.xml:1554(para)
15742
msgid ""
15743
"Here an example how to install and configure a basic OpenVswitch using DPDK "
15744
"for later use via libvirt/qemu-kvm."
15745
msgstr ""
15746
15747
#: serverguide/C/network-config.xml:1557(programlisting)
15748
#, no-wrap
15749
msgid ""
15750
"\n"
15751
"sudo apt-get install openvswitch-switch-dpdk\n"
15752
"sudo update-alternatives --set ovs-vswitchd /usr/lib/openvswitch-switch-"
15753
"dpdk/ovs-vswitchd-dpdk\n"
15754
"echo \"DPDK_OPTS='--dpdk -c 0x1 -n 4 -m 2048 --vhost-owner libvirt-qemu:kvm -"
15755
"-vhost-perm 0664'\" | sudo tee -a /etc/default/openvswitch-switch\n"
15756
"sudo service openvswitch-switch restart\n"
15757
"\t\t "
15758
msgstr ""
15759
15760
#: serverguide/C/network-config.xml:1563(para)
15761
msgid ""
15762
"Please remember that you have to assign devices to DPDK compatible drivers "
15763
"(see above) before restarting."
15764
msgstr ""
15765
15766
#: serverguide/C/network-config.xml:1566(para)
15767
msgid ""
15768
"The section <emphasis>--vhost-owner libvirt-qemu:kvm --vhost-perm "
15769
"0664</emphasis> will set vhost_user ports up with owner/permissions to be "
15770
"compatible with Ubuntus way of running qemu-kvm/libvirt with reduced "
15771
"privileges for more security."
15772
msgstr ""
15773
15774
#: serverguide/C/network-config.xml:1569(para)
15775
msgid ""
15776
"Please note that the section <emphasis>-m 2048</emphasis> is the most basic "
15777
"numa setup for a single socket system. If you have multiple sockets you "
15778
"might want to define how to split your memory among them, for example "
15779
"<emphasis>-m 1024, 1024</emphasis>. Please be aware that DPDK will try to "
15780
"work only with local memory to the network cards it works with (for "
15781
"performance reasons). That said if you have multiple nodes, but all network "
15782
"cards on one, you should consider spreading your cards. If not at least "
15783
"allocate your memory to the node where the cards reside, for example in a "
15784
"two node all to node #2: <emphasis>-m 0, 2048</emphasis>. You can use the "
15785
"tool <emphasis>lstopo</emphasis> from the package <emphasis>hwloc-"
15786
"nox</emphasis> to see on which socket your cards are located."
15787
msgstr ""
15788
15789
#: serverguide/C/network-config.xml:1577(para)
15790
msgid ""
15791
"The OpenVswitch you now started supports all port types OpenVswitch usually "
15792
"does, plus DPDK port types. Here an example how to create a bridge and - "
15793
"instead of a normal external port - add an external DPDK port to it."
15794
msgstr ""
15795
15796
#: serverguide/C/network-config.xml:1581(programlisting)
15797
#, no-wrap
15798
msgid ""
15799
"\n"
15800
"ovs-vsctl add-br ovsdpdkbr0 -- set bridge ovsdpdkbr0 datapath_type=netdev\n"
15801
"ovs-vsctl add-port ovsdpdkbr0 dpdk0 -- set Interface dpdk0 type=dpdk\n"
15802
"\t\t "
15803
msgstr ""
15804
15805
#: serverguide/C/network-config.xml:1586(para)
15806
msgid ""
15807
"The enablement of DPDK in Open vSwitch has changed in version 2.6. So for "
15808
"users of releases >=16.10, but also for users of the <ulink "
15809
"url=\"https://wiki.ubuntu.com/OpenStack/CloudArchive\">Ubuntu Cloud "
15810
"Archive</ulink> >=neutron the enablement has changed compared to that for "
15811
"users of Ubuntu 16.04. The options formerly passed via "
15812
"<emphasis>DPDK_OPTS</emphasis> are now configured via ovs-vsctl into the "
15813
"Open vSwitch configuration database."
15814
msgstr ""
15815
15816
#: serverguide/C/network-config.xml:1591(para)
15817
msgid "The same example as above would in the new way look like:"
15818
msgstr ""
15819
15820
#: serverguide/C/network-config.xml:1594(programlisting)
15821
#, no-wrap
15822
msgid ""
15823
"\n"
15824
"# Enable DPDK\n"
15825
"ovs-vsctl set Open_vSwitch . \"other_config:dpdk-init=true\"\n"
15826
"# run on core 0\n"
15827
"ovs-vsctl set Open_vSwitch . \"other_config:dpdk-lcore-mask=0x1\"\n"
15828
"# Allocate 2G huge pages (not Numa node aware)\n"
15829
"ovs-vsctl set Open_vSwitch . \"other_config:dpdk-alloc-mem=2048\"\n"
15830
"# group/permissions for vhost-user sockets (required to work with "
15831
"libvirt/qemu)\n"
15832
"ovs-vsctl set Open_vSwitch . \\\n"
15833
" \"other_config:dpdk-extra=--vhost-owner libvirt-qemu:kvm --vhost-perm "
15834
"0666\"\n"
15835
"\t\t "
15836
msgstr ""
15837
15838
#: serverguide/C/network-config.xml:1609(filename)
15839
msgid "/usr/share/doc/openvswitch-common/INSTALL.DPDK.md.gz"
15840
msgstr ""
15841
15842
#: serverguide/C/network-config.xml:1610(filename)
15843
msgid "/usr/share/doc/openvswitch-common/INSTALL.DPDK-ADVANCED.md.gz"
15844
msgstr ""
15845
15846
#: serverguide/C/network-config.xml:1611(command)
15847
msgid "man ovs-vswitchd.conf.db"
15848
msgstr ""
15849
15850
#: serverguide/C/network-config.xml:1605(para)
15851
msgid ""
15852
"Please see the associated upstream documentation and the man page of the "
15853
"vswitch configuration as provided by the package for more details: "
15854
"<placeholder-1/>"
15855
msgstr ""
15856
15857
#: serverguide/C/network-config.xml:1618(title)
15858
msgid "OpenVswitch DPDK to KVM Guests"
15859
msgstr ""
15860
15861
#: serverguide/C/network-config.xml:1619(para)
15862
msgid ""
15863
"If you are not building some sort of SDN switch or NFV on top of DPDK it is "
15864
"very likely that you want to forward traffic to KVM guests. The good news "
15865
"is, that with the new qemu/libvirt/dpdk/openvswitch versions in Ubuntu 16.04 "
15866
"this is no more about manually appending commandline string. This chapter "
15867
"covers a basic configuration how to connect a KVM guest to a OpenVswitch-"
15868
"DPDK instance."
15869
msgstr ""
15870
15871
#: serverguide/C/network-config.xml:1624(para)
15872
msgid ""
15873
"The Guest has to be backed by shared hugepages for DPDK/vhost_user to work. "
15874
"To ensure in general that libvirt/qemu-kvm finds a proper hugepage "
15875
"mountpoint you can just enable KVM_HUGEPAGES in /etc/default/qemu-kvm. "
15876
"Afterwards restart the service to pick up the changed configuration."
15877
msgstr ""
15878
15879
#: serverguide/C/network-config.xml:1629(programlisting)
15880
#, no-wrap
15881
msgid ""
15882
"\n"
15883
"sed -ri -e 's,(KVM_HUGEPAGES=).*,\\11,' /etc/default/qemu-kvm\n"
15884
"service qemu-kvm restart\n"
15885
"\t\t "
15886
msgstr ""
15887
15888
#: serverguide/C/network-config.xml:1633(para)
15889
msgid ""
15890
"To let a guest be backed by hugepages is now also supported via recent "
15891
"libvirt, just add the following snippet to your virsh xml (or the equivalent "
15892
"libvirt interface you use). Those xmls can also be used as templates to "
15893
"easily spawn guests with \"uvt-kvm create\"."
15894
msgstr ""
15895
15896
#: serverguide/C/network-config.xml:1637(programlisting)
15897
#, no-wrap
15898
msgid ""
15899
"\n"
15900
"<numa>\n"
15901
"<cell id='0' cpus='0' memory='6291456' unit='KiB' "
15902
"memAccess='shared'/>\n"
15903
"</numa>\n"
15904
"[...]\n"
15905
"<memoryBacking>\n"
15906
"<hugepages>\n"
15907
"<page size=\"2\" unit=\"M\" nodeset=\"0\"/>\n"
15908
"</hugepages>\n"
15909
"</memoryBacking>\n"
15910
"\t\t "
15911
msgstr ""
15912
15913
#: serverguide/C/network-config.xml:1648(para)
15914
msgid ""
15915
"The new and recommended way to get to a KVM guest is using vhost_user. This "
15916
"will cause DPDK to create a socket that qemu will connect the guest to. Here "
15917
"an example how to add such a port to the bridge you created (see above)."
15918
msgstr ""
15919
15920
#: serverguide/C/network-config.xml:1653(programlisting)
15921
#, no-wrap
15922
msgid ""
15923
"\n"
15924
"ovs-vsctl add-port ovsdpdkbr0 vhost-user-1 -- set Interface vhost-user-1 "
15925
"type=dpdkvhostuser\n"
15926
"\t\t "
15927
msgstr ""
15928
15929
#: serverguide/C/network-config.xml:1656(para)
15930
msgid ""
15931
"This will create a vhost_user socket at /var/run/openvswitch/vhost-user-1"
15932
msgstr ""
15933
15934
#: serverguide/C/network-config.xml:1659(para)
15935
msgid ""
15936
"To let libvirt/kvm consume this socket and create a guest virtio network "
15937
"device for it add a snippet like this to your guest definition as the "
15938
"network definition."
15939
msgstr ""
15940
15941
#: serverguide/C/network-config.xml:1662(programlisting)
15942
#, no-wrap
15943
msgid ""
15944
"\n"
15945
"<interface type='vhostuser'>\n"
15946
"<source type='unix'\n"
15947
"path='/var/run/openvswitch/vhost-user-1'\n"
15948
"mode='client'/>\n"
15949
"<model type='virtio'/>\n"
15950
"</interface>\n"
15951
"\t\t "
15952
msgstr ""
15953
15954
#: serverguide/C/network-config.xml:1673(title)
15955
msgid "DPDK in KVM Guests"
15956
msgstr ""
15957
15958
#: serverguide/C/network-config.xml:1674(para)
15959
msgid ""
15960
"If you have no access to DPDK supported network cards you can still work "
15961
"with DPDK by using its support for virtio. To do so you have to create "
15962
"guests backed by hugepages (see above)."
15963
msgstr ""
15964
15965
#: serverguide/C/network-config.xml:1678(para)
15966
msgid ""
15967
"On top of that there it is required to have at least SSE3. The default CPU "
15968
"model qemu/libvirt uses is only up to SSE2. So you will have to define a "
15969
"model that passed the proper feature flag - and of course have a Host system "
15970
"that supportes it. An example can be found in following snippet to your "
15971
"virsh xml (or the equivalent virsh interface you use)."
15972
msgstr ""
15973
15974
#: serverguide/C/network-config.xml:1684(programlisting)
15975
#, no-wrap
15976
msgid ""
15977
"\n"
15978
"<cpu mode='host-passthrough'>\n"
15979
"\t\t "
15980
msgstr ""
15981
15982
#: serverguide/C/network-config.xml:1687(para)
15983
msgid ""
15984
"This example is rather offensive and passes all host features. That in turn "
15985
"makes the guest not very migratable as the target would need all the "
15986
"features as well. A \"softer\" way is to just add sse3 to the default model "
15987
"like the following example."
15988
msgstr ""
15989
15990
#: serverguide/C/network-config.xml:1692(programlisting)
15991
#, no-wrap
15992
msgid ""
15993
"\n"
15994
"<cpu mode='custom' match='exact'>\n"
15995
"<model fallback='allow'>qemu64</model>\n"
15996
"<feature policy='require' name='ssse3'/>\n"
15997
"</cpu>\n"
15998
"\t\t "
15999
msgstr ""
16000
16001
#: serverguide/C/network-config.xml:1698(para)
16002
msgid ""
16003
"Also virtio nowadays supports multiqueue which DPDK in turn can exploit for "
16004
"better speed. To modify a normal virtio definition to have multiple queues "
16005
"add the following to your interface definition. This is about enhancing a "
16006
"normal virtio nic to have multiple queues, to later on be consumed e.g. by "
16007
"DPDK in the guest."
16008
msgstr ""
16009
16010
#: serverguide/C/network-config.xml:1703(programlisting)
16011
#, no-wrap
16012
msgid ""
16013
"\n"
16014
"<driver name=\"vhost\" queues=\"4\"/>\n"
16015
"\t\t "
16016
msgstr ""
16017
16018
#: serverguide/C/network-config.xml:1709(title)
16019
msgid "Tuning Openvswitch-DPDK"
16020
msgstr ""
16021
16022
#: serverguide/C/network-config.xml:1710(para)
16023
msgid ""
16024
"DPDK has plenty of options - in combination with Openvswitch-DPDK the two "
16025
"most commonly used are:"
16026
msgstr ""
16027
16028
#: serverguide/C/network-config.xml:1713(programlisting)
16029
#, no-wrap
16030
msgid ""
16031
"\n"
16032
"ovs-vsctl set Open_vSwitch . other_config:n-dpdk-rxqs=2\n"
16033
"ovs-vsctl set Open_vSwitch . other_config:pmd-cpu-mask=0x6\n"
16034
"\t\t "
16035
msgstr ""
16036
16037
#: serverguide/C/network-config.xml:1717(para)
16038
msgid ""
16039
"The first select how many rx queues are to be used for each DPDK interface, "
16040
"while the second controls how many and where to run PMD threads. The example "
16041
"above will utilize two rx queues and run PMD threads on CPU 1 and 2. See the "
16042
"referred links to \"EAL Command-line Options\" and \"OpenVswitch DPDK "
16043
"installation\" at the end of this document for more."
16044
msgstr ""
16045
16046
#: serverguide/C/network-config.xml:1722(para)
16047
msgid ""
16048
"As usual with tunings you have to know your system and workload really well -"
16049
" so please verify any tunings with workloads matching your real use case."
16050
msgstr ""
16051
16052
#: serverguide/C/network-config.xml:1729(para)
16053
msgid ""
16054
"DPDK is a fast evolving project. In any case of a search for support and "
16055
"further guides it is highly recommended to first check if they apply to the "
16056
"current version."
16057
msgstr ""
16058
16059
#: serverguide/C/network-config.xml:1737(ulink)
16060
msgid "DPDK Mailing Lists"
16061
msgstr ""
16062
16063
#: serverguide/C/network-config.xml:1741(para)
16064
msgid ""
16065
"For OpenVswitch-DPDK <ulink url=\"http://openvswitch.org/mlists\">OpenStack "
16066
"Mailing Lists</ulink>"
16067
msgstr ""
16068
16069
#: serverguide/C/network-config.xml:1746(para)
16070
msgid ""
16071
"Known issues in <ulink "
16072
"url=\"https://bugs.launchpad.net/ubuntu/+source/dpdk\">DPDK Launchpad "
16073
"Area</ulink>"
16074
msgstr ""
16075
16076
#: serverguide/C/network-config.xml:1751(para)
16077
msgid "Join the IRC channels #DPDK or #openvswitch on freenode."
16078
msgstr ""
16079
16080
#: serverguide/C/network-config.xml:1757(para)
16081
msgid ""
16082
"Issues are often due to missing small details in the general setup. Later "
16083
"on, these missing details cause problems which can be hard to track down to "
16084
"their root cause. A common case seems to be the \"could not open network "
16085
"device dpdk0 (No such device)\" issue. This occurs rather late when setting "
16086
"up a port in Open vSwitch with DPDK. But the root cause most of the time is "
16087
"very early in the setup and initialization. Here an example how a proper "
16088
"initialization of a device looks - this can be found in the syslog/journal "
16089
"when starting Open vSwitch with DPDK enabled."
16090
msgstr ""
16091
16092
#: serverguide/C/network-config.xml:1768(programlisting)
16093
#, no-wrap
16094
msgid ""
16095
"\n"
16096
"ovs-ctl[3560]: EAL: PCI device 0000:04:00.1 on NUMA socket 0\n"
16097
"ovs-ctl[3560]: EAL: probe driver: 8086:1528 rte_ixgbe_pmd\n"
16098
"ovs-ctl[3560]: EAL: PCI memory mapped at 0x7f2140000000\n"
16099
"ovs-ctl[3560]: EAL: PCI memory mapped at 0x7f2140200000\n"
16100
"\t\t "
16101
msgstr ""
16102
16103
#: serverguide/C/network-config.xml:1775(para)
16104
msgid ""
16105
"If this is missing, either by ignored cards, failed initialization or other "
16106
"reasons, later on there will be no DPDK device to refer to. Unfortunately "
16107
"the logging is spread across syslog/journal and the openvswitch log. To "
16108
"allow some cross checking here an example what can be found in these logs, "
16109
"relative to the entered command."
16110
msgstr ""
16111
16112
#: serverguide/C/network-config.xml:1783(programlisting)
16113
#, no-wrap
16114
msgid ""
16115
"\n"
16116
"#Note: This log was taken with dpdk 2.2 and openvswitch 2.5\n"
16117
"Captions:\n"
16118
"CMD: that you enter\n"
16119
"SYSLOG: (Inlcuding EAL and OVS Messages)\n"
16120
"OVS-LOG: (Openvswitch messages)\n"
16121
"\n"
16122
"#PREPARATION\n"
16123
"Bind an interface to DPDK UIO drivers, make Hugepages available, enable DPDK "
16124
"on OVS\n"
16125
"\n"
16126
"CMD: sudo service openvswitch-switch restart\n"
16127
"\n"
16128
"SYSLOG:\n"
16129
"2016-01-22T08:58:31.372Z|00003|daemon_unix(monitor)|INFO|pid 3329 died, "
16130
"killed (Terminated), exiting\n"
16131
"2016-01-22T08:58:33.377Z|00002|vlog|INFO|opened log file "
16132
"/var/log/openvswitch/ovs-vswitchd.log\n"
16133
"2016-01-22T08:58:33.381Z|00003|ovs_numa|INFO|Discovered 12 CPU cores on NUMA "
16134
"node 0\n"
16135
"2016-01-22T08:58:33.381Z|00004|ovs_numa|INFO|Discovered 1 NUMA nodes and 12 "
16136
"CPU cores\n"
16137
"2016-01-"
16138
"22T08:58:33.381Z|00005|reconnect|INFO|unix:/var/run/openvswitch/db.sock: "
16139
"connecting...\n"
16140
"2016-01-"
16141
"22T08:58:33.383Z|00006|reconnect|INFO|unix:/var/run/openvswitch/db.sock: "
16142
"connected\n"
16143
"2016-01-22T08:58:33.386Z|00007|bridge|INFO|ovs-vswitchd (Open vSwitch) "
16144
"2.5.0\n"
16145
"\n"
16146
"OVS-LOG:\n"
16147
"systemd[1]: Stopping Open vSwitch...\n"
16148
"systemd[1]: Stopped Open vSwitch.\n"
16149
"systemd[1]: Stopping Open vSwitch Internal Unit...\n"
16150
"ovs-ctl[3541]: * Killing ovs-vswitchd (3329)\n"
16151
"ovs-ctl[3541]: * Killing ovsdb-server (3318)\n"
16152
"systemd[1]: Stopped Open vSwitch Internal Unit.\n"
16153
"systemd[1]: Starting Open vSwitch Internal Unit...\n"
16154
"ovs-ctl[3560]: * Starting ovsdb-server\n"
16155
"ovs-vsctl: ovs|00001|vsctl|INFO|Called as ovs-vsctl --no-wait -- init -- set "
16156
"Open_vSwitch . db-version=7.12.1\n"
16157
"ovs-vsctl: ovs|00001|vsctl|INFO|Called as ovs-vsctl --no-wait set "
16158
"Open_vSwitch . ovs-version=2.5.0 \"external-ids:system-id=\\\"e7c5ba80-bb14-"
16159
"45c1-b8eb-628f3ad03903\\\"\" \"system-type=\\\"Ubuntu\\\"\" \"system-"
16160
"version=\\\"16.04-xenial\\\"\"\n"
16161
"ovs-ctl[3560]: * Configuring Open vSwitch system IDs\n"
16162
"ovs-ctl[3560]: 2016-01-22T08:58:31Z|00001|dpdk|INFO|No -vhost_sock_dir "
16163
"provided - defaulting to /var/run/openvswitch\n"
16164
"ovs-vswitchd: ovs|00001|dpdk|INFO|No -vhost_sock_dir provided - defaulting "
16165
"to /var/run/openvswitch\n"
16166
"ovs-ctl[3560]: EAL: Detected lcore 0 as core 0 on socket 0\n"
16167
"ovs-ctl[3560]: EAL: Detected lcore 1 as core 1 on socket 0\n"
16168
"ovs-ctl[3560]: EAL: Detected lcore 2 as core 2 on socket 0\n"
16169
"ovs-ctl[3560]: EAL: Detected lcore 3 as core 3 on socket 0\n"
16170
"ovs-ctl[3560]: EAL: Detected lcore 4 as core 4 on socket 0\n"
16171
"ovs-ctl[3560]: EAL: Detected lcore 5 as core 5 on socket 0\n"
16172
"ovs-ctl[3560]: EAL: Detected lcore 6 as core 0 on socket 0\n"
16173
"ovs-ctl[3560]: EAL: Detected lcore 7 as core 1 on socket 0\n"
16174
"ovs-ctl[3560]: EAL: Detected lcore 8 as core 2 on socket 0\n"
16175
"ovs-ctl[3560]: EAL: Detected lcore 9 as core 3 on socket 0\n"
16176
"ovs-ctl[3560]: EAL: Detected lcore 10 as core 4 on socket 0\n"
16177
"ovs-ctl[3560]: EAL: Detected lcore 11 as core 5 on socket 0\n"
16178
"ovs-ctl[3560]: EAL: Support maximum 128 logical core(s) by configuration.\n"
16179
"ovs-ctl[3560]: EAL: Detected 12 lcore(s)\n"
16180
"ovs-ctl[3560]: EAL: VFIO modules not all loaded, skip VFIO support...\n"
16181
"ovs-ctl[3560]: EAL: Setting up physically contiguous memory...\n"
16182
"ovs-ctl[3560]: EAL: Ask a virtual area of 0x100000000 bytes\n"
16183
"ovs-ctl[3560]: EAL: Virtual area found at 0x7f2040000000 (size = "
16184
"0x100000000)\n"
16185
"ovs-ctl[3560]: EAL: Requesting 4 pages of size 1024MB from socket 0\n"
16186
"ovs-ctl[3560]: EAL: TSC frequency is ~2397202 KHz\n"
16187
"ovs-vswitchd[3592]: EAL: TSC frequency is ~2397202 KHz\n"
16188
"ovs-vswitchd[3592]: EAL: Master lcore 0 is ready (tid=fc6cbb00;cpuset=[0])\n"
16189
"ovs-vswitchd[3592]: EAL: PCI device 0000:04:00.0 on NUMA socket 0\n"
16190
"ovs-vswitchd[3592]: EAL: probe driver: 8086:1528 rte_ixgbe_pmd\n"
16191
"ovs-vswitchd[3592]: EAL: Not managed by a supported kernel driver, "
16192
"skipped\n"
16193
"ovs-vswitchd[3592]: EAL: PCI device 0000:04:00.1 on NUMA socket 0\n"
16194
"ovs-vswitchd[3592]: EAL: probe driver: 8086:1528 rte_ixgbe_pmd\n"
16195
"ovs-vswitchd[3592]: EAL: PCI memory mapped at 0x7f2140000000\n"
16196
"ovs-vswitchd[3592]: EAL: PCI memory mapped at 0x7f2140200000\n"
16197
"ovs-ctl[3560]: EAL: Master lcore 0 is ready (tid=fc6cbb00;cpuset=[0])\n"
16198
"ovs-ctl[3560]: EAL: PCI device 0000:04:00.0 on NUMA socket 0\n"
16199
"ovs-ctl[3560]: EAL: probe driver: 8086:1528 rte_ixgbe_pmd\n"
16200
"ovs-ctl[3560]: EAL: Not managed by a supported kernel driver, skipped\n"
16201
"ovs-ctl[3560]: EAL: PCI device 0000:04:00.1 on NUMA socket 0\n"
16202
"ovs-ctl[3560]: EAL: probe driver: 8086:1528 rte_ixgbe_pmd\n"
16203
"ovs-ctl[3560]: EAL: PCI memory mapped at 0x7f2140000000\n"
16204
"ovs-ctl[3560]: EAL: PCI memory mapped at 0x7f2140200000\n"
16205
"ovs-vswitchd[3592]: PMD: eth_ixgbe_dev_init(): MAC: 4, PHY: 3\n"
16206
"ovs-vswitchd[3592]: PMD: eth_ixgbe_dev_init(): port 0 vendorID=0x8086 "
16207
"deviceID=0x1528\n"
16208
"ovs-ctl[3560]: PMD: eth_ixgbe_dev_init(): MAC: 4, PHY: 3\n"
16209
"ovs-ctl[3560]: PMD: eth_ixgbe_dev_init(): port 0 vendorID=0x8086 "
16210
"deviceID=0x1528\n"
16211
"ovs-ctl[3560]: Zone 0: name:<RG_MP_log_history>, phys:0x83fffdec0, "
16212
"len:0x2080, virt:0x7f213fffdec0, socket_id:0, flags:0\n"
16213
"ovs-ctl[3560]: Zone 1: name:<MP_log_history>, phys:0x83fd73d40, "
16214
"len:0x28a0c0, virt:0x7f213fd73d40, socket_id:0, flags:0\n"
16215
"ovs-ctl[3560]: Zone 2: name:<rte_eth_dev_data>, phys:0x83fd43380, "
16216
"len:0x2f700, virt:0x7f213fd43380, socket_id:0, flags:0\n"
16217
"ovs-ctl[3560]: * Starting ovs-vswitchd\n"
16218
"ovs-ctl[3560]: * Enabling remote OVSDB managers\n"
16219
"systemd[1]: Started Open vSwitch Internal Unit.\n"
16220
"systemd[1]: Starting Open vSwitch...\n"
16221
"systemd[1]: Started Open vSwitch.\n"
16222
"\n"
16223
"\n"
16224
"CMD: sudo ovs-vsctl add-br ovsdpdkbr0 -- set bridge ovsdpdkbr0 "
16225
"datapath_type=netdev\n"
16226
"\n"
16227
"SYSLOG:\n"
16228
"2016-01-22T08:58:56.344Z|00008|memory|INFO|37256 kB peak resident set size "
16229
"after 24.5 seconds\n"
16230
"2016-01-22T08:58:56.346Z|00009|ofproto_dpif|INFO|netdev@ovs-netdev: Datapath "
16231
"supports recirculation\n"
16232
"2016-01-22T08:58:56.346Z|00010|ofproto_dpif|INFO|netdev@ovs-netdev: MPLS "
16233
"label stack length probed as 3\n"
16234
"2016-01-22T08:58:56.346Z|00011|ofproto_dpif|INFO|netdev@ovs-netdev: Datapath "
16235
"supports unique flow ids\n"
16236
"2016-01-22T08:58:56.346Z|00012|ofproto_dpif|INFO|netdev@ovs-netdev: Datapath "
16237
"does not support ct_state\n"
16238
"2016-01-22T08:58:56.346Z|00013|ofproto_dpif|INFO|netdev@ovs-netdev: Datapath "
16239
"does not support ct_zone\n"
16240
"2016-01-22T08:58:56.346Z|00014|ofproto_dpif|INFO|netdev@ovs-netdev: Datapath "
16241
"does not support ct_mark\n"
16242
"2016-01-22T08:58:56.346Z|00015|ofproto_dpif|INFO|netdev@ovs-netdev: Datapath "
16243
"does not support ct_label\n"
16244
"2016-01-22T08:58:56.360Z|00016|bridge|INFO|bridge ovsdpdkbr0: added "
16245
"interface ovsdpdkbr0 on port 65534\n"
16246
"2016-01-22T08:58:56.361Z|00017|bridge|INFO|bridge ovsdpdkbr0: using datapath "
16247
"ID 00005a4a1ed0a14d\n"
16248
"2016-01-22T08:58:56.361Z|00018|connmgr|INFO|ovsdpdkbr0: added service "
16249
"controller \"punix:/var/run/openvswitch/ovsdpdkbr0.mgmt\"\n"
16250
"\n"
16251
"OVS-LOG:\n"
16252
"ovs-vsctl: ovs|00001|vsctl|INFO|Called as ovs-vsctl add-br ovsdpdkbr0 -- set "
16253
"bridge ovsdpdkbr0 datapath_type=netdev\n"
16254
"systemd-udevd[3607]: Could not generate persistent MAC address for ovs-"
16255
"netdev: No such file or directory\n"
16256
"kernel: [50165.886554] device ovs-netdev entered promiscuous mode\n"
16257
"kernel: [50165.901261] device ovsdpdkbr0 entered promiscuous mode\n"
16258
"\n"
16259
"\n"
16260
"CMD: sudo ovs-vsctl add-port ovsdpdkbr0 dpdk0 -- set Interface dpdk0 "
16261
"type=dpdk\n"
16262
"\n"
16263
"SYSLOG:\n"
16264
"2016-01-22T08:59:06.369Z|00019|memory|INFO|peak resident set size grew 155% "
16265
"in last 10.0 seconds, from 37256 kB to 95008 kB\n"
16266
"2016-01-22T08:59:06.369Z|00020|memory|INFO|handlers:4 ports:1 revalidators:2 "
16267
"rules:5\n"
16268
"2016-01-22T08:59:30.989Z|00021|dpdk|INFO|Port 0: 8c:dc:d4:b3:6d:e9\n"
16269
"2016-01-22T08:59:31.520Z|00022|dpdk|INFO|Port 0: 8c:dc:d4:b3:6d:e9\n"
16270
"2016-01-22T08:59:31.521Z|00023|dpif_netdev|INFO|Created 1 pmd threads on "
16271
"numa node 0\n"
16272
"2016-01-22T08:59:31.522Z|00001|dpif_netdev(pmd16)|INFO|Core 0 processing "
16273
"port 'dpdk0'\n"
16274
"2016-01-22T08:59:31.522Z|00024|bridge|INFO|bridge ovsdpdkbr0: added "
16275
"interface dpdk0 on port 1\n"
16276
"2016-01-22T08:59:31.522Z|00025|bridge|INFO|bridge ovsdpdkbr0: using datapath "
16277
"ID 00008cdcd4b36de9\n"
16278
"2016-01-22T08:59:31.523Z|00002|dpif_netdev(pmd16)|INFO|Core 0 processing "
16279
"port 'dpdk0'\n"
16280
"\n"
16281
"OVS-LOG:\n"
16282
"ovs-vsctl: ovs|00001|vsctl|INFO|Called as ovs-vsctl add-port ovsdpdkbr0 "
16283
"dpdk0 -- set Interface dpdk0 type=dpdk\n"
16284
"ovs-vswitchd[3595]: PMD: ixgbe_dev_tx_queue_setup(): sw_ring=0x7f211a79ebc0 "
16285
"hw_ring=0x7f211a7a6c00 dma_addr=0x81a7a6c00\n"
16286
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Using simple tx code path\n"
16287
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Vector tx enabled.\n"
16288
"ovs-vswitchd[3595]: PMD: ixgbe_dev_rx_queue_setup(): sw_ring=0x7f211a78a6c0 "
16289
"sw_sc_ring=0x7f211a786580 hw_ring=0x7f211a78e800 dma_addr=0x81a78e800\n"
16290
"ovs-vswitchd[3595]: PMD: ixgbe_set_rx_function(): Vector rx enabled, please "
16291
"make sure RX burst size no less than 4 (port=0).\n"
16292
"ovs-vswitchd[3595]: PMD: ixgbe_dev_tx_queue_setup(): sw_ring=0x7f211a79ebc0 "
16293
"hw_ring=0x7f211a7a6c00 dma_addr=0x81a7a6c00\n"
16294
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Using simple tx code path\n"
16295
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Vector tx enabled.\n"
16296
"ovs-vswitchd[3595]: PMD: ixgbe_dev_tx_queue_setup(): sw_ring=0x7f211a76e4c0 "
16297
"hw_ring=0x7f211a776500 dma_addr=0x81a776500\n"
16298
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Using simple tx code path\n"
16299
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Vector tx enabled.\n"
16300
"ovs-vswitchd[3595]: PMD: ixgbe_dev_tx_queue_setup(): sw_ring=0x7f211a756440 "
16301
"hw_ring=0x7f211a75e480 dma_addr=0x81a75e480\n"
16302
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Using simple tx code path\n"
16303
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Vector tx enabled.\n"
16304
"ovs-vswitchd[3595]: PMD: ixgbe_dev_tx_queue_setup(): sw_ring=0x7f211a73e3c0 "
16305
"hw_ring=0x7f211a746400 dma_addr=0x81a746400\n"
16306
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Using simple tx code path\n"
16307
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Vector tx enabled.\n"
16308
"ovs-vswitchd[3595]: PMD: ixgbe_dev_tx_queue_setup(): sw_ring=0x7f211a726340 "
16309
"hw_ring=0x7f211a72e380 dma_addr=0x81a72e380\n"
16310
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Using simple tx code path\n"
16311
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Vector tx enabled.\n"
16312
"ovs-vswitchd[3595]: PMD: ixgbe_dev_tx_queue_setup(): sw_ring=0x7f211a70e2c0 "
16313
"hw_ring=0x7f211a716300 dma_addr=0x81a716300\n"
16314
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Using simple tx code path\n"
16315
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Vector tx enabled.\n"
16316
"ovs-vswitchd[3595]: PMD: ixgbe_dev_tx_queue_setup(): sw_ring=0x7f211a6f6240 "
16317
"hw_ring=0x7f211a6fe280 dma_addr=0x81a6fe280\n"
16318
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Using simple tx code path\n"
16319
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Vector tx enabled.\n"
16320
"ovs-vswitchd[3595]: PMD: ixgbe_dev_tx_queue_setup(): sw_ring=0x7f211a6de1c0 "
16321
"hw_ring=0x7f211a6e6200 dma_addr=0x81a6e6200\n"
16322
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Using simple tx code path\n"
16323
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Vector tx enabled.\n"
16324
"ovs-vswitchd[3595]: PMD: ixgbe_dev_tx_queue_setup(): sw_ring=0x7f211a6c6140 "
16325
"hw_ring=0x7f211a6ce180 dma_addr=0x81a6ce180\n"
16326
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Using simple tx code path\n"
16327
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Vector tx enabled.\n"
16328
"ovs-vswitchd[3595]: PMD: ixgbe_dev_tx_queue_setup(): sw_ring=0x7f211a6ae0c0 "
16329
"hw_ring=0x7f211a6b6100 dma_addr=0x81a6b6100\n"
16330
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Using simple tx code path\n"
16331
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Vector tx enabled.\n"
16332
"ovs-vswitchd[3595]: PMD: ixgbe_dev_tx_queue_setup(): sw_ring=0x7f211a696040 "
16333
"hw_ring=0x7f211a69e080 dma_addr=0x81a69e080\n"
16334
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Using simple tx code path\n"
16335
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Vector tx enabled.\n"
16336
"ovs-vswitchd[3595]: PMD: ixgbe_dev_tx_queue_setup(): sw_ring=0x7f211a67dfc0 "
16337
"hw_ring=0x7f211a686000 dma_addr=0x81a686000\n"
16338
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Using simple tx code path\n"
16339
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Vector tx enabled.\n"
16340
"ovs-vswitchd[3595]: PMD: ixgbe_dev_tx_queue_setup(): sw_ring=0x7f211a665e40 "
16341
"hw_ring=0x7f211a66de80 dma_addr=0x81a66de80\n"
16342
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Using simple tx code path\n"
16343
"ovs-vswitchd[3595]: PMD: ixgbe_set_tx_function(): Vector tx enabled.\n"
16344
"ovs-vswitchd[3595]: PMD: ixgbe_dev_rx_queue_setup(): sw_ring=0x7f211a78a6c0 "
16345
"sw_sc_ring=0x7f211a786580 hw_ring=0x7f211a78e800 dma_addr=0x81a78e800\n"
16346
"ovs-vswitchd[3595]: PMD: ixgbe_set_rx_function(): Vector rx enabled, please "
16347
"make sure RX burst size no less than 4 (port=0).\n"
16348
"\n"
16349
"\n"
16350
"CMD: sudo ovs-vsctl add-port ovsdpdkbr0 vhost-user-1 -- set Interface vhost-"
16351
"user-1 type=dpdkvhostuser\n"
16352
"\n"
16353
"OVS-LOG:\n"
16354
"2016-01-22T09:00:35.145Z|00026|dpdk|INFO|Socket /var/run/openvswitch/vhost-"
16355
"user-1 created for vhost-user port vhost-user-1\n"
16356
"2016-01-22T09:00:35.145Z|00003|dpif_netdev(pmd16)|INFO|Core 0 processing "
16357
"port 'dpdk0'\n"
16358
"2016-01-22T09:00:35.145Z|00004|dpif_netdev(pmd16)|INFO|Core 0 processing "
16359
"port 'vhost-user-1'\n"
16360
"2016-01-22T09:00:35.145Z|00027|bridge|INFO|bridge ovsdpdkbr0: added "
16361
"interface vhost-user-1 on port 2\n"
16362
"\n"
16363
"SYSLOG:\n"
16364
"ovs-vsctl: ovs|00001|vsctl|INFO|Called as ovs-vsctl add-port ovsdpdkbr0 "
16365
"vhost-user-1 -- set Interface vhost-user-1 type=dpdkvhostuser\n"
16366
"ovs-vswitchd[3595]: VHOST_CONFIG: socket created, fd:46\n"
16367
"ovs-vswitchd[3595]: VHOST_CONFIG: bind to /var/run/openvswitch/vhost-user-1\n"
16368
"\n"
16369
"Eventually we can see the poll thread in top\n"
16370
" PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n"
16371
" 3595 root 10 -10 4975344 103936 9916 S 100.0 0.3 33:13.56 ovs-"
16372
"vswitchd\n"
16373
"\t\t "
16374
msgstr ""
16375
16376
#: serverguide/C/network-config.xml:1980(ulink)
16377
msgid "DPDK Documentation"
16378
msgstr ""
16379
16380
#: serverguide/C/network-config.xml:1985(ulink)
16381
msgid "Release Notes matching the version packages in Ubuntu 16.04"
16382
msgstr ""
16383
16384
#: serverguide/C/network-config.xml:1990(ulink)
16385
msgid "Linux DPDK User Getting Started"
16386
msgstr ""
16387
16388
#: serverguide/C/network-config.xml:1995(ulink)
16389
msgid "EAL Command-line Options"
16390
msgstr ""
16391
16392
#: serverguide/C/network-config.xml:2000(ulink)
16393
msgid "DPDK Api Documentation"
16394
msgstr ""
16395
16396
#: serverguide/C/network-config.xml:2005(ulink)
16397
msgid "OpenVswitch DPDK installation"
16398
msgstr ""
16399
16400
#: serverguide/C/network-config.xml:2010(ulink)
16401
msgid "Wikipedias definition of DPDK"
16402
msgstr ""
16403
16404
#: serverguide/C/network-auth.xml:12(title)
16405
msgid "Network Authentication"
16406
msgstr ""
16407
16408
#: serverguide/C/network-auth.xml:14(para)
16409
msgid ""
16410
"This section applies LDAP to network authentication and authorization."
16411
msgstr ""
16412
16413
#: serverguide/C/network-auth.xml:19(title)
16414
msgid "OpenLDAP Server"
16415
msgstr "Server OpenLDAP"
16416
16417
#: serverguide/C/network-auth.xml:21(para)
16418
msgid ""
16419
"The Lightweight Directory Access Protocol, or LDAP, is a protocol for "
16420
"querying and modifying a X.500-based directory service running over TCP/IP. "
16421
"The current LDAP version is LDAPv3, as defined in <ulink "
16422
"url=\"http://tools.ietf.org/html/rfc4510\">RFC4510</ulink>, and the "
16423
"implementation in Ubuntu is OpenLDAP.\""
16424
msgstr ""
16425
16426
#: serverguide/C/network-auth.xml:29(para)
16427
msgid ""
16428
"So the LDAP protocol accesses LDAP directories. Here are some key concepts "
16429
"and terms:"
16430
msgstr ""
16431
16432
#: serverguide/C/network-auth.xml:36(para)
16433
msgid ""
16434
"A LDAP directory is a tree of data <emphasis>entries</emphasis> that is "
16435
"hierarchical in nature and is called the Directory Information Tree (DIT)."
16436
msgstr ""
16437
16438
#: serverguide/C/network-auth.xml:43(para)
16439
msgid "An entry consists of a set of <emphasis>attributes</emphasis>."
16440
msgstr ""
16441
16442
#: serverguide/C/network-auth.xml:49(para)
16443
msgid ""
16444
"An attribute has a <emphasis>type</emphasis> (a name/description) and one or "
16445
"more <emphasis>values</emphasis>."
16446
msgstr ""
16447
16448
#: serverguide/C/network-auth.xml:55(para)
16449
msgid ""
16450
"Every attribute must be defined in at least one "
16451
"<emphasis>objectClass</emphasis>."
16452
msgstr ""
16453
16454
#: serverguide/C/network-auth.xml:61(para)
16455
msgid ""
16456
"Attributes and objectclasses are defined in <emphasis>schemas</emphasis> (an "
16457
"objectclass is actually considered as a special kind of attribute)."
16458
msgstr ""
16459
16460
#: serverguide/C/network-auth.xml:68(para)
16461
msgid ""
16462
"Each entry has a unique identifier: its <emphasis>Distinguished "
16463
"Name</emphasis> (DN or dn). This, in turn, consists of a <emphasis>Relative "
16464
"Distinguished Name</emphasis> (RDN) followed by the parent entry's DN."
16465
msgstr ""
16466
16467
#: serverguide/C/network-auth.xml:75(para)
16468
msgid ""
16469
"The entry's DN is not an attribute. It is not considered part of the entry "
16470
"itself."
16471
msgstr ""
16472
16473
#: serverguide/C/network-auth.xml:83(para)
16474
msgid ""
16475
"The terms <emphasis>object</emphasis>, <emphasis>container</emphasis>, and "
16476
"<emphasis>node</emphasis> have certain connotations but they all essentially "
16477
"mean the same thing as <emphasis>entry</emphasis>, the technically correct "
16478
"term."
16479
msgstr ""
16480
16481
#: serverguide/C/network-auth.xml:89(para)
16482
msgid ""
16483
"For example, below we have a single entry consisting of 11 attributes where "
16484
"the following is true:"
16485
msgstr ""
16486
16487
#: serverguide/C/network-auth.xml:96(para)
16488
msgid "DN is \"cn=John Doe,dc=example,dc=com\""
16489
msgstr ""
16490
16491
#: serverguide/C/network-auth.xml:102(para)
16492
msgid "RDN is \"cn=John Doe\""
16493
msgstr ""
16494
16495
#: serverguide/C/network-auth.xml:108(para)
16496
msgid "parent DN is \"dc=example,dc=com\""
16497
msgstr ""
16498
16499
#: serverguide/C/network-auth.xml:115(programlisting)
16500
#, no-wrap
16501
msgid ""
16502
"\n"
16503
" dn: cn=John Doe,dc=example,dc=com\n"
16504
" cn: John Doe\n"
16505
" givenName: John\n"
16506
" sn: Doe\n"
16507
" telephoneNumber: +1 888 555 6789\n"
16508
" telephoneNumber: +1 888 555 1232\n"
16509
" mail: john@example.com\n"
16510
" manager: cn=Larry Smith,dc=example,dc=com\n"
16511
" objectClass: inetOrgPerson\n"
16512
" objectClass: organizationalPerson\n"
16513
" objectClass: person\n"
16514
" objectClass: top\n"
16515
msgstr ""
16516
16517
#: serverguide/C/network-auth.xml:130(para)
16518
msgid ""
16519
"The above entry is in <emphasis>LDIF</emphasis> format (LDAP Data "
16520
"Interchange Format). Any information that you feed into your DIT must also "
16521
"be in such a format. It is defined in <ulink "
16522
"url=\"http://tools.ietf.org/html/rfc2849\">RFC2849</ulink>."
16523
msgstr ""
16524
16525
#: serverguide/C/network-auth.xml:135(para)
16526
msgid ""
16527
"Although this guide will describe how to use it for central authentication, "
16528
"LDAP is good for anything that involves a large number of access requests to "
16529
"a mostly-read, attribute-based (name:value) backend. Examples include an "
16530
"address book, a list of email addresses, and a mail server's configuration."
16531
msgstr ""
16532
16533
#: serverguide/C/network-auth.xml:144(para)
16534
msgid ""
16535
"Install the OpenLDAP server daemon and the traditional LDAP management "
16536
"utilities. These are found in packages <application>slapd</application> and "
16537
"<application>ldap-utils</application> respectively."
16538
msgstr ""
16539
16540
#: serverguide/C/network-auth.xml:149(para)
16541
msgid ""
16542
"The installation of slapd will create a working configuration. In "
16543
"particular, it will create a database instance that you can use to store "
16544
"your data. However, the suffix (or base DN) of this instance will be "
16545
"determined from the domain name of the host. If you want something "
16546
"different, you can change it right after the installation when you still "
16547
"don't have any useful data."
16548
msgstr ""
16549
16550
#: serverguide/C/network-auth.xml:156(para)
16551
msgid ""
16552
"This guide will use a database suffix of "
16553
"<emphasis>dc=example,dc=com</emphasis>."
16554
msgstr ""
16555
16556
#: serverguide/C/network-auth.xml:161(para)
16557
msgid "Proceed with the install:"
16558
msgstr ""
16559
16560
#: serverguide/C/network-auth.xml:166(command)
16561
msgid "sudo apt install slapd ldap-utils"
16562
msgstr ""
16563
16564
#: serverguide/C/network-auth.xml:169(para)
16565
msgid ""
16566
"If you want to change your DIT suffix, now would be a good time, because "
16567
"changing it discards your existing one. To change the suffix, run the "
16568
"following command:"
16569
msgstr ""
16570
16571
#: serverguide/C/network-auth.xml:175(command)
16572
msgid "sudo dpkg-reconfigure slapd"
16573
msgstr ""
16574
16575
#: serverguide/C/network-auth.xml:177(para)
16576
msgid ""
16577
"To switch your DIT suffix to <emphasis>dc=example,dc=com</emphasis>, for "
16578
"example, so you can follow this guide more closely, answer "
16579
"<emphasis>example.com</emphasis> when asked about the DNS domain name."
16580
msgstr ""
16581
16582
#: serverguide/C/network-auth.xml:181(para)
16583
msgid ""
16584
"Since Ubuntu 8.10 slapd is designed to be configured within slapd itself by "
16585
"dedicating a separate DIT for that purpose. This allows one to dynamically "
16586
"configure slapd without the need to restart the service. This configuration "
16587
"database consists of a collection of text-based LDIF files located under "
16588
"<filename>/etc/ldap/slapd.d</filename>. This way of working is known by "
16589
"several names: the slapd-config method, the RTC method (Real Time "
16590
"Configuration), or the cn=config method. You can still use the traditional "
16591
"flat-file method (slapd.conf) but it's not recommended; the functionality "
16592
"will be eventually phased out."
16593
msgstr ""
16594
16595
#: serverguide/C/network-auth.xml:190(para)
16596
msgid ""
16597
"Ubuntu now uses the <emphasis>slapd-config</emphasis> method for slapd "
16598
"configuration and this guide reflects that."
16599
msgstr ""
16600
16601
#: serverguide/C/network-auth.xml:196(para)
16602
msgid ""
16603
"During the install you were prompted to define administrative credentials. "
16604
"These are LDAP-based credentials for the <emphasis>rootDN</emphasis> of your "
16605
"database instance. By default, this user's DN is "
16606
"<emphasis>cn=admin,dc=example,dc=com</emphasis>. Also by default, there is "
16607
"no administrative account created for the slapd-config database and you will "
16608
"therefore need to authenticate externally to LDAP in order to access it. We "
16609
"will see how to do this later on."
16610
msgstr ""
16611
16612
#: serverguide/C/network-auth.xml:203(para)
16613
msgid ""
16614
"Some classical schemas (cosine, nis, inetorgperson) come built-in with slapd "
16615
"nowadays. There is also an included \"core\" schema, a pre-requisite for any "
16616
"schema to work."
16617
msgstr ""
16618
16619
#: serverguide/C/network-auth.xml:211(title)
16620
msgid "Post-install Inspection"
16621
msgstr ""
16622
16623
#: serverguide/C/network-auth.xml:213(para)
16624
msgid ""
16625
"The installation process set up 2 DITs. One for slapd-config and one for "
16626
"your own data (dc=example,dc=com). Let's take a look."
16627
msgstr ""
16628
16629
#: serverguide/C/network-auth.xml:220(para)
16630
msgid ""
16631
"This is what the slapd-config database/DIT looks like. Recall that this "
16632
"database is LDIF-based and lives under "
16633
"<filename>/etc/ldap/slapd.d</filename>:"
16634
msgstr ""
16635
16636
#: serverguide/C/network-auth.xml:226(computeroutput)
16637
#, no-wrap
16638
msgid ""
16639
"\n"
16640
" /etc/ldap/slapd.d/\n"
16641
" /etc/ldap/slapd.d/cn=config.ldif\n"
16642
" /etc/ldap/slapd.d/cn=config\n"
16643
" /etc/ldap/slapd.d/cn=config/cn=schema\n"
16644
" /etc/ldap/slapd.d/cn=config/cn=schema/cn={1}cosine.ldif\n"
16645
" /etc/ldap/slapd.d/cn=config/cn=schema/cn={0}core.ldif\n"
16646
" /etc/ldap/slapd.d/cn=config/cn=schema/cn={2}nis.ldif\n"
16647
" /etc/ldap/slapd.d/cn=config/cn=schema/cn={3}inetorgperson.ldif\n"
16648
" /etc/ldap/slapd.d/cn=config/cn=module{0}.ldif\n"
16649
" /etc/ldap/slapd.d/cn=config/olcDatabase={0}config.ldif\n"
16650
" /etc/ldap/slapd.d/cn=config/olcDatabase={-1}frontend.ldif\n"
16651
" /etc/ldap/slapd.d/cn=config/olcDatabase={1}mdb.ldif\n"
16652
" /etc/ldap/slapd.d/cn=config/olcBackend={0}mdb.ldif\n"
16653
" /etc/ldap/slapd.d/cn=config/cn=schema.ldif\n"
16654
msgstr ""
16655
16656
#: serverguide/C/network-auth.xml:245(para)
16657
msgid ""
16658
"Do not edit the slapd-config database directly. Make changes via the LDAP "
16659
"protocol (utilities)."
16660
msgstr ""
16661
16662
#: serverguide/C/network-auth.xml:253(para)
16663
msgid "This is what the slapd-config DIT looks like via the LDAP protocol:"
16664
msgstr ""
16665
16666
#: serverguide/C/network-auth.xml:258(command)
16667
msgid "sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config dn"
16668
msgstr ""
16669
16670
#: serverguide/C/network-auth.xml:259(computeroutput)
16671
#, no-wrap
16672
msgid ""
16673
"\n"
16674
"dn: cn=config\n"
16675
"\n"
16676
"dn: cn=module{0},cn=config\n"
16677
"\n"
16678
"dn: cn=schema,cn=config\n"
16679
"\n"
16680
"dn: cn={0}core,cn=schema,cn=config\n"
16681
"\n"
16682
"dn: cn={1}cosine,cn=schema,cn=config\n"
16683
"\n"
16684
"dn: cn={2}nis,cn=schema,cn=config\n"
16685
"\n"
16686
"dn: cn={3}inetorgperson,cn=schema,cn=config\n"
16687
"\n"
16688
"dn: olcBackend={0}mdb,cn=config\n"
16689
"\n"
16690
"dn: olcDatabase={-1}frontend,cn=config\n"
16691
"\n"
16692
"dn: olcDatabase={0}config,cn=config\n"
16693
"\n"
16694
"dn: olcDatabase={1}mdb,cn=config\n"
16695
msgstr ""
16696
16697
#: serverguide/C/network-auth.xml:284(para) serverguide/C/network-auth.xml:375(para)
16698
msgid "Explanation of entries:"
16699
msgstr ""
16700
16701
#: serverguide/C/network-auth.xml:291(para)
16702
msgid "<emphasis>cn=config</emphasis>: global settings"
16703
msgstr ""
16704
16705
#: serverguide/C/network-auth.xml:297(para)
16706
msgid ""
16707
"<emphasis>cn=module{0},cn=config</emphasis>: a dynamically loaded module"
16708
msgstr ""
16709
16710
#: serverguide/C/network-auth.xml:303(para)
16711
msgid ""
16712
"<emphasis>cn=schema,cn=config</emphasis>: contains hard-coded system-level "
16713
"schema"
16714
msgstr ""
16715
16716
#: serverguide/C/network-auth.xml:309(para)
16717
msgid ""
16718
"<emphasis>cn={0}core,cn=schema,cn=config</emphasis>: the hard-coded core "
16719
"schema"
16720
msgstr ""
16721
16722
#: serverguide/C/network-auth.xml:315(para)
16723
msgid ""
16724
"<emphasis>cn={1}cosine,cn=schema,cn=config</emphasis>: the cosine schema"
16725
msgstr ""
16726
16727
#: serverguide/C/network-auth.xml:321(para)
16728
msgid "<emphasis>cn={2}nis,cn=schema,cn=config</emphasis>: the nis schema"
16729
msgstr ""
16730
16731
#: serverguide/C/network-auth.xml:327(para)
16732
msgid ""
16733
"<emphasis>cn={3}inetorgperson,cn=schema,cn=config</emphasis>: the "
16734
"inetorgperson schema"
16735
msgstr ""
16736
16737
#: serverguide/C/network-auth.xml:333(para)
16738
msgid ""
16739
"<emphasis>olcBackend={0}mdb,cn=config</emphasis>: the 'mdb' backend storage "
16740
"type"
16741
msgstr ""
16742
16743
#: serverguide/C/network-auth.xml:339(para)
16744
msgid ""
16745
"<emphasis>olcDatabase={-1}frontend,cn=config</emphasis>: frontend database, "
16746
"default settings for other databases"
16747
msgstr ""
16748
16749
#: serverguide/C/network-auth.xml:345(para)
16750
msgid ""
16751
"<emphasis>olcDatabase={0}config,cn=config</emphasis>: slapd configuration "
16752
"database (cn=config)"
16753
msgstr ""
16754
16755
#: serverguide/C/network-auth.xml:351(para)
16756
msgid ""
16757
"<emphasis>olcDatabase={1}mdb,cn=config</emphasis>: your database instance "
16758
"(dc=example,dc=com)"
16759
msgstr ""
16760
16761
#: serverguide/C/network-auth.xml:362(para)
16762
msgid "This is what the dc=example,dc=com DIT looks like:"
16763
msgstr ""
16764
16765
#: serverguide/C/network-auth.xml:367(command)
16766
msgid "ldapsearch -x -LLL -H ldap:/// -b dc=example,dc=com dn"
16767
msgstr ""
16768
16769
#: serverguide/C/network-auth.xml:368(computeroutput)
16770
#, no-wrap
16771
msgid ""
16772
"\n"
16773
"dn: dc=example,dc=com\n"
16774
"\n"
16775
"dn: cn=admin,dc=example,dc=com\n"
16776
msgstr ""
16777
16778
#: serverguide/C/network-auth.xml:382(para)
16779
msgid "<emphasis>dc=example,dc=com</emphasis>: base of the DIT"
16780
msgstr ""
16781
16782
#: serverguide/C/network-auth.xml:388(para)
16783
msgid ""
16784
"<emphasis>cn=admin,dc=example,dc=com</emphasis>: administrator (rootDN) for "
16785
"this DIT (set up during package install)"
16786
msgstr ""
16787
16788
#: serverguide/C/network-auth.xml:402(title)
16789
msgid "Modifying/Populating your Database"
16790
msgstr ""
16791
16792
#: serverguide/C/network-auth.xml:404(para)
16793
msgid ""
16794
"Let's introduce some content to our database. We will add the following:"
16795
msgstr ""
16796
16797
#: serverguide/C/network-auth.xml:411(para)
16798
msgid "a node called <emphasis>People</emphasis> (to store users)"
16799
msgstr ""
16800
16801
#: serverguide/C/network-auth.xml:417(para)
16802
msgid "a node called <emphasis>Groups</emphasis> (to store groups)"
16803
msgstr ""
16804
16805
#: serverguide/C/network-auth.xml:423(para)
16806
msgid "a group called <emphasis>miners</emphasis>"
16807
msgstr ""
16808
16809
#: serverguide/C/network-auth.xml:429(para)
16810
msgid "a user called <emphasis>john</emphasis>"
16811
msgstr ""
16812
16813
#: serverguide/C/network-auth.xml:436(para)
16814
msgid ""
16815
"Create the following LDIF file and call it "
16816
"<filename>add_content.ldif</filename>:"
16817
msgstr ""
16818
16819
#: serverguide/C/network-auth.xml:440(programlisting)
16820
#, no-wrap
16821
msgid ""
16822
"\n"
16823
"dn: ou=People,dc=example,dc=com\n"
16824
"objectClass: organizationalUnit\n"
16825
"ou: People\n"
16826
"\n"
16827
"dn: ou=Groups,dc=example,dc=com\n"
16828
"objectClass: organizationalUnit\n"
16829
"ou: Groups\n"
16830
"\n"
16831
"dn: cn=miners,ou=Groups,dc=example,dc=com\n"
16832
"objectClass: posixGroup\n"
16833
"cn: miners\n"
16834
"gidNumber: 5000\n"
16835
"\n"
16836
"dn: uid=john,ou=People,dc=example,dc=com\n"
16837
"objectClass: inetOrgPerson\n"
16838
"objectClass: posixAccount\n"
16839
"objectClass: shadowAccount\n"
16840
"uid: john\n"
16841
"sn: Doe\n"
16842
"givenName: John\n"
16843
"cn: John Doe\n"
16844
"displayName: John Doe\n"
16845
"uidNumber: 10000\n"
16846
"gidNumber: 5000\n"
16847
"userPassword: johnldap\n"
16848
"gecos: John Doe\n"
16849
"loginShell: /bin/bash\n"
16850
"homeDirectory: /home/john\n"
16851
msgstr ""
16852
16853
#: serverguide/C/network-auth.xml:472(para)
16854
msgid ""
16855
"It's important that uid and gid values in your directory do not collide with "
16856
"local values. Use high number ranges, such as starting at 5000. By setting "
16857
"the uid and gid values in ldap high, you also allow for easier control of "
16858
"what can be done with a local user vs a ldap one. More on that later."
16859
msgstr ""
16860
16861
#: serverguide/C/network-auth.xml:480(para)
16862
msgid "Add the content:"
16863
msgstr ""
16864
16865
#: serverguide/C/network-auth.xml:485(command)
16866
msgid "ldapadd -x -D cn=admin,dc=example,dc=com -W -f add_content.ldif"
16867
msgstr ""
16868
16869
#: serverguide/C/network-auth.xml:487(application)
16870
msgid "********"
16871
msgstr ""
16872
16873
#: serverguide/C/network-auth.xml:486(computeroutput)
16874
#, no-wrap
16875
msgid ""
16876
"\n"
16877
"Enter LDAP Password: <placeholder-1/>\n"
16878
"adding new entry \"ou=People,dc=example,dc=com\"\n"
16879
"\n"
16880
"adding new entry \"ou=Groups,dc=example,dc=com\"\n"
16881
"\n"
16882
"adding new entry \"cn=miners,ou=Groups,dc=example,dc=com\"\n"
16883
"\n"
16884
"adding new entry \"uid=john,ou=People,dc=example,dc=com\"\n"
16885
msgstr ""
16886
16887
#: serverguide/C/network-auth.xml:498(para)
16888
msgid ""
16889
"We can check that the information has been correctly added with the "
16890
"<application>ldapsearch</application> utility:"
16891
msgstr ""
16892
16893
#: serverguide/C/network-auth.xml:503(command)
16894
msgid "ldapsearch -x -LLL -b dc=example,dc=com 'uid=john' cn gidNumber"
16895
msgstr ""
16896
16897
#: serverguide/C/network-auth.xml:504(computeroutput)
16898
#, no-wrap
16899
msgid ""
16900
"\n"
16901
"dn: uid=john,ou=People,dc=example,dc=com\n"
16902
"cn: John Doe\n"
16903
"gidNumber: 5000\n"
16904
msgstr ""
16905
16906
#: serverguide/C/network-auth.xml:511(para)
16907
msgid "Explanation of switches:"
16908
msgstr ""
16909
16910
#: serverguide/C/network-auth.xml:518(para)
16911
msgid ""
16912
"<emphasis>-x:</emphasis> \"simple\" binding; will not use the default SASL "
16913
"method"
16914
msgstr ""
16915
16916
#: serverguide/C/network-auth.xml:524(para)
16917
msgid "<emphasis>-LLL:</emphasis> disable printing extraneous information"
16918
msgstr ""
16919
16920
#: serverguide/C/network-auth.xml:530(para)
16921
msgid "<emphasis>uid=john:</emphasis> a \"filter\" to find the john user"
16922
msgstr ""
16923
16924
#: serverguide/C/network-auth.xml:536(para)
16925
msgid ""
16926
"<emphasis>cn gidNumber:</emphasis> requests certain attributes to be "
16927
"displayed (the default is to show all attributes)"
16928
msgstr ""
16929
16930
#: serverguide/C/network-auth.xml:546(title)
16931
msgid "Modifying the slapd Configuration Database"
16932
msgstr ""
16933
16934
#: serverguide/C/network-auth.xml:548(para)
16935
msgid ""
16936
"The slapd-config DIT can also be queried and modified. Here are a few "
16937
"examples."
16938
msgstr ""
16939
16940
#: serverguide/C/network-auth.xml:555(para)
16941
msgid ""
16942
"Use <application>ldapmodify</application> to add an \"Index\" (DbIndex "
16943
"attribute) to your <application>{1}mdb,cn=config</application> database "
16944
"(dc=example,dc=com). Create a file, call it "
16945
"<filename>uid_index.ldif</filename>, with the following contents:"
16946
msgstr ""
16947
16948
#: serverguide/C/network-auth.xml:560(programlisting)
16949
#, no-wrap
16950
msgid ""
16951
"\n"
16952
"dn: olcDatabase={1}mdb,cn=config\n"
16953
"add: olcDbIndex\n"
16954
"olcDbIndex: mail eq,sub\n"
16955
msgstr ""
16956
16957
#: serverguide/C/network-auth.xml:566(para)
16958
msgid "Then issue the command:"
16959
msgstr ""
16960
16961
#: serverguide/C/network-auth.xml:571(command)
16962
msgid "sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f uid_index.ldif"
16963
msgstr ""
16964
16965
#: serverguide/C/network-auth.xml:572(computeroutput)
16966
#, no-wrap
16967
msgid ""
16968
"\n"
16969
"modifying entry \"olcDatabase={1}mdb,cn=config\"\n"
16970
msgstr ""
16971
16972
#: serverguide/C/network-auth.xml:577(para)
16973
msgid "You can confirm the change in this way:"
16974
msgstr ""
16975
16976
#: serverguide/C/network-auth.xml:582(command)
16977
msgid ""
16978
"sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b \\ cn=config "
16979
"'(olcDatabase={1}mdb)' olcDbIndex"
16980
msgstr ""
16981
16982
#: serverguide/C/network-auth.xml:584(computeroutput)
16983
#, no-wrap
16984
msgid ""
16985
"\n"
16986
"dn: olcDatabase={1}mdb,cn=config\n"
16987
"olcDbIndex: objectClass eq\n"
16988
"olcDbIndex: cn,uid eq\n"
16989
"olcDbIndex: uidNumber,gidNumber eq\n"
16990
"olcDbIndex: member,memberUid eq\n"
16991
"olcDbIndex: mail eq,sub\n"
16992
msgstr ""
16993
16994
#: serverguide/C/network-auth.xml:597(para)
16995
msgid ""
16996
"Let's add a schema. It will first need to be converted to LDIF format. You "
16997
"can find unconverted schemas in addition to converted ones in the <filename "
16998
"role=\"directory\">/etc/ldap/schema</filename> directory."
16999
msgstr ""
17000
17001
#: serverguide/C/network-auth.xml:605(para)
17002
msgid ""
17003
"It is not trivial to remove a schema from the slapd-config database. "
17004
"Practice adding schemas on a test system."
17005
msgstr ""
17006
17007
#: serverguide/C/network-auth.xml:611(para)
17008
msgid ""
17009
"Before adding any schema, you should check which schemas are already "
17010
"installed (shown is a default, out-of-the-box output):"
17011
msgstr ""
17012
17013
#: serverguide/C/network-auth.xml:617(command)
17014
msgid ""
17015
"sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b \\ cn=schema,cn=config dn"
17016
msgstr ""
17017
17018
#: serverguide/C/network-auth.xml:619(computeroutput)
17019
#, no-wrap
17020
msgid ""
17021
"\n"
17022
"dn: cn=schema,cn=config\n"
17023
"\n"
17024
"dn: cn={0}core,cn=schema,cn=config\n"
17025
"\n"
17026
"dn: cn={1}cosine,cn=schema,cn=config\n"
17027
"\n"
17028
"dn: cn={2}nis,cn=schema,cn=config\n"
17029
"\n"
17030
"dn: cn={3}inetorgperson,cn=schema,cn=config\n"
17031
msgstr ""
17032
17033
#: serverguide/C/network-auth.xml:636(para)
17034
msgid "In the following example we'll add the CORBA schema."
17035
msgstr ""
17036
17037
#: serverguide/C/network-auth.xml:643(para)
17038
msgid ""
17039
"Create the conversion configuration file "
17040
"<filename>schema_convert.conf</filename> containing the following lines:"
17041
msgstr ""
17042
17043
#: serverguide/C/network-auth.xml:648(programlisting)
17044
#, no-wrap
17045
msgid ""
17046
"\n"
17047
"include /etc/ldap/schema/core.schema\n"
17048
"include /etc/ldap/schema/collective.schema\n"
17049
"include /etc/ldap/schema/corba.schema\n"
17050
"include /etc/ldap/schema/cosine.schema\n"
17051
"include /etc/ldap/schema/duaconf.schema\n"
17052
"include /etc/ldap/schema/dyngroup.schema\n"
17053
"include /etc/ldap/schema/inetorgperson.schema\n"
17054
"include /etc/ldap/schema/java.schema\n"
17055
"include /etc/ldap/schema/misc.schema\n"
17056
"include /etc/ldap/schema/nis.schema\n"
17057
"include /etc/ldap/schema/openldap.schema\n"
17058
"include /etc/ldap/schema/ppolicy.schema\n"
17059
"include /etc/ldap/schema/ldapns.schema\n"
17060
"include /etc/ldap/schema/pmi.schema\n"
17061
msgstr ""
17062
17063
#: serverguide/C/network-auth.xml:668(para)
17064
msgid "Create the output directory <filename>ldif_output</filename>."
17065
msgstr ""
17066
17067
#: serverguide/C/network-auth.xml:674(para)
17068
msgid "Determine the index of the schema:"
17069
msgstr ""
17070
17071
#: serverguide/C/network-auth.xml:679(command)
17072
msgid ""
17073
"slapcat -f schema_convert.conf -F ldif_output -n 0 | grep corba,cn=schema"
17074
msgstr ""
17075
17076
#: serverguide/C/network-auth.xml:680(computeroutput)
17077
#, no-wrap
17078
msgid ""
17079
"\n"
17080
"cn={2}corba,cn=schema,cn=config\n"
17081
msgstr ""
17082
17083
#: serverguide/C/network-auth.xml:686(para)
17084
msgid ""
17085
"When slapd ingests objects with the same parent DN it will create an "
17086
"<emphasis>index</emphasis> for that object. An index is contained within "
17087
"braces: <application>{X}</application>."
17088
msgstr ""
17089
17090
#: serverguide/C/network-auth.xml:695(para)
17091
msgid "Use <application>slapcat</application> to perform the conversion:"
17092
msgstr ""
17093
17094
#: serverguide/C/network-auth.xml:700(command)
17095
msgid ""
17096
"slapcat -f schema_convert.conf -F ldif_output -n0 -H \\ "
17097
"ldap:///cn={2}corba,cn=schema,cn=config -l cn=corba.ldif"
17098
msgstr ""
17099
17100
#: serverguide/C/network-auth.xml:704(para)
17101
msgid "The converted schema is now in <filename>cn=corba.ldif</filename>"
17102
msgstr ""
17103
17104
#: serverguide/C/network-auth.xml:710(para)
17105
msgid ""
17106
"Edit <filename>cn=corba.ldif</filename> to arrive at the following "
17107
"attributes:"
17108
msgstr ""
17109
17110
#: serverguide/C/network-auth.xml:714(programlisting)
17111
#, no-wrap
17112
msgid ""
17113
"\n"
17114
"dn: cn=corba,cn=schema,cn=config\n"
17115
"...\n"
17116
"cn: corba\n"
17117
msgstr ""
17118
17119
#: serverguide/C/network-auth.xml:720(para)
17120
msgid "Also remove the following lines from the bottom:"
17121
msgstr ""
17122
17123
#: serverguide/C/network-auth.xml:724(programlisting)
17124
#, no-wrap
17125
msgid ""
17126
"\n"
17127
"structuralObjectClass: olcSchemaConfig\n"
17128
"entryUUID: 52109a02-66ab-1030-8be2-bbf166230478\n"
17129
"creatorsName: cn=config\n"
17130
"createTimestamp: 20110829165435Z\n"
17131
"entryCSN: 20110829165435.935248Z#000000#000#000000\n"
17132
"modifiersName: cn=config\n"
17133
"modifyTimestamp: 20110829165435Z\n"
17134
msgstr ""
17135
17136
#: serverguide/C/network-auth.xml:734(para)
17137
msgid "Your attribute values will vary."
17138
msgstr ""
17139
17140
#: serverguide/C/network-auth.xml:740(para)
17141
msgid ""
17142
"Finally, use <application>ldapadd</application> to add the new schema to the "
17143
"slapd-config DIT:"
17144
msgstr ""
17145
17146
#: serverguide/C/network-auth.xml:745(command)
17147
msgid "sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// -f cn\\=corba.ldif"
17148
msgstr ""
17149
17150
#: serverguide/C/network-auth.xml:746(computeroutput)
17151
#, no-wrap
17152
msgid ""
17153
"\n"
17154
"adding new entry \"cn=corba,cn=schema,cn=config\"\n"
17155
msgstr ""
17156
17157
#: serverguide/C/network-auth.xml:754(para)
17158
msgid "Confirm currently loaded schemas:"
17159
msgstr ""
17160
17161
#: serverguide/C/network-auth.xml:759(command)
17162
msgid ""
17163
"sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=schema,cn=config dn"
17164
msgstr ""
17165
17166
#: serverguide/C/network-auth.xml:760(computeroutput)
17167
#, no-wrap
17168
msgid ""
17169
"\n"
17170
"dn: cn=schema,cn=config\n"
17171
"\n"
17172
"dn: cn={0}core,cn=schema,cn=config\n"
17173
"\n"
17174
"dn: cn={1}cosine,cn=schema,cn=config\n"
17175
"\n"
17176
"dn: cn={2}nis,cn=schema,cn=config\n"
17177
"\n"
17178
"dn: cn={3}inetorgperson,cn=schema,cn=config\n"
17179
"\n"
17180
"dn: cn={4}corba,cn=schema,cn=config\n"
17181
msgstr ""
17182
17183
#: serverguide/C/network-auth.xml:784(para)
17184
msgid ""
17185
"For external applications and clients to authenticate using LDAP they will "
17186
"each need to be specifically configured to do so. Refer to the appropriate "
17187
"client-side documentation for details."
17188
msgstr ""
17189
17190
#: serverguide/C/network-auth.xml:795(para)
17191
msgid ""
17192
"Activity logging for slapd is indispensible when implementing an OpenLDAP-"
17193
"based solution yet it must be manually enabled after software installation. "
17194
"Otherwise, only rudimentary messages will appear in the logs. Logging, like "
17195
"any other slapd configuration, is enabled via the slapd-config database."
17196
msgstr ""
17197
17198
#: serverguide/C/network-auth.xml:801(para)
17199
msgid ""
17200
"OpenLDAP comes with multiple logging subsystems (levels) with each one "
17201
"containing the lower one (additive). A good level to try is "
17202
"<emphasis>stats</emphasis>. The <ulink "
17203
"url=\"http://manpages.ubuntu.com/manpages/en/man5/slapd-"
17204
"config.5.html\">slapd-config</ulink> man page has more to say on the "
17205
"different subsystems."
17206
msgstr ""
17207
17208
#: serverguide/C/network-auth.xml:807(para)
17209
msgid ""
17210
"Create the file <filename>logging.ldif</filename> with the following "
17211
"contents:"
17212
msgstr ""
17213
17214
#: serverguide/C/network-auth.xml:811(programlisting)
17215
#, no-wrap
17216
msgid ""
17217
"\n"
17218
"dn: cn=config\n"
17219
"changetype: modify\n"
17220
"replace: olcLogLevel\n"
17221
"olcLogLevel: stats\n"
17222
msgstr ""
17223
17224
#: serverguide/C/network-auth.xml:818(para)
17225
msgid "Implement the change:"
17226
msgstr ""
17227
17228
#: serverguide/C/network-auth.xml:823(command)
17229
msgid "sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f logging.ldif"
17230
msgstr ""
17231
17232
#: serverguide/C/network-auth.xml:826(para)
17233
msgid ""
17234
"This will produce a significant amount of logging and you will want to "
17235
"throttle back to a less verbose level once your system is in production. "
17236
"While in this verbose mode your host's syslog engine (rsyslog) may have a "
17237
"hard time keeping up and may drop messages:"
17238
msgstr ""
17239
17240
#: serverguide/C/network-auth.xml:832(programlisting)
17241
#, no-wrap
17242
msgid ""
17243
"\n"
17244
"rsyslogd-2177: imuxsock lost 228 messages from pid 2547 due to rate-"
17245
"limiting\n"
17246
msgstr ""
17247
17248
#: serverguide/C/network-auth.xml:836(para)
17249
msgid ""
17250
"You may consider a change to rsyslog's configuration. In "
17251
"<filename>/etc/rsyslog.conf</filename>, put:"
17252
msgstr ""
17253
17254
#: serverguide/C/network-auth.xml:840(programlisting)
17255
#, no-wrap
17256
msgid ""
17257
"\n"
17258
"# Disable rate limiting\n"
17259
"# (default is 200 messages in 5 seconds; below we make the 5 become 0)\n"
17260
"$SystemLogRateLimitInterval 0\n"
17261
msgstr ""
17262
17263
#: serverguide/C/network-auth.xml:846(para)
17264
msgid "And then restart the rsyslog daemon:"
17265
msgstr ""
17266
17267
#: serverguide/C/network-auth.xml:851(command)
17268
msgid "sudo systemctl restart syslog.service"
17269
msgstr ""
17270
17271
#: serverguide/C/network-auth.xml:857(title)
17272
msgid "Replication"
17273
msgstr ""
17274
17275
#: serverguide/C/network-auth.xml:859(para)
17276
msgid ""
17277
"The LDAP service becomes increasingly important as more networked systems "
17278
"begin to depend on it. In such an environment, it is standard practice to "
17279
"build redundancy (high availability) into LDAP to prevent havoc should the "
17280
"LDAP server become unresponsive. This is done through <emphasis>LDAP "
17281
"replication</emphasis>."
17282
msgstr ""
17283
17284
#: serverguide/C/network-auth.xml:865(para)
17285
msgid ""
17286
"Replication is achieved via the <emphasis>Syncrepl</emphasis> engine. This "
17287
"allows changes to be synchronized using a <emphasis>Consumer</emphasis> - "
17288
"<emphasis>Provider</emphasis> model. The specific kind of replication we "
17289
"will implement in this guide is a combination of the following modes: "
17290
"<emphasis>refreshAndPersist</emphasis> and <emphasis>delta-"
17291
"syncrepl</emphasis>. This has the Provider push changed entries to the "
17292
"Consumer as soon as they're made but, in addition, only actual changes will "
17293
"be sent, not entire entries."
17294
msgstr ""
17295
17296
#: serverguide/C/network-auth.xml:874(title)
17297
msgid "Provider Configuration"
17298
msgstr ""
17299
17300
#: serverguide/C/network-auth.xml:876(para)
17301
msgid "Begin by configuring the <emphasis>Provider</emphasis>."
17302
msgstr ""
17303
17304
#: serverguide/C/network-auth.xml:883(para)
17305
msgid ""
17306
"Create an LDIF file with the following contents and name it "
17307
"<filename>provider_sync.ldif</filename>:"
17308
msgstr ""
17309
17310
#: serverguide/C/network-auth.xml:887(programlisting)
17311
#, no-wrap
17312
msgid ""
17313
"\n"
17314
"# Add indexes to the frontend db.\n"
17315
"dn: olcDatabase={1}mdb,cn=config\n"
17316
"changetype: modify\n"
17317
"add: olcDbIndex\n"
17318
"olcDbIndex: entryCSN eq\n"
17319
"-\n"
17320
"add: olcDbIndex\n"
17321
"olcDbIndex: entryUUID eq\n"
17322
"\n"
17323
"#Load the syncprov and accesslog modules.\n"
17324
"dn: cn=module{0},cn=config\n"
17325
"changetype: modify\n"
17326
"add: olcModuleLoad\n"
17327
"olcModuleLoad: syncprov\n"
17328
"-\n"
17329
"add: olcModuleLoad\n"
17330
"olcModuleLoad: accesslog\n"
17331
"\n"
17332
"# Accesslog database definitions\n"
17333
"dn: olcDatabase={2}mdb,cn=config\n"
17334
"objectClass: olcDatabaseConfig\n"
17335
"objectClass: olcMdbConfig\n"
17336
"olcDatabase: {2}mdb\n"
17337
"olcDbDirectory: /var/lib/ldap/accesslog\n"
17338
"olcSuffix: cn=accesslog\n"
17339
"olcRootDN: cn=admin,dc=example,dc=com\n"
17340
"olcDbIndex: default eq\n"
17341
"olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart\n"
17342
"\n"
17343
"# Accesslog db syncprov.\n"
17344
"dn: olcOverlay=syncprov,olcDatabase={2}mdb,cn=config\n"
17345
"changetype: add\n"
17346
"objectClass: olcOverlayConfig\n"
17347
"objectClass: olcSyncProvConfig\n"
17348
"olcOverlay: syncprov\n"
17349
"olcSpNoPresent: TRUE\n"
17350
"olcSpReloadHint: TRUE\n"
17351
"\n"
17352
"# syncrepl Provider for primary db\n"
17353
"dn: olcOverlay=syncprov,olcDatabase={1}mdb,cn=config\n"
17354
"changetype: add\n"
17355
"objectClass: olcOverlayConfig\n"
17356
"objectClass: olcSyncProvConfig\n"
17357
"olcOverlay: syncprov\n"
17358
"olcSpNoPresent: TRUE\n"
17359
"\n"
17360
"# accesslog overlay definitions for primary db\n"
17361
"dn: olcOverlay=accesslog,olcDatabase={1}mdb,cn=config\n"
17362
"objectClass: olcOverlayConfig\n"
17363
"objectClass: olcAccessLogConfig\n"
17364
"olcOverlay: accesslog\n"
17365
"olcAccessLogDB: cn=accesslog\n"
17366
"olcAccessLogOps: writes\n"
17367
"olcAccessLogSuccess: TRUE\n"
17368
"# scan the accesslog DB every day, and purge entries older than 7 days\n"
17369
"olcAccessLogPurge: 07+00:00 01+00:00\n"
17370
msgstr ""
17371
17372
#: serverguide/C/network-auth.xml:946(para)
17373
msgid ""
17374
"Change the rootDN in the LDIF file to match the one you have for your "
17375
"directory."
17376
msgstr ""
17377
17378
#: serverguide/C/network-auth.xml:954(para)
17379
msgid "Create a directory:"
17380
msgstr ""
17381
17382
#: serverguide/C/network-auth.xml:959(command)
17383
msgid "sudo -u openldap mkdir /var/lib/ldap/accesslog"
17384
msgstr ""
17385
17386
#: serverguide/C/network-auth.xml:965(para) serverguide/C/network-auth.xml:1044(para)
17387
msgid "Add the new content:"
17388
msgstr ""
17389
17390
#: serverguide/C/network-auth.xml:970(command)
17391
msgid "sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// -f provider_sync.ldif"
17392
msgstr ""
17393
17394
#: serverguide/C/network-auth.xml:977(para)
17395
msgid "The Provider is now configured."
17396
msgstr ""
17397
17398
#: serverguide/C/network-auth.xml:984(title)
17399
msgid "Consumer Configuration"
17400
msgstr ""
17401
17402
#: serverguide/C/network-auth.xml:986(para)
17403
msgid "And now configure the <emphasis>Consumer</emphasis>."
17404
msgstr ""
17405
17406
#: serverguide/C/network-auth.xml:993(para)
17407
msgid ""
17408
"Install the software by going through <xref linkend=\"openldap-server-"
17409
"installation\"/>. Make sure the slapd-config database is identical to the "
17410
"Provider's. In particular, make sure schemas and the databse suffix are the "
17411
"same."
17412
msgstr ""
17413
17414
#: serverguide/C/network-auth.xml:1000(para)
17415
msgid ""
17416
"Create an LDIF file with the following contents and name it "
17417
"<filename>consumer_sync.ldif</filename>:"
17418
msgstr ""
17419
17420
#: serverguide/C/network-auth.xml:1004(programlisting)
17421
#, no-wrap
17422
msgid ""
17423
"\n"
17424
"dn: cn=module{0},cn=config\n"
17425
"changetype: modify\n"
17426
"add: olcModuleLoad\n"
17427
"olcModuleLoad: syncprov\n"
17428
"\n"
17429
"dn: olcDatabase={1}mdb,cn=config\n"
17430
"changetype: modify\n"
17431
"add: olcDbIndex\n"
17432
"olcDbIndex: entryUUID eq\n"
17433
"-\n"
17434
"add: olcSyncRepl\n"
17435
"olcSyncRepl: rid=0 provider=ldap://ldap01.example.com bindmethod=simple "
17436
"binddn=\"cn=admin,dc=example,dc=com\"\n"
17437
" credentials=secret searchbase=\"dc=example,dc=com\" "
17438
"logbase=\"cn=accesslog\"\n"
17439
" logfilter=\"(&(objectClass=auditWriteObject)(reqResult=0))\" "
17440
"schemachecking=on\n"
17441
" type=refreshAndPersist retry=\"60 +\" syncdata=accesslog\n"
17442
"-\n"
17443
"add: olcUpdateRef\n"
17444
"olcUpdateRef: ldap://ldap01.example.com\n"
17445
msgstr ""
17446
17447
#: serverguide/C/network-auth.xml:1025(para)
17448
msgid "Ensure the following attributes have the correct values:"
17449
msgstr ""
17450
17451
#: serverguide/C/network-auth.xml:1030(para)
17452
msgid ""
17453
"<emphasis>provider</emphasis> (Provider server's hostname -- "
17454
"ldap01.example.com in this example -- or IP address)"
17455
msgstr ""
17456
17457
#: serverguide/C/network-auth.xml:1031(para)
17458
msgid "<emphasis>binddn</emphasis> (the admin DN you're using)"
17459
msgstr ""
17460
17461
#: serverguide/C/network-auth.xml:1032(para)
17462
msgid "<emphasis>credentials</emphasis> (the admin DN password you're using)"
17463
msgstr ""
17464
17465
#: serverguide/C/network-auth.xml:1033(para)
17466
msgid "<emphasis>searchbase</emphasis> (the database suffix you're using)"
17467
msgstr ""
17468
17469
#: serverguide/C/network-auth.xml:1034(para)
17470
msgid ""
17471
"<emphasis>olcUpdateRef</emphasis> (Provider server's hostname or IP address)"
17472
msgstr ""
17473
17474
#: serverguide/C/network-auth.xml:1035(para)
17475
msgid ""
17476
"<emphasis>rid</emphasis> (Replica ID, an unique 3-digit that identifies the "
17477
"replica. Each consumer should have at least one rid)"
17478
msgstr ""
17479
17480
#: serverguide/C/network-auth.xml:1049(command)
17481
msgid "sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// -f consumer_sync.ldif"
17482
msgstr ""
17483
17484
#: serverguide/C/network-auth.xml:1056(para)
17485
msgid ""
17486
"You're done. The two databases (suffix: dc=example,dc=com) should now be "
17487
"synchronizing."
17488
msgstr ""
17489
17490
#: serverguide/C/network-auth.xml:1065(para)
17491
msgid "Once replication starts, you can monitor it by running"
17492
msgstr ""
17493
17494
#: serverguide/C/network-auth.xml:1070(command)
17495
msgid ""
17496
"ldapsearch -z1 -LLLQY EXTERNAL -H ldapi:/// -s base -b dc=example,dc=com "
17497
"contextCSN"
17498
msgstr ""
17499
17500
#: serverguide/C/network-auth.xml:1071(computeroutput)
17501
#, no-wrap
17502
msgid ""
17503
"\n"
17504
"dn: dc=example,dc=com\n"
17505
"contextCSN: 20120201193408.178454Z#000000#000#000000\n"
17506
msgstr ""
17507
17508
#: serverguide/C/network-auth.xml:1077(para)
17509
msgid ""
17510
"on both the provider and the consumer. Once the output "
17511
"(<computeroutput>20120201193408.178454Z#000000#000#000000</computeroutput> "
17512
"in the above example) for both machines match, you have replication. Every "
17513
"time a change is done in the provider, this value will change and so should "
17514
"the one in the consumer(s)."
17515
msgstr ""
17516
17517
#: serverguide/C/network-auth.xml:1086(para)
17518
msgid ""
17519
"If your connection is slow and/or your ldap database large, it might take a "
17520
"while for the consumer's <emphasis>contextCSN</emphasis> match the "
17521
"provider's. But, you will know it is progressing since the consumer's "
17522
"<emphasis>contextCSN</emphasis> will be steadly increasing."
17523
msgstr ""
17524
17525
#: serverguide/C/network-auth.xml:1094(para)
17526
msgid ""
17527
"If the consumer's <emphasis>contextCSN</emphasis> is missing or does not "
17528
"match the provider, you should stop and figure out the issue before "
17529
"continuing. Try checking the slapd (syslog) and the auth log files in the "
17530
"provider to see if the consumer's authentication requests were successful or "
17531
"its requests to retrieve data (they look like a lot of ldapsearch "
17532
"statements) return no errors."
17533
msgstr ""
17534
17535
#: serverguide/C/network-auth.xml:1103(para)
17536
msgid ""
17537
"To test if it worked simply query, on the Consumer, the DNs in the database:"
17538
msgstr ""
17539
17540
#: serverguide/C/network-auth.xml:1108(command)
17541
msgid ""
17542
"sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b dc=example,dc=com dn"
17543
msgstr ""
17544
17545
#: serverguide/C/network-auth.xml:1111(para)
17546
msgid ""
17547
"You should see the user 'john' and the group 'miners' as well as the nodes "
17548
"'People' and 'Groups'."
17549
msgstr ""
17550
17551
#: serverguide/C/network-auth.xml:1120(title)
17552
msgid "Access Control"
17553
msgstr ""
17554
17555
#: serverguide/C/network-auth.xml:1122(para)
17556
msgid ""
17557
"The management of what type of access (read, write, etc) users should be "
17558
"granted to resources is known as <emphasis>access control</emphasis>. The "
17559
"configuration directives involved are called <emphasis>access control "
17560
"lists</emphasis> or ACL."
17561
msgstr ""
17562
17563
#: serverguide/C/network-auth.xml:1127(para)
17564
msgid ""
17565
"When we installed the slapd package various ACL were set up automatically. "
17566
"We will look at a few important consequences of those defaults and, in so "
17567
"doing, we'll get an idea of how ACLs work and how they're configured."
17568
msgstr ""
17569
17570
#: serverguide/C/network-auth.xml:1132(para)
17571
msgid ""
17572
"To get the effective ACL for an LDAP query we need to look at the ACL "
17573
"entries of the database being queried as well as those of the special "
17574
"frontend database instance. The ACLs belonging to the latter act as defaults "
17575
"in case those of the former do not match. The frontend database is the "
17576
"second to be consulted and the ACL to be applied is the first to match "
17577
"(\"first match wins\") among these 2 ACL sources. The following commands "
17578
"will give, respectively, the ACLs of the mdb database "
17579
"(\"dc=example,dc=com\") and those of the frontend database:"
17580
msgstr ""
17581
17582
#: serverguide/C/network-auth.xml:1141(command)
17583
msgid ""
17584
"sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b \\ cn=config "
17585
"'(olcDatabase={1}mdb)' olcAccess"
17586
msgstr ""
17587
17588
#: serverguide/C/network-auth.xml:1143(computeroutput)
17589
#, no-wrap
17590
msgid ""
17591
"\n"
17592
"dn: olcDatabase={1}mdb,cn=config\n"
17593
"olcAccess: {0}to attrs=userPassword by self write by anonymous auth by * "
17594
"none\n"
17595
"olcAccess: {1}to attrs=shadowLastChange by self write by * read\n"
17596
"olcAccess: {2}to * by * read\n"
17597
msgstr ""
17598
17599
#: serverguide/C/network-auth.xml:1152(para)
17600
msgid ""
17601
"The rootDN always has full rights to its database and does not need to be "
17602
"included in any ACL."
17603
msgstr ""
17604
17605
#: serverguide/C/network-auth.xml:1158(command)
17606
msgid ""
17607
"sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b \\ cn=config "
17608
"'(olcDatabase={-1}frontend)' olcAccess"
17609
msgstr ""
17610
17611
#: serverguide/C/network-auth.xml:1160(computeroutput)
17612
#, no-wrap
17613
msgid ""
17614
"\n"
17615
"dn: olcDatabase={-1}frontend,cn=config\n"
17616
"olcAccess: {0}to * by "
17617
"dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external\n"
17618
" ,cn=auth manage by * break\n"
17619
"olcAccess: {1}to dn.exact=\"\" by * read\n"
17620
"olcAccess: {2}to dn.base=\"cn=Subschema\" by * read\n"
17621
msgstr ""
17622
17623
#: serverguide/C/network-auth.xml:1169(para)
17624
msgid "The very first two ACLs are crucial:"
17625
msgstr ""
17626
17627
#: serverguide/C/network-auth.xml:1173(programlisting)
17628
#, no-wrap
17629
msgid ""
17630
"\n"
17631
"olcAccess: {0}to attrs=userPassword by self write by anonymous auth by * "
17632
"none\n"
17633
"olcAccess: {1}to attrs=shadowLastChange by self write by * read\n"
17634
msgstr ""
17635
17636
#: serverguide/C/network-auth.xml:1178(para)
17637
msgid "This can be represented differently for easier digestion:"
17638
msgstr ""
17639
17640
#: serverguide/C/network-auth.xml:1182(programlisting)
17641
#, no-wrap
17642
msgid ""
17643
"\n"
17644
"to attrs=userPassword\n"
17645
"\tby self write\n"
17646
"\tby anonymous auth\n"
17647
"\tby * none\n"
17648
"\n"
17649
"to attrs=shadowLastChange\n"
17650
"\tby self write\n"
17651
"\tby * read\n"
17652
msgstr ""
17653
17654
#: serverguide/C/network-auth.xml:1193(para)
17655
msgid "These ACLs enforce the following:"
17656
msgstr ""
17657
17658
#: serverguide/C/network-auth.xml:1200(para)
17659
msgid ""
17660
"Anonymous 'auth' access is provided to the <emphasis>userPassword</emphasis> "
17661
"attribute so that users can authenticate, or <emphasis>bind</emphasis>. "
17662
"Perhaps counter-intuitively, 'by anonymous auth' is needed even when "
17663
"anonymous access to the DIT is unwanted, otherwise this would be a chicken "
17664
"and egg problem: before authentication, all users are anonymous."
17665
msgstr ""
17666
17667
#: serverguide/C/network-auth.xml:1209(para)
17668
msgid ""
17669
"The <emphasis>by self write</emphasis> ACL grants write access to the "
17670
"<emphasis>userPassword</emphasis> attribute to users who authenticated as "
17671
"the <emphasis>dn</emphasis> where the attribute lives. In other words, users "
17672
"can update the <emphasis>userPassword</emphasis> attribute of their own "
17673
"entries."
17674
msgstr ""
17675
17676
#: serverguide/C/network-auth.xml:1217(para)
17677
msgid ""
17678
"The <emphasis>userPassword</emphasis> attribute is otherwise unaccessible by "
17679
"all other users, with the exception of the rootDN, who always has access and "
17680
"doesn't need to be mentioned explicitly."
17681
msgstr ""
17682
17683
#: serverguide/C/network-auth.xml:1224(para)
17684
msgid ""
17685
"In order for users to change their own password, using "
17686
"<command>passwd</command> or other utilities, the user's own "
17687
"<emphasis>shadowLastChange</emphasis> attribute needs to be writable. All "
17688
"other directory users get to read this attribute's contents."
17689
msgstr ""
17690
17691
#: serverguide/C/network-auth.xml:1233(para)
17692
msgid ""
17693
"This DIT can be searched anonymously because of 'to * by * read' in this "
17694
"ACL, which grants read access to everything else, by anyone (including "
17695
"anonymous):"
17696
msgstr ""
17697
17698
#: serverguide/C/network-auth.xml:1238(programlisting)
17699
#, no-wrap
17700
msgid ""
17701
"\n"
17702
"to *\n"
17703
"\tby * read\n"
17704
msgstr ""
17705
17706
#: serverguide/C/network-auth.xml:1243(para)
17707
msgid ""
17708
"If this is unwanted then you need to change the ACLs. To force "
17709
"authentication during a bind request you can alternatively (or in "
17710
"combination with the modified ACL) use the 'olcRequire: authc' directive."
17711
msgstr ""
17712
17713
#: serverguide/C/network-auth.xml:1248(para)
17714
msgid ""
17715
"As previously mentioned, there is no administrative account (\"rootDN\") "
17716
"created for the slapd-config database. There is, however, a SASL identity "
17717
"that is granted full access to it. It represents the localhost's superuser "
17718
"(root/sudo). Here it is:"
17719
msgstr ""
17720
17721
#: serverguide/C/network-auth.xml:1253(programlisting)
17722
#, no-wrap
17723
msgid ""
17724
"\n"
17725
"dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth \n"
17726
msgstr ""
17727
17728
#: serverguide/C/network-auth.xml:1257(para)
17729
msgid ""
17730
"The following command will display the ACLs of the slapd-config database:"
17731
msgstr ""
17732
17733
#: serverguide/C/network-auth.xml:1262(command)
17734
msgid ""
17735
"sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b \\ cn=config "
17736
"'(olcDatabase={0}config)' olcAccess"
17737
msgstr ""
17738
17739
#: serverguide/C/network-auth.xml:1264(computeroutput)
17740
#, no-wrap
17741
msgid ""
17742
"\n"
17743
"dn: olcDatabase={0}config,cn=config\n"
17744
"olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,\n"
17745
" cn=external,cn=auth manage by * break\n"
17746
msgstr ""
17747
17748
#: serverguide/C/network-auth.xml:1271(para)
17749
msgid ""
17750
"Since this is a SASL identity we need to use a SASL "
17751
"<emphasis>mechanism</emphasis> when invoking the LDAP utility in question "
17752
"and we have seen it plenty of times in this guide. It is the EXTERNAL "
17753
"mechanism. See the previous command for an example. Note that:"
17754
msgstr ""
17755
17756
#: serverguide/C/network-auth.xml:1279(para)
17757
msgid ""
17758
"You must use <emphasis>sudo</emphasis> to become the root identity in order "
17759
"for the ACL to match."
17760
msgstr ""
17761
17762
#: serverguide/C/network-auth.xml:1285(para)
17763
msgid ""
17764
"The EXTERNAL mechanism works via <emphasis>IPC</emphasis> (UNIX domain "
17765
"sockets). This means you must use the <emphasis>ldapi</emphasis> URI format."
17766
msgstr ""
17767
17768
#: serverguide/C/network-auth.xml:1293(para)
17769
msgid "A succinct way to get all the ACLs is like this:"
17770
msgstr ""
17771
17772
#: serverguide/C/network-auth.xml:1298(command)
17773
msgid ""
17774
"sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b \\ cn=config "
17775
"'(olcAccess=*)' olcAccess olcSuffix"
17776
msgstr ""
17777
17778
#: serverguide/C/network-auth.xml:1302(para)
17779
msgid ""
17780
"There is much to say on the topic of access control. See the man page for "
17781
"<ulink "
17782
"url=\"http://manpages.ubuntu.com/manpages/en/man5/slapd.access.5.html\">slapd"
17783
".access</ulink>."
17784
msgstr ""
17785
17786
#: serverguide/C/network-auth.xml:1310(title)
17787
msgid "TLS"
17788
msgstr ""
17789
17790
#: serverguide/C/network-auth.xml:1312(para)
17791
msgid ""
17792
"When authenticating to an OpenLDAP server it is best to do so using an "
17793
"encrypted session. This can be accomplished using Transport Layer Security "
17794
"(TLS)."
17795
msgstr ""
17796
17797
#: serverguide/C/network-auth.xml:1317(para)
17798
msgid ""
17799
"Here, we will be our own <emphasis>Certificate Authority</emphasis> and then "
17800
"create and sign our LDAP server certificate as that CA. Since "
17801
"<application>slapd</application> is compiled using the "
17802
"<application>gnutls</application> library, we will use the "
17803
"<application>certtool</application> utility to complete these tasks."
17804
msgstr ""
17805
17806
#: serverguide/C/network-auth.xml:1326(para)
17807
msgid ""
17808
"Install the <application>gnutls-bin</application> and <application>ssl-"
17809
"cert</application> packages:"
17810
msgstr ""
17811
17812
#: serverguide/C/network-auth.xml:1331(command)
17813
msgid "sudo apt install gnutls-bin ssl-cert"
17814
msgstr ""
17815
17816
#: serverguide/C/network-auth.xml:1337(para)
17817
msgid "Create a private key for the Certificate Authority:"
17818
msgstr ""
17819
17820
#: serverguide/C/network-auth.xml:1342(command)
17821
msgid ""
17822
"sudo sh -c \"certtool --generate-privkey > /etc/ssl/private/cakey.pem\""
17823
msgstr ""
17824
17825
#: serverguide/C/network-auth.xml:1348(para)
17826
msgid ""
17827
"Create the template/file <filename>/etc/ssl/ca.info</filename> to define the "
17828
"CA:"
17829
msgstr ""
17830
17831
#: serverguide/C/network-auth.xml:1352(programlisting)
17832
#, no-wrap
17833
msgid ""
17834
"\n"
17835
"cn = Example Company\n"
17836
"ca\n"
17837
"cert_signing_key\n"
17838
msgstr ""
17839
17840
#: serverguide/C/network-auth.xml:1361(para)
17841
msgid "Create the self-signed CA certificate:"
17842
msgstr ""
17843
17844
#: serverguide/C/network-auth.xml:1366(command)
17845
msgid ""
17846
"sudo certtool --generate-self-signed \\ --load-privkey "
17847
"/etc/ssl/private/cakey.pem \\ --template /etc/ssl/ca.info \\ --outfile "
17848
"/etc/ssl/certs/cacert.pem"
17849
msgstr ""
17850
17851
#: serverguide/C/network-auth.xml:1375(para)
17852
msgid "Make a private key for the server:"
17853
msgstr ""
17854
17855
#: serverguide/C/network-auth.xml:1380(command)
17856
msgid ""
17857
"sudo certtool --generate-privkey \\ --bits 1024 \\ --outfile "
17858
"/etc/ssl/private/ldap01_slapd_key.pem"
17859
msgstr ""
17860
17861
#: serverguide/C/network-auth.xml:1386(para)
17862
msgid ""
17863
"Replace <emphasis>ldap01</emphasis> in the filename with your server's "
17864
"hostname. Naming the certificate and key for the host and service that will "
17865
"be using them will help keep things clear."
17866
msgstr ""
17867
17868
#: serverguide/C/network-auth.xml:1395(para)
17869
msgid ""
17870
"Create the <filename>/etc/ssl/ldap01.info</filename> info file containing:"
17871
msgstr ""
17872
17873
#: serverguide/C/network-auth.xml:1399(programlisting)
17874
#, no-wrap
17875
msgid ""
17876
"\n"
17877
"organization = Example Company\n"
17878
"cn = ldap01.example.com\n"
17879
"tls_www_server\n"
17880
"encryption_key\n"
17881
"signing_key\n"
17882
"expiration_days = 3650\n"
17883
msgstr ""
17884
17885
#: serverguide/C/network-auth.xml:1408(para)
17886
msgid "The above certificate is good for 10 years. Adjust accordingly."
17887
msgstr ""
17888
17889
#: serverguide/C/network-auth.xml:1414(para)
17890
msgid "Create the server's certificate:"
17891
msgstr ""
17892
17893
#: serverguide/C/network-auth.xml:1419(command)
17894
msgid ""
17895
"sudo certtool --generate-certificate \\ --load-privkey "
17896
"/etc/ssl/private/ldap01_slapd_key.pem \\ --load-ca-certificate "
17897
"/etc/ssl/certs/cacert.pem \\ --load-ca-privkey /etc/ssl/private/cakey.pem \\ "
17898
"--template /etc/ssl/ldap01.info \\ --outfile "
17899
"/etc/ssl/certs/ldap01_slapd_cert.pem"
17900
msgstr ""
17901
17902
#: serverguide/C/network-auth.xml:1430(para)
17903
msgid "Adjust permissions and ownership:"
17904
msgstr ""
17905
17906
#: serverguide/C/network-auth.xml:1434(command)
17907
msgid "sudo chgrp openldap /etc/ssl/private/ldap01_slapd_key.pem"
17908
msgstr ""
17909
17910
#: serverguide/C/network-auth.xml:1435(command)
17911
msgid "sudo chmod 0640 /etc/ssl/private/ldap01_slapd_key.pem"
17912
msgstr ""
17913
17914
#: serverguide/C/network-auth.xml:1436(command) serverguide/C/network-auth.xml:1594(command)
17915
msgid "sudo gpasswd -a openldap ssl-cert"
17916
msgstr ""
17917
17918
#: serverguide/C/network-auth.xml:1441(para)
17919
msgid ""
17920
"Now restart <application>slapd</application>, since we added the 'openldap' "
17921
"user to the 'ssl-cert' group:"
17922
msgstr ""
17923
17924
#: serverguide/C/network-auth.xml:1446(command) serverguide/C/network-auth.xml:1599(command) serverguide/C/network-auth.xml:1673(command) serverguide/C/network-auth.xml:3887(command)
17925
msgid "sudo systemctl restart slapd.service"
17926
msgstr ""
17927
17928
#: serverguide/C/network-auth.xml:1448(para)
17929
msgid "Your server is now ready to accept the new TLS configuration."
17930
msgstr ""
17931
17932
#: serverguide/C/network-auth.xml:1454(para)
17933
msgid ""
17934
"Create the file <filename>certinfo.ldif</filename> with the following "
17935
"contents (adjust accordingly, our example assumes we created certs using "
17936
"https://www.cacert.org):"
17937
msgstr ""
17938
17939
#: serverguide/C/network-auth.xml:1458(programlisting)
17940
#, no-wrap
17941
msgid ""
17942
"\n"
17943
"dn: cn=config\n"
17944
"add: olcTLSCACertificateFile\n"
17945
"olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem\n"
17946
"-\n"
17947
"add: olcTLSCertificateFile\n"
17948
"olcTLSCertificateFile: /etc/ssl/certs/ldap01_slapd_cert.pem\n"
17949
"-\n"
17950
"add: olcTLSCertificateKeyFile\n"
17951
"olcTLSCertificateKeyFile: /etc/ssl/private/ldap01_slapd_key.pem\n"
17952
msgstr ""
17953
17954
#: serverguide/C/network-auth.xml:1470(para)
17955
msgid ""
17956
"Use the <application>ldapmodify</application> command to tell slapd about "
17957
"our TLS work via the slapd-config database:"
17958
msgstr ""
17959
17960
#: serverguide/C/network-auth.xml:1475(command) serverguide/C/network-auth.xml:1623(command)
17961
msgid "sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f certinfo.ldif"
17962
msgstr ""
17963
17964
#: serverguide/C/network-auth.xml:1478(para)
17965
msgid ""
17966
"Contratry to popular belief, you do not need <emphasis>ldaps://</emphasis> "
17967
"in <filename>/etc/default/slapd</filename> in order to use encryption. You "
17968
"should have just:"
17969
msgstr ""
17970
17971
#: serverguide/C/network-auth.xml:1483(programlisting)
17972
#, no-wrap
17973
msgid ""
17974
"\n"
17975
"SLAPD_SERVICES=\"ldap:/// ldapi:///\"\n"
17976
msgstr ""
17977
17978
#: serverguide/C/network-auth.xml:1488(para)
17979
msgid ""
17980
"LDAP over TLS/SSL (ldaps://) is deprecated in favour of "
17981
"<emphasis>StartTLS</emphasis>. The latter refers to an existing LDAP session "
17982
"(listening on TCP port 389) becoming protected by TLS/SSL whereas LDAPS, "
17983
"like HTTPS, is a distinct encrypted-from-the-start protocol that operates "
17984
"over TCP port 636."
17985
msgstr ""
17986
17987
#: serverguide/C/network-auth.xml:1498(title)
17988
msgid "Replication and TLS"
17989
msgstr ""
17990
17991
#: serverguide/C/network-auth.xml:1500(para)
17992
msgid ""
17993
"If you have set up replication between servers, it is common practice to "
17994
"encrypt (StartTLS) the replication traffic to prevent evesdropping. This is "
17995
"distinct from using encryption with authentication as we did above. In this "
17996
"section we will build on that TLS-authentication work."
17997
msgstr ""
17998
17999
#: serverguide/C/network-auth.xml:1506(para)
18000
msgid ""
18001
"The assumption here is that you have set up replication between Provider and "
18002
"Consumer according to <xref linkend=\"openldap-server-replication\"/> and "
18003
"have configured TLS for authentication on the Provider by following <xref "
18004
"linkend=\"openldap-tls\"/>."
18005
msgstr ""
18006
18007
#: serverguide/C/network-auth.xml:1511(para)
18008
msgid ""
18009
"As previously stated, the objective (for us) with replication is high "
18010
"availablity for the LDAP service. Since we have TLS for authentication on "
18011
"the Provider we will require the same on the Consumer. In addition to this, "
18012
"however, we want to encrypt replication traffic. What remains to be done is "
18013
"to create a key and certificate for the Consumer and then configure "
18014
"accordingly. We will generate the key/certificate on the Provider, to avoid "
18015
"having to create another CA certificate, and then transfer the necessary "
18016
"material over to the Consumer."
18017
msgstr ""
18018
18019
#: serverguide/C/network-auth.xml:1522(para) serverguide/C/network-auth.xml:1679(para)
18020
msgid "On the Provider,"
18021
msgstr ""
18022
18023
#: serverguide/C/network-auth.xml:1526(para)
18024
msgid ""
18025
"Create a holding directory (which will be used for the eventual transfer) "
18026
"and then the Consumer's private key:"
18027
msgstr ""
18028
18029
#: serverguide/C/network-auth.xml:1531(command)
18030
msgid "mkdir ldap02-ssl"
18031
msgstr ""
18032
18033
#: serverguide/C/network-auth.xml:1532(command)
18034
msgid "cd ldap02-ssl"
18035
msgstr ""
18036
18037
#: serverguide/C/network-auth.xml:1533(command)
18038
msgid ""
18039
"sudo certtool --generate-privkey \\ --bits 1024 \\ --outfile "
18040
"ldap02_slapd_key.pem"
18041
msgstr ""
18042
18043
#: serverguide/C/network-auth.xml:1538(para)
18044
msgid ""
18045
"Create an info file, <filename>ldap02.info</filename>, for the Consumer "
18046
"server, adjusting its values accordingly:"
18047
msgstr ""
18048
18049
#: serverguide/C/network-auth.xml:1542(programlisting)
18050
#, no-wrap
18051
msgid ""
18052
"\n"
18053
"organization = Example Company\n"
18054
"cn = ldap02.example.com\n"
18055
"tls_www_server\n"
18056
"encryption_key\n"
18057
"signing_key\n"
18058
"expiration_days = 3650\n"
18059
msgstr ""
18060
18061
#: serverguide/C/network-auth.xml:1551(para)
18062
msgid "Create the Consumer's certificate:"
18063
msgstr ""
18064
18065
#: serverguide/C/network-auth.xml:1556(command)
18066
msgid ""
18067
"sudo certtool --generate-certificate \\ --load-privkey ldap02_slapd_key.pem "
18068
"\\ --load-ca-certificate /etc/ssl/certs/cacert.pem \\ --load-ca-privkey "
18069
"/etc/ssl/private/cakey.pem \\ --template ldap02.info \\ --outfile "
18070
"ldap02_slapd_cert.pem"
18071
msgstr ""
18072
18073
#: serverguide/C/network-auth.xml:1564(para)
18074
msgid "Get a copy of the CA certificate:"
18075
msgstr ""
18076
18077
#: serverguide/C/network-auth.xml:1569(command)
18078
msgid "cp /etc/ssl/certs/cacert.pem ."
18079
msgstr ""
18080
18081
#: serverguide/C/network-auth.xml:1572(para)
18082
msgid ""
18083
"We're done. Now transfer the <filename>ldap02-ssl</filename> directory to "
18084
"the Consumer. Here we use scp (adjust accordingly):"
18085
msgstr ""
18086
18087
#: serverguide/C/network-auth.xml:1577(command)
18088
msgid "cd .."
18089
msgstr ""
18090
18091
#: serverguide/C/network-auth.xml:1578(command)
18092
msgid "scp -r ldap02-ssl user@consumer:"
18093
msgstr ""
18094
18095
#: serverguide/C/network-auth.xml:1584(para) serverguide/C/network-auth.xml:1632(para)
18096
msgid "On the Consumer,"
18097
msgstr ""
18098
18099
#: serverguide/C/network-auth.xml:1588(para)
18100
msgid "Configure TLS authentication:"
18101
msgstr ""
18102
18103
#: serverguide/C/network-auth.xml:1593(command)
18104
msgid "sudo apt install ssl-cert"
18105
msgstr ""
18106
18107
#: serverguide/C/network-auth.xml:1595(command)
18108
msgid "sudo cp ldap02_slapd_cert.pem cacert.pem /etc/ssl/certs"
18109
msgstr ""
18110
18111
#: serverguide/C/network-auth.xml:1596(command)
18112
msgid "sudo cp ldap02_slapd_key.pem /etc/ssl/private"
18113
msgstr ""
18114
18115
#: serverguide/C/network-auth.xml:1597(command)
18116
msgid "sudo chgrp openldap /etc/ssl/private/ldap02_slapd_key.pem"
18117
msgstr ""
18118
18119
#: serverguide/C/network-auth.xml:1598(command)
18120
msgid "sudo chmod 0640 /etc/ssl/private/ldap02_slapd_key.pem"
18121
msgstr ""
18122
18123
#: serverguide/C/network-auth.xml:1602(para)
18124
msgid ""
18125
"Create the file <filename>/etc/ssl/certinfo.ldif</filename> with the "
18126
"following contents (adjust accordingly):"
18127
msgstr ""
18128
18129
#: serverguide/C/network-auth.xml:1606(programlisting)
18130
#, no-wrap
18131
msgid ""
18132
"\n"
18133
"dn: cn=config\n"
18134
"add: olcTLSCACertificateFile\n"
18135
"olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem\n"
18136
"-\n"
18137
"add: olcTLSCertificateFile\n"
18138
"olcTLSCertificateFile: /etc/ssl/certs/ldap02_slapd_cert.pem\n"
18139
"-\n"
18140
"add: olcTLSCertificateKeyFile\n"
18141
"olcTLSCertificateKeyFile: /etc/ssl/private/ldap02_slapd_key.pem\n"
18142
msgstr ""
18143
18144
#: serverguide/C/network-auth.xml:1618(para)
18145
msgid "Configure the slapd-config database:"
18146
msgstr ""
18147
18148
#: serverguide/C/network-auth.xml:1626(para)
18149
msgid ""
18150
"Configure <filename>/etc/default/slapd</filename> as on the Provider "
18151
"(SLAPD_SERVICES)."
18152
msgstr ""
18153
18154
#: serverguide/C/network-auth.xml:1636(para)
18155
msgid ""
18156
"Configure TLS for Consumer-side replication. Modify the existing "
18157
"<emphasis>olcSyncrepl</emphasis> attribute by tacking on some TLS options. "
18158
"In so doing, we will see, for the first time, how to change an attribute's "
18159
"value(s)."
18160
msgstr ""
18161
18162
#: serverguide/C/network-auth.xml:1641(para)
18163
msgid ""
18164
"Create the file <filename>consumer_sync_tls.ldif</filename> with the "
18165
"following contents:"
18166
msgstr ""
18167
18168
#: serverguide/C/network-auth.xml:1645(programlisting)
18169
#, no-wrap
18170
msgid ""
18171
"\n"
18172
"dn: olcDatabase={1}mdb,cn=config\n"
18173
"replace: olcSyncRepl\n"
18174
"olcSyncRepl: rid=0 provider=ldap://ldap01.example.com bindmethod=simple\n"
18175
" binddn=\"cn=admin,dc=example,dc=com\" credentials=secret "
18176
"searchbase=\"dc=example,dc=com\"\n"
18177
" logbase=\"cn=accesslog\" "
18178
"logfilter=\"(&(objectClass=auditWriteObject)(reqResult=0))\"\n"
18179
" schemachecking=on type=refreshAndPersist retry=\"60 +\" syncdata=accesslog\n"
18180
" starttls=critical tls_reqcert=demand\n"
18181
msgstr ""
18182
18183
#: serverguide/C/network-auth.xml:1655(para)
18184
msgid ""
18185
"The extra options specify, respectively, that the consumer must use StartTLS "
18186
"and that the CA certificate is required to verify the Provider's identity. "
18187
"Also note the LDIF syntax for changing the values of an attribute "
18188
"('replace')."
18189
msgstr ""
18190
18191
#: serverguide/C/network-auth.xml:1660(para)
18192
msgid "Implement these changes:"
18193
msgstr ""
18194
18195
#: serverguide/C/network-auth.xml:1665(command)
18196
msgid "sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f consumer_sync_tls.ldif"
18197
msgstr ""
18198
18199
#: serverguide/C/network-auth.xml:1668(para)
18200
msgid "And restart slapd:"
18201
msgstr ""
18202
18203
#: serverguide/C/network-auth.xml:1683(para)
18204
msgid ""
18205
"Check to see that a TLS session has been established. In "
18206
"<filename>/var/log/syslog</filename>, providing you have 'conns'-level "
18207
"logging set up, you should see messages similar to:"
18208
msgstr ""
18209
18210
#: serverguide/C/network-auth.xml:1688(programlisting)
18211
#, no-wrap
18212
msgid ""
18213
"\n"
18214
"slapd[3620]: conn=1047 fd=20 ACCEPT from IP=10.153.107.229:57922 "
18215
"(IP=0.0.0.0:389)\n"
18216
"slapd[3620]: conn=1047 op=0 EXT oid=1.3.6.1.4.1.1466.20037\n"
18217
"slapd[3620]: conn=1047 op=0 STARTTLS\n"
18218
"slapd[3620]: conn=1047 op=0 RESULT oid= err=0 text=\n"
18219
"slapd[3620]: conn=1047 fd=20 TLS established tls_ssf=128 ssf=128\n"
18220
"slapd[3620]: conn=1047 op=1 BIND dn=\"cn=admin,dc=example,dc=com\" "
18221
"method=128\n"
18222
"slapd[3620]: conn=1047 op=1 BIND dn=\"cn=admin,dc=example,dc=com\" "
18223
"mech=SIMPLE ssf=0\n"
18224
"slapd[3620]: conn=1047 op=1 RESULT tag=97 err=0 text\n"
18225
msgstr ""
18226
18227
#: serverguide/C/network-auth.xml:1706(title)
18228
msgid "LDAP Authentication"
18229
msgstr ""
18230
18231
#: serverguide/C/network-auth.xml:1708(para)
18232
msgid ""
18233
"Once you have a working LDAP server, you will need to install libraries on "
18234
"the client that will know how and when to contact it. On Ubuntu, this has "
18235
"been traditionally accomplished by installing the <application>libnss-"
18236
"ldap</application> package. This package will bring in other tools that will "
18237
"assist you in the configuration step. Install this package now:"
18238
msgstr ""
18239
18240
#: serverguide/C/network-auth.xml:1715(command) serverguide/C/network-auth.xml:2479(screen)
18241
msgid "sudo apt install libnss-ldap"
18242
msgstr ""
18243
18244
#: serverguide/C/network-auth.xml:1718(para)
18245
msgid ""
18246
"You will be prompted for details of your LDAP server. If you make a mistake "
18247
"you can try again using:"
18248
msgstr ""
18249
18250
#: serverguide/C/network-auth.xml:1723(command)
18251
msgid "sudo dpkg-reconfigure ldap-auth-config"
18252
msgstr ""
18253
18254
#: serverguide/C/network-auth.xml:1726(para)
18255
msgid ""
18256
"The results of the dialog can be seen in "
18257
"<filename>/etc/ldap.conf</filename>. If your server requires options not "
18258
"covered in the menu edit this file accordingly."
18259
msgstr ""
18260
18261
#: serverguide/C/network-auth.xml:1731(para)
18262
msgid "Now configure the LDAP profile for NSS:"
18263
msgstr ""
18264
18265
#: serverguide/C/network-auth.xml:1736(command) serverguide/C/network-auth.xml:2484(screen)
18266
msgid "sudo auth-client-config -t nss -p lac_ldap"
18267
msgstr ""
18268
18269
#: serverguide/C/network-auth.xml:1739(para)
18270
msgid "Configure the system to use LDAP for authentication:"
18271
msgstr ""
18272
18273
#: serverguide/C/network-auth.xml:1744(command)
18274
msgid "sudo pam-auth-update"
18275
msgstr ""
18276
18277
#: serverguide/C/network-auth.xml:1747(para)
18278
msgid ""
18279
"From the menu, choose LDAP and any other authentication mechanisms you need."
18280
msgstr ""
18281
18282
#: serverguide/C/network-auth.xml:1751(para)
18283
msgid "You should now be able to log in using LDAP-based credentials."
18284
msgstr ""
18285
18286
#: serverguide/C/network-auth.xml:1755(para)
18287
msgid ""
18288
"LDAP clients will need to refer to multiple servers if replication is in "
18289
"use. In <filename>/etc/ldap.conf</filename> you would have something like:"
18290
msgstr ""
18291
18292
#: serverguide/C/network-auth.xml:1760(programlisting)
18293
#, no-wrap
18294
msgid ""
18295
"\n"
18296
"uri ldap://ldap01.example.com ldap://ldap02.example.com\n"
18297
msgstr ""
18298
18299
#: serverguide/C/network-auth.xml:1764(para)
18300
msgid ""
18301
"The request will time out and the Consumer (ldap02) will attempt to be "
18302
"reached if the Provider (ldap01) becomes unresponsive."
18303
msgstr ""
18304
18305
#: serverguide/C/network-auth.xml:1768(para)
18306
msgid ""
18307
"If you are going to use LDAP to store Samba users you will need to configure "
18308
"the Samba server to authenticate using LDAP. See <xref linkend=\"samba-"
18309
"ldap\"/> for details."
18310
msgstr ""
18311
18312
#: serverguide/C/network-auth.xml:1774(para)
18313
msgid ""
18314
"An alternative to the <application>libnss-ldap</application> package is the "
18315
"<application>libnss-ldapd</application> package. This, however, will bring "
18316
"in the <application>nscd</application> package which is problably not "
18317
"wanted. Simply remove it afterwards."
18318
msgstr ""
18319
18320
#: serverguide/C/network-auth.xml:1784(title)
18321
msgid "User and Group Management"
18322
msgstr ""
18323
18324
#: serverguide/C/network-auth.xml:1786(para)
18325
msgid ""
18326
"The <application>ldap-utils</application> package comes with enough "
18327
"utilities to manage the directory but the long string of options needed can "
18328
"make them a burden to use. The <application>ldapscripts</application> "
18329
"package contains wrapper scripts to these utilities that some people find "
18330
"easier to use."
18331
msgstr ""
18332
18333
#: serverguide/C/network-auth.xml:1792(para)
18334
msgid "Install the package:"
18335
msgstr ""
18336
18337
#: serverguide/C/network-auth.xml:1797(command)
18338
msgid "sudo apt install ldapscripts"
18339
msgstr ""
18340
18341
#: serverguide/C/network-auth.xml:1800(para)
18342
msgid ""
18343
"Then edit the file <filename>/etc/ldapscripts/ldapscripts.conf</filename> to "
18344
"arrive at something similar to the following:"
18345
msgstr ""
18346
18347
#: serverguide/C/network-auth.xml:1804(programlisting)
18348
#, no-wrap
18349
msgid ""
18350
"\n"
18351
"SERVER=localhost\n"
18352
"BINDDN='cn=admin,dc=example,dc=com'\n"
18353
"BINDPWDFILE=\"/etc/ldapscripts/ldapscripts.passwd\"\n"
18354
"SUFFIX='dc=example,dc=com'\n"
18355
"GSUFFIX='ou=Groups'\n"
18356
"USUFFIX='ou=People'\n"
18357
"MSUFFIX='ou=Computers'\n"
18358
"GIDSTART=10000\n"
18359
"UIDSTART=10000\n"
18360
"MIDSTART=10000\n"
18361
msgstr ""
18362
18363
#: serverguide/C/network-auth.xml:1817(para)
18364
msgid ""
18365
"Now, create the <filename>ldapscripts.passwd</filename> file to allow rootDN "
18366
"access to the directory:"
18367
msgstr ""
18368
18369
#: serverguide/C/network-auth.xml:1822(command)
18370
msgid ""
18371
"sudo sh -c \"echo -n 'secret' > /etc/ldapscripts/ldapscripts.passwd\""
18372
msgstr ""
18373
18374
#: serverguide/C/network-auth.xml:1823(command)
18375
msgid "sudo chmod 400 /etc/ldapscripts/ldapscripts.passwd"
18376
msgstr ""
18377
18378
#: serverguide/C/network-auth.xml:1827(para)
18379
msgid ""
18380
"Replace <quote>secret</quote> with the actual password for your database's "
18381
"rootDN user."
18382
msgstr ""
18383
18384
#: serverguide/C/network-auth.xml:1832(para)
18385
msgid ""
18386
"The scripts are now ready to help manage your directory. Here are some "
18387
"examples of how to use them:"
18388
msgstr ""
18389
18390
#: serverguide/C/network-auth.xml:1839(para)
18391
msgid "Create a new user:"
18392
msgstr ""
18393
18394
#: serverguide/C/network-auth.xml:1844(command)
18395
msgid "sudo ldapadduser george example"
18396
msgstr ""
18397
18398
#: serverguide/C/network-auth.xml:1847(para)
18399
msgid ""
18400
"This will create a user with uid <emphasis role=\"italic\">george</emphasis> "
18401
"and set the user's primary group (gid) to <emphasis "
18402
"role=\"italic\">example</emphasis>"
18403
msgstr ""
18404
18405
#: serverguide/C/network-auth.xml:1854(para)
18406
msgid "Change a user's password:"
18407
msgstr ""
18408
18409
#: serverguide/C/network-auth.xml:1859(command)
18410
msgid "sudo ldapsetpasswd george"
18411
msgstr ""
18412
18413
#: serverguide/C/network-auth.xml:1860(computeroutput)
18414
#, no-wrap
18415
msgid "Changing password for user uid=george,ou=People,dc=example,dc=com"
18416
msgstr ""
18417
18418
#: serverguide/C/network-auth.xml:1861(userinput)
18419
#, no-wrap
18420
msgid "New Password: "
18421
msgstr ""
18422
18423
#: serverguide/C/network-auth.xml:1862(userinput)
18424
#, no-wrap
18425
msgid "New Password (verify): "
18426
msgstr ""
18427
18428
#: serverguide/C/network-auth.xml:1868(para)
18429
msgid "Delete a user:"
18430
msgstr ""
18431
18432
#: serverguide/C/network-auth.xml:1873(command)
18433
msgid "sudo ldapdeleteuser george"
18434
msgstr ""
18435
18436
#: serverguide/C/network-auth.xml:1879(para)
18437
msgid "Add a group:"
18438
msgstr ""
18439
18440
#: serverguide/C/network-auth.xml:1884(command)
18441
msgid "sudo ldapaddgroup qa"
18442
msgstr ""
18443
18444
#: serverguide/C/network-auth.xml:1890(para)
18445
msgid "Delete a group:"
18446
msgstr ""
18447
18448
#: serverguide/C/network-auth.xml:1895(command)
18449
msgid "sudo ldapdeletegroup qa"
18450
msgstr ""
18451
18452
#: serverguide/C/network-auth.xml:1901(para)
18453
msgid "Add a user to a group:"
18454
msgstr ""
18455
18456
#: serverguide/C/network-auth.xml:1906(command)
18457
msgid "sudo ldapaddusertogroup george qa"
18458
msgstr ""
18459
18460
#: serverguide/C/network-auth.xml:1909(para)
18461
msgid ""
18462
"You should now see a <emphasis>memberUid</emphasis> attribute for the "
18463
"<emphasis role=\"italic\">qa</emphasis> group with a value of <emphasis "
18464
"role=\"italic\">george</emphasis>."
18465
msgstr ""
18466
18467
#: serverguide/C/network-auth.xml:1916(para)
18468
msgid "Remove a user from a group:"
18469
msgstr ""
18470
18471
#: serverguide/C/network-auth.xml:1921(command)
18472
msgid "sudo ldapdeleteuserfromgroup george qa"
18473
msgstr ""
18474
18475
#: serverguide/C/network-auth.xml:1924(para)
18476
msgid ""
18477
"The <emphasis>memberUid</emphasis> attribute should now be removed from the "
18478
"<emphasis role=\"italic\">qa</emphasis> group."
18479
msgstr ""
18480
18481
#: serverguide/C/network-auth.xml:1931(para)
18482
msgid ""
18483
"The <application>ldapmodifyuser</application> script allows you to add, "
18484
"remove, or replace a user's attributes. The script uses the same syntax as "
18485
"the <application>ldapmodify</application> utility. For example:"
18486
msgstr ""
18487
18488
#: serverguide/C/network-auth.xml:1937(command)
18489
msgid "sudo ldapmodifyuser george"
18490
msgstr ""
18491
18492
#: serverguide/C/network-auth.xml:1938(computeroutput)
18493
#, no-wrap
18494
msgid ""
18495
"# About to modify the following entry :\n"
18496
"dn: uid=george,ou=People,dc=example,dc=com\n"
18497
"objectClass: account\n"
18498
"objectClass: posixAccount\n"
18499
"cn: george\n"
18500
"uid: george\n"
18501
"uidNumber: 1001\n"
18502
"gidNumber: 1001\n"
18503
"homeDirectory: /home/george\n"
18504
"loginShell: /bin/bash\n"
18505
"gecos: george\n"
18506
"description: User account\n"
18507
"userPassword:: e1NTSEF9eXFsTFcyWlhwWkF1eGUybVdFWHZKRzJVMjFTSG9vcHk=\n"
18508
"\n"
18509
"# Enter your modifications here, end with CTRL-D.\n"
18510
"dn: uid=george,ou=People,dc=example,dc=com"
18511
msgstr ""
18512
18513
#: serverguide/C/network-auth.xml:1954(userinput)
18514
#, no-wrap
18515
msgid ""
18516
"replace: gecos\n"
18517
"gecos: George Carlin"
18518
msgstr ""
18519
18520
#: serverguide/C/network-auth.xml:1958(para)
18521
msgid ""
18522
"The user's <emphasis>gecos</emphasis> should now be <quote>George "
18523
"Carlin</quote>."
18524
msgstr ""
18525
18526
#: serverguide/C/network-auth.xml:1964(para)
18527
msgid ""
18528
"A nice feature of <application>ldapscripts</application> is the template "
18529
"system. Templates allow you to customize the attributes of user, group, and "
18530
"machine objects. For example, to enable the <emphasis>user</emphasis> "
18531
"template edit <filename>/etc/ldapscripts/ldapscripts.conf</filename> "
18532
"changing:"
18533
msgstr ""
18534
18535
#: serverguide/C/network-auth.xml:1970(programlisting)
18536
#, no-wrap
18537
msgid ""
18538
"\n"
18539
"UTEMPLATE=\"/etc/ldapscripts/ldapadduser.template\"\n"
18540
msgstr ""
18541
18542
#: serverguide/C/network-auth.xml:1974(para)
18543
msgid ""
18544
"There are <emphasis role=\"italic\">sample</emphasis> templates in the "
18545
"<filename>/usr/share/doc/ldapscripts/examples</filename> directory. Copy or "
18546
"rename the <filename>ldapadduser.template.sample</filename> file to "
18547
"<filename>/etc/ldapscripts/ldapadduser.template</filename>:"
18548
msgstr ""
18549
18550
#: serverguide/C/network-auth.xml:1981(command)
18551
msgid ""
18552
"sudo cp /usr/share/doc/ldapscripts/examples/ldapadduser.template.sample \\ "
18553
"/etc/ldapscripts/ldapadduser.template"
18554
msgstr ""
18555
18556
#: serverguide/C/network-auth.xml:1985(para)
18557
msgid ""
18558
"Edit the new template to add the desired attributes. The following will "
18559
"create new users with an objectClass of inetOrgPerson:"
18560
msgstr ""
18561
18562
#: serverguide/C/network-auth.xml:1990(programlisting)
18563
#, no-wrap
18564
msgid ""
18565
"\n"
18566
"dn: uid=<user>,<usuffix>,<suffix>\n"
18567
"objectClass: inetOrgPerson\n"
18568
"objectClass: posixAccount\n"
18569
"cn: <user>\n"
18570
"sn: <ask>\n"
18571
"uid: <user>\n"
18572
"uidNumber: <uid>\n"
18573
"gidNumber: <gid>\n"
18574
"homeDirectory: <home>\n"
18575
"loginShell: <shell>\n"
18576
"gecos: <user>\n"
18577
"description: User account\n"
18578
"title: Employee\n"
18579
msgstr ""
18580
18581
#: serverguide/C/network-auth.xml:2006(para)
18582
msgid ""
18583
"Notice the <emphasis><ask></emphasis> option used for the "
18584
"<emphasis>sn</emphasis> attribute. This will make "
18585
"<application>ldapadduser</application> prompt you for its value."
18586
msgstr ""
18587
18588
#: serverguide/C/network-auth.xml:2014(para)
18589
msgid ""
18590
"There are utilities in the package that were not covered here. Here is a "
18591
"complete list:"
18592
msgstr ""
18593
18594
#: serverguide/C/network-auth.xml:2019(ulink)
18595
msgid "ldaprenamemachine"
18596
msgstr ""
18597
18598
#: serverguide/C/network-auth.xml:2020(ulink)
18599
msgid "ldapadduser"
18600
msgstr ""
18601
18602
#: serverguide/C/network-auth.xml:2021(ulink)
18603
msgid "ldapdeleteuserfromgroup"
18604
msgstr ""
18605
18606
#: serverguide/C/network-auth.xml:2022(ulink)
18607
msgid "ldapfinger"
18608
msgstr ""
18609
18610
#: serverguide/C/network-auth.xml:2023(ulink)
18611
msgid "ldapid"
18612
msgstr ""
18613
18614
#: serverguide/C/network-auth.xml:2024(ulink)
18615
msgid "ldapgid"
18616
msgstr ""
18617
18618
#: serverguide/C/network-auth.xml:2025(ulink)
18619
msgid "ldapmodifyuser"
18620
msgstr ""
18621
18622
#: serverguide/C/network-auth.xml:2026(ulink)
18623
msgid "ldaprenameuser"
18624
msgstr ""
18625
18626
#: serverguide/C/network-auth.xml:2027(ulink)
18627
msgid "lsldap"
18628
msgstr ""
18629
18630
#: serverguide/C/network-auth.xml:2028(ulink)
18631
msgid "ldapaddusertogroup"
18632
msgstr ""
18633
18634
#: serverguide/C/network-auth.xml:2029(ulink)
18635
msgid "ldapsetpasswd"
18636
msgstr ""
18637
18638
#: serverguide/C/network-auth.xml:2030(ulink)
18639
msgid "ldapinit"
18640
msgstr ""
18641
18642
#: serverguide/C/network-auth.xml:2031(ulink)
18643
msgid "ldapaddgroup"
18644
msgstr ""
18645
18646
#: serverguide/C/network-auth.xml:2032(ulink)
18647
msgid "ldapdeletegroup"
18648
msgstr ""
18649
18650
#: serverguide/C/network-auth.xml:2033(ulink)
18651
msgid "ldapmodifygroup"
18652
msgstr ""
18653
18654
#: serverguide/C/network-auth.xml:2034(ulink)
18655
msgid "ldapdeletemachine"
18656
msgstr ""
18657
18658
#: serverguide/C/network-auth.xml:2035(ulink)
18659
msgid "ldaprenamegroup"
18660
msgstr ""
18661
18662
#: serverguide/C/network-auth.xml:2036(ulink)
18663
msgid "ldapaddmachine"
18664
msgstr ""
18665
18666
#: serverguide/C/network-auth.xml:2037(ulink)
18667
msgid "ldapmodifymachine"
18668
msgstr ""
18669
18670
#: serverguide/C/network-auth.xml:2038(ulink)
18671
msgid "ldapsetprimarygroup"
18672
msgstr ""
18673
18674
#: serverguide/C/network-auth.xml:2039(ulink)
18675
msgid "ldapdeleteuser"
18676
msgstr ""
18677
18678
#: serverguide/C/network-auth.xml:2045(title)
18679
msgid "Backup and Restore"
18680
msgstr ""
18681
18682
#: serverguide/C/network-auth.xml:2047(para)
18683
msgid ""
18684
"Now we have ldap running just the way we want, it is time to ensure we can "
18685
"save all of our work and restore it as needed."
18686
msgstr ""
18687
18688
#: serverguide/C/network-auth.xml:2052(para)
18689
msgid ""
18690
"What we need is a way to backup the ldap database(s), specifically the "
18691
"backend (cn=config) and frontend (dc=example,dc=com). If we are going to "
18692
"backup those databases into, say, <filename>/export/backup</filename>, we "
18693
"could use <application>slapcat</application> as shown in the following "
18694
"script, called <filename>/usr/local/bin/ldapbackup</filename>:"
18695
msgstr ""
18696
18697
#: serverguide/C/network-auth.xml:2062(programlisting)
18698
#, no-wrap
18699
msgid ""
18700
"\n"
18701
"#!/bin/bash\n"
18702
"\n"
18703
"BACKUP_PATH=/export/backup\n"
18704
"SLAPCAT=/usr/sbin/slapcat\n"
18705
"\n"
18706
"nice ${SLAPCAT} -n 0 > ${BACKUP_PATH}/config.ldif\n"
18707
"nice ${SLAPCAT} -n 1 > ${BACKUP_PATH}/example.com.ldif\n"
18708
"nice ${SLAPCAT} -n 2 > ${BACKUP_PATH}/access.ldif\n"
18709
"chmod 640 ${BACKUP_PATH}/*.ldif\n"
18710
msgstr ""
18711
18712
#: serverguide/C/network-auth.xml:2075(para)
18713
msgid ""
18714
"These files are uncompressed text files containing everything in your ldap "
18715
"databases including the tree layout, usernames, and every password. So, you "
18716
"might want to consider making <filename>/export/backup</filename> an "
18717
"encrypted partition and even having the script encrypt those files as it "
18718
"creates them. Ideally you should do both, but that depends on your security "
18719
"requirements."
18720
msgstr ""
18721
18722
#: serverguide/C/network-auth.xml:2086(para)
18723
msgid ""
18724
"Then, it is just a matter of having a cron script to run this program as "
18725
"often as we feel comfortable with. For many, once a day suffices. For "
18726
"others, more often is required. Here is an example of a cron script called "
18727
"<filename>/etc/cron.d/ldapbackup</filename> that is run every night at "
18728
"22:45h:"
18729
msgstr ""
18730
18731
#: serverguide/C/network-auth.xml:2094(programlisting)
18732
#, no-wrap
18733
msgid ""
18734
"\n"
18735
"MAILTO=backup-emails@domain.com\n"
18736
"45 22 * * * root /usr/local/bin/ldapbackup\n"
18737
msgstr ""
18738
18739
#: serverguide/C/network-auth.xml:2099(para)
18740
msgid "Now the files are created, they should be copied to a backup server."
18741
msgstr ""
18742
18743
#: serverguide/C/network-auth.xml:2104(para)
18744
msgid ""
18745
"Assuming we did a fresh reinstall of ldap, the restore process could be "
18746
"something like this:"
18747
msgstr ""
18748
18749
#: serverguide/C/network-auth.xml:2110(command)
18750
msgid "sudo systemctl stop slapd.service"
18751
msgstr ""
18752
18753
#: serverguide/C/network-auth.xml:2111(command)
18754
msgid "sudo mkdir /var/lib/ldap/accesslog"
18755
msgstr ""
18756
18757
#: serverguide/C/network-auth.xml:2112(command)
18758
msgid "sudo slapadd -F /etc/ldap/slapd.d -n 0 -l /export/backup/config.ldif"
18759
msgstr ""
18760
18761
#: serverguide/C/network-auth.xml:2113(command)
18762
msgid ""
18763
"sudo slapadd -F /etc/ldap/slapd.d -n 1 -l /export/backup/domain.com.ldif"
18764
msgstr ""
18765
18766
#: serverguide/C/network-auth.xml:2114(command)
18767
msgid "sudo slapadd -F /etc/ldap/slapd.d -n 2 -l /export/backup/access.ldif"
18768
msgstr ""
18769
18770
#: serverguide/C/network-auth.xml:2115(command)
18771
msgid "sudo chown -R openldap:openldap /etc/ldap/slapd.d/"
18772
msgstr ""
18773
18774
#: serverguide/C/network-auth.xml:2116(command)
18775
msgid "sudo chown -R openldap:openldap /var/lib/ldap/"
18776
msgstr ""
18777
18778
#: serverguide/C/network-auth.xml:2117(command)
18779
msgid "sudo systemctl start slapd.service"
18780
msgstr ""
18781
18782
#: serverguide/C/network-auth.xml:2128(para)
18783
msgid ""
18784
"The primary resource is the upstream documentation: <ulink "
18785
"url=\"http://www.openldap.org/\">www.openldap.org</ulink>"
18786
msgstr ""
18787
18788
#: serverguide/C/network-auth.xml:2134(para)
18789
msgid ""
18790
"There are many man pages that come with the slapd package. Here are some "
18791
"important ones, especially considering the material presented in this guide:"
18792
msgstr ""
18793
18794
#: serverguide/C/network-auth.xml:2140(ulink)
18795
msgid "slapd"
18796
msgstr ""
18797
18798
#: serverguide/C/network-auth.xml:2141(ulink)
18799
msgid "slapd-config"
18800
msgstr ""
18801
18802
#: serverguide/C/network-auth.xml:2142(ulink)
18803
msgid "slapd.access"
18804
msgstr ""
18805
18806
#: serverguide/C/network-auth.xml:2143(ulink)
18807
msgid "slapo-syncprov"
18808
msgstr ""
18809
18810
#: serverguide/C/network-auth.xml:2149(para)
18811
msgid "Other man pages:"
18812
msgstr ""
18813
18814
#: serverguide/C/network-auth.xml:2154(ulink)
18815
msgid "auth-client-config"
18816
msgstr ""
18817
18818
#: serverguide/C/network-auth.xml:2155(ulink)
18819
msgid "pam-auth-update"
18820
msgstr ""
18821
18822
#: serverguide/C/network-auth.xml:2161(para)
18823
msgid ""
18824
"Zytrax's <ulink url=\"http://www.zytrax.com/books/ldap/\">LDAP for Rocket "
18825
"Scientists</ulink>; a less pedantic but comprehensive treatment of LDAP"
18826
msgstr ""
18827
18828
#: serverguide/C/network-auth.xml:2167(para)
18829
msgid ""
18830
"A Ubuntu community <ulink "
18831
"url=\"https://help.ubuntu.com/community/OpenLDAPServer\">OpenLDAP "
18832
"wiki</ulink> page has a collection of notes"
18833
msgstr ""
18834
18835
#: serverguide/C/network-auth.xml:2173(para)
18836
msgid ""
18837
"O'Reilly's <ulink url=\"http://www.oreilly.com/catalog/ldapsa/\">LDAP System "
18838
"Administration</ulink> (textbook; 2003)"
18839
msgstr ""
18840
18841
#: serverguide/C/network-auth.xml:2179(para)
18842
msgid ""
18843
"Packt's <ulink url=\"http://www.packtpub.com/OpenLDAP-Developers-Server-Open-"
18844
"Source-Linux/book\">Mastering OpenLDAP</ulink> (textbook; 2007)"
18845
msgstr ""
18846
18847
#: serverguide/C/network-auth.xml:2190(title)
18848
msgid "Samba and LDAP"
18849
msgstr ""
18850
18851
#: serverguide/C/network-auth.xml:2192(para)
18852
msgid ""
18853
"This section covers the integration of Samba with LDAP. The Samba server's "
18854
"role will be that of a \"standalone\" server and the LDAP directory will "
18855
"provide the authentication layer in addition to containing the user, group, "
18856
"and machine account information that Samba requires in order to function (in "
18857
"any of its 3 possible roles). The pre-requisite is an OpenLDAP server "
18858
"configured with a directory that can accept authentication requests. See "
18859
"<xref linkend=\"openldap-server\"/> for details on fulfilling this "
18860
"requirement. Once this section is completed, you will need to decide what "
18861
"specifically you want Samba to do for you and then configure it accordingly."
18862
msgstr ""
18863
18864
#: serverguide/C/network-auth.xml:2199(para)
18865
msgid ""
18866
"This guide will assume that the LDAP and Samba services are running on the "
18867
"same server and therefore use SASL EXTERNAL authentication whenever changing "
18868
"something under <emphasis>cn=config</emphasis>. If that is not your "
18869
"scenario, you will have to run those ldap commands on the LDAP server."
18870
msgstr ""
18871
18872
#: serverguide/C/network-auth.xml:2205(title) serverguide/C/network-auth.xml:3976(title)
18873
msgid "Software Installation"
18874
msgstr ""
18875
18876
#: serverguide/C/network-auth.xml:2207(para)
18877
msgid ""
18878
"There are two packages needed when integrating Samba with LDAP: "
18879
"<application>samba</application> and <application>smbldap-"
18880
"tools</application>."
18881
msgstr ""
18882
18883
#: serverguide/C/network-auth.xml:2212(para)
18884
msgid ""
18885
"Strictly speaking, the <application>smbldap-tools</application> package "
18886
"isn't needed, but unless you have some other way to manage the various Samba "
18887
"entities (users, groups, computers) in an LDAP context then you should "
18888
"install it."
18889
msgstr ""
18890
18891
#: serverguide/C/network-auth.xml:2217(para)
18892
msgid "Install these packages now:"
18893
msgstr ""
18894
18895
#: serverguide/C/network-auth.xml:2222(command)
18896
msgid "sudo apt install samba smbldap-tools"
18897
msgstr ""
18898
18899
#: serverguide/C/network-auth.xml:2228(title)
18900
msgid "LDAP Configuration"
18901
msgstr ""
18902
18903
#: serverguide/C/network-auth.xml:2230(para)
18904
msgid ""
18905
"We will now configure the LDAP server so that it can accomodate Samba data. "
18906
"We will perform three tasks in this section:"
18907
msgstr ""
18908
18909
#: serverguide/C/network-auth.xml:2237(para)
18910
msgid "Import a schema"
18911
msgstr ""
18912
18913
#: serverguide/C/network-auth.xml:2241(para)
18914
msgid "Index some entries"
18915
msgstr ""
18916
18917
#: serverguide/C/network-auth.xml:2245(para)
18918
msgid "Add objects"
18919
msgstr ""
18920
18921
#: serverguide/C/network-auth.xml:2251(title)
18922
msgid "Samba schema"
18923
msgstr ""
18924
18925
#: serverguide/C/network-auth.xml:2253(para)
18926
msgid ""
18927
"In order for OpenLDAP to be used as a backend for Samba, logically, the DIT "
18928
"will need to use attributes that can properly describe Samba data. Such "
18929
"attributes can be obtained by introducing a Samba LDAP schema. Let's do this "
18930
"now."
18931
msgstr ""
18932
18933
#: serverguide/C/network-auth.xml:2259(para)
18934
msgid ""
18935
"For more information on schemas and their installation see <xref "
18936
"linkend=\"openldap-configuration\"/>."
18937
msgstr ""
18938
18939
#: serverguide/C/network-auth.xml:2267(para)
18940
msgid ""
18941
"The schema is found in the now-installed <application>samba</application> "
18942
"package and is already in the ldif format. We can import it with one simple "
18943
"command:"
18944
msgstr ""
18945
18946
#: serverguide/C/network-auth.xml:2273(command)
18947
msgid ""
18948
"zcat /usr/share/doc/samba/examples/LDAP/samba.ldif.gz | sudo ldapadd -Q -Y "
18949
"EXTERNAL -H ldapi:///"
18950
msgstr ""
18951
18952
#: serverguide/C/network-auth.xml:2279(para)
18953
msgid "To query and view this new schema:"
18954
msgstr ""
18955
18956
#: serverguide/C/network-auth.xml:2284(command)
18957
msgid ""
18958
"sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=schema,cn=config "
18959
"'cn=*samba*'"
18960
msgstr ""
18961
18962
#: serverguide/C/network-auth.xml:2294(title)
18963
msgid "Samba indices"
18964
msgstr ""
18965
18966
#: serverguide/C/network-auth.xml:2296(para)
18967
msgid ""
18968
"Now that slapd knows about the Samba attributes, we can set up some indices "
18969
"based on them. Indexing entries is a way to improve performance when a "
18970
"client performs a filtered search on the DIT."
18971
msgstr ""
18972
18973
#: serverguide/C/network-auth.xml:2301(para)
18974
msgid ""
18975
"Create the file <filename>samba_indices.ldif</filename> with the following "
18976
"contents:"
18977
msgstr ""
18978
18979
#: serverguide/C/network-auth.xml:2305(programlisting)
18980
#, no-wrap
18981
msgid ""
18982
"\n"
18983
"dn: olcDatabase={1}mdb,cn=config\n"
18984
"changetype: modify\n"
18985
"replace: olcDbIndex\n"
18986
"olcDbIndex: objectClass eq\n"
18987
"olcDbIndex: uidNumber,gidNumber eq\n"
18988
"olcDbIndex: loginShell eq\n"
18989
"olcDbIndex: uid,cn eq,sub\n"
18990
"olcDbIndex: memberUid eq,sub\n"
18991
"olcDbIndex: member,uniqueMember eq\n"
18992
"olcDbIndex: sambaSID eq\n"
18993
"olcDbIndex: sambaPrimaryGroupSID eq\n"
18994
"olcDbIndex: sambaGroupType eq\n"
18995
"olcDbIndex: sambaSIDList eq\n"
18996
"olcDbIndex: sambaDomainName eq\n"
18997
"olcDbIndex: default sub,eq\n"
18998
msgstr ""
18999
19000
#: serverguide/C/network-auth.xml:2323(para)
19001
msgid ""
19002
"Using the <application>ldapmodify</application> utility load the new indices:"
19003
msgstr ""
19004
19005
#: serverguide/C/network-auth.xml:2328(command)
19006
msgid "sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f samba_indices.ldif"
19007
msgstr ""
19008
19009
#: serverguide/C/network-auth.xml:2331(para)
19010
msgid ""
19011
"If all went well you should see the new indices using "
19012
"<application>ldapsearch</application>:"
19013
msgstr ""
19014
19015
#: serverguide/C/network-auth.xml:2336(command)
19016
msgid ""
19017
"sudo ldapsearch -Q -LLL -Y EXTERNAL -H \\ ldapi:/// -b cn=config "
19018
"olcDatabase={1}mdb olcDbIndex"
19019
msgstr ""
19020
19021
#: serverguide/C/network-auth.xml:2343(title)
19022
msgid "Adding Samba LDAP objects"
19023
msgstr ""
19024
19025
#: serverguide/C/network-auth.xml:2345(para)
19026
msgid ""
19027
"Next, configure the <application>smbldap-tools</application> package to "
19028
"match your environment. The package comes with a configuration helper script "
19029
"called <application>smbldap-config</application>. Before running it, though, "
19030
"you should decide on two important configuration settings in "
19031
"<filename>/etc/samba/smb.conf</filename>:"
19032
msgstr ""
19033
19034
#: serverguide/C/network-auth.xml:2352(para)
19035
msgid ""
19036
"<emphasis>netbios name</emphasis>: how this server will be known. The "
19037
"default value is derived from the server's hostname, but truncated at 15 "
19038
"characters."
19039
msgstr ""
19040
19041
#: serverguide/C/network-auth.xml:2356(para)
19042
msgid ""
19043
"<emphasis>workgroup</emphasis>: the workgroup name for this server, or, if "
19044
"you later decide to make it a domain controller, this will be the domain."
19045
msgstr ""
19046
19047
#: serverguide/C/network-auth.xml:2360(para)
19048
msgid ""
19049
"It's important to make these choices now because <application>smbldap-"
19050
"config</application> will use them to generate the config that will be later "
19051
"stored in the LDAP directory. If you run <application>smbldap-"
19052
"config</application> now and later change these values in "
19053
"<filename>/etc/samba/smb.conf</filename> there will be an inconsistency."
19054
msgstr ""
19055
19056
#: serverguide/C/network-auth.xml:2366(para)
19057
msgid ""
19058
"Once you are happy with <emphasis>netbios name</emphasis> and "
19059
"<emphasis>workgroup</emphasis>, proceed to generat the <application>smbldap-"
19060
"tools</application> configuration by running the configuration script which "
19061
"will ask you some questions:"
19062
msgstr ""
19063
19064
#: serverguide/C/network-auth.xml:2371(command)
19065
msgid "sudo smbldap-config"
19066
msgstr ""
19067
19068
#: serverguide/C/network-auth.xml:2374(para)
19069
msgid "Some of the more important ones:"
19070
msgstr ""
19071
19072
#: serverguide/C/network-auth.xml:2377(para)
19073
msgid ""
19074
"<emphasis>workgroup name</emphasis>: has to match what you will configure in "
19075
"<filename>/etc/samba/smb.conf</filename> later on."
19076
msgstr ""
19077
19078
#: serverguide/C/network-auth.xml:2381(para)
19079
msgid ""
19080
"<emphasis>ldap suffix</emphasis>: has to match the ldap suffix you chose "
19081
"when you configured the LDAP server."
19082
msgstr ""
19083
19084
#: serverguide/C/network-auth.xml:2384(para)
19085
msgid ""
19086
"other ldap suffixes: they are all relative to <emphasis>ldap "
19087
"suffix</emphasis> above. For example, for <emphasis>ldap user "
19088
"suffix</emphasis> you should use <emphasis>ou=People</emphasis>."
19089
msgstr ""
19090
19091
#: serverguide/C/network-auth.xml:2388(para)
19092
msgid ""
19093
"<emphasis>ldap master bind dn</emphasis> and <emphasis>bind "
19094
"password</emphasis>: use the rootDN credentials."
19095
msgstr ""
19096
19097
#: serverguide/C/network-auth.xml:2391(para)
19098
msgid ""
19099
"The <application>smbldap-populate</application> script will then add the "
19100
"LDAP objects required for Samba. It is a good idea to first make a backup of "
19101
"your DIT using <application>slapcat</application>:"
19102
msgstr ""
19103
19104
#: serverguide/C/network-auth.xml:2397(command)
19105
msgid "sudo slapcat -l backup.ldif"
19106
msgstr ""
19107
19108
#: serverguide/C/network-auth.xml:2400(para)
19109
msgid ""
19110
"Once you have a backup proceed to populate your directory. It will ask you "
19111
"for a password for the \"domain root\" user, which is also the \"root\" user "
19112
"stored in LDAP:"
19113
msgstr ""
19114
19115
#: serverguide/C/network-auth.xml:2406(command)
19116
msgid "sudo smbldap-populate -g 10000 -u 10000 -r 10000"
19117
msgstr ""
19118
19119
#: serverguide/C/network-auth.xml:2409(para)
19120
msgid ""
19121
"The <emphasis>-g</emphasis>, <emphasis>-u</emphasis> and <emphasis>-"
19122
"r</emphasis> parameters tell <application>smbldap-tools</application> where "
19123
"to start the numeric uid and gid allocation for the LDAP users. You should "
19124
"pick a range start that does not overlap with your local "
19125
"<emphasis>/etc/passwd</emphasis> users."
19126
msgstr ""
19127
19128
#: serverguide/C/network-auth.xml:2413(para)
19129
msgid ""
19130
"You can create a LDIF file containing the new Samba objects by executing "
19131
"<command>sudo smbldap-populate -e samba.ldif</command>. This allows you to "
19132
"look over the changes making sure everything is correct. If it is, rerun the "
19133
"script without the '-e' switch. Alternatively, you can take the LDIF file "
19134
"and import its data per usual."
19135
msgstr ""
19136
19137
#: serverguide/C/network-auth.xml:2419(para)
19138
msgid ""
19139
"Your LDAP directory now has the necessary information to authenticate Samba "
19140
"users."
19141
msgstr ""
19142
19143
#: serverguide/C/network-auth.xml:2428(title) serverguide/C/network-auth.xml:4008(title)
19144
msgid "Samba Configuration"
19145
msgstr ""
19146
19147
#: serverguide/C/network-auth.xml:2430(para)
19148
msgid ""
19149
"There are multiple ways to configure Samba. For details on some common "
19150
"configurations see <xref linkend=\"samba\"/>. To configure Samba to use "
19151
"LDAP, edit its configuration file <filename>/etc/samba/smb.conf</filename> "
19152
"commenting out the default <emphasis>passdb backend</emphasis> parameter and "
19153
"adding some ldap-related ones. Make sure to use the same values you used "
19154
"when running <application>smbldap-populate</application>:"
19155
msgstr ""
19156
19157
#: serverguide/C/network-auth.xml:2437(programlisting)
19158
#, no-wrap
19159
msgid ""
19160
"\n"
19161
"# passdb backend = tdbsam\n"
19162
" workgroup = EXAMPLE\n"
19163
"\n"
19164
"# LDAP Settings\n"
19165
" passdb backend = ldapsam:ldap://hostname\n"
19166
" ldap suffix = dc=example,dc=com\n"
19167
" ldap user suffix = ou=People\n"
19168
" ldap group suffix = ou=Groups\n"
19169
" ldap machine suffix = ou=Computers\n"
19170
" ldap idmap suffix = ou=Idmap\n"
19171
" ldap admin dn = cn=admin,dc=example,dc=com\n"
19172
" # or off if TLS/SSL is not configured\n"
19173
" ldap ssl = start tls\n"
19174
" ldap passwd sync = yes\n"
19175
msgstr ""
19176
19177
#: serverguide/C/network-auth.xml:2454(para)
19178
msgid "Change the values to match your environment."
19179
msgstr ""
19180
19181
#: serverguide/C/network-auth.xml:2458(para)
19182
msgid ""
19183
"The <filename>smb.conf</filename> as shipped by the package is quite long "
19184
"and has many configuration examples. An easy way to visualize it without any "
19185
"comments is to run <application>testparm -s</application>."
19186
msgstr ""
19187
19188
#: serverguide/C/network-auth.xml:2462(para)
19189
msgid ""
19190
"Now inform Samba about the rootDN user's password (the one set during the "
19191
"installation of the slapd package):"
19192
msgstr ""
19193
19194
#: serverguide/C/network-auth.xml:2467(command)
19195
msgid "sudo smbpasswd -W"
19196
msgstr ""
19197
19198
#: serverguide/C/network-auth.xml:2470(para)
19199
msgid ""
19200
"As a final step to have your LDAP users be able to connect to samba and "
19201
"authenticate, we need these users to also show up in the system as \"unix\" "
19202
"users. One way to do this is to use <application>libnss-ldap</application>. "
19203
"Detailed instructions can be found in the <xref linkend=\"openldap-auth-"
19204
"config\"/> section, but we only need the NSS part."
19205
msgstr ""
19206
19207
#: serverguide/C/network-auth.xml:2478(para)
19208
msgid "Install <application>libnss-ldap</application>"
19209
msgstr ""
19210
19211
#: serverguide/C/network-auth.xml:2480(para)
19212
msgid ""
19213
"There is no need to use the LDAP rootDN login credentials, so you can skip "
19214
"that step."
19215
msgstr ""
19216
19217
#: serverguide/C/network-auth.xml:2483(para)
19218
msgid "Configure the LDAP profile for NSS:"
19219
msgstr ""
19220
19221
#: serverguide/C/network-auth.xml:2487(para)
19222
msgid "Restart the Samba services:"
19223
msgstr ""
19224
19225
#: serverguide/C/network-auth.xml:2491(para)
19226
msgid ""
19227
"To quickly test the setup, see if <application>getent</application> can list "
19228
"the Samba groups:"
19229
msgstr ""
19230
19231
#: serverguide/C/network-auth.xml:2493(command)
19232
msgid "getent group"
19233
msgstr ""
19234
19235
#: serverguide/C/network-auth.xml:2494(computeroutput)
19236
#, no-wrap
19237
msgid ""
19238
"\n"
19239
"...\n"
19240
"Account Operators:*:548:\n"
19241
"Print Operators:*:550:\n"
19242
"Backup Operators:*:551:\n"
19243
"Replicators:*:552:\n"
19244
msgstr ""
19245
19246
#: serverguide/C/network-auth.xml:2504(para)
19247
msgid ""
19248
"If you have existing LDAP users that you want to include in your new LDAP-"
19249
"backed Samba they will, of course, also need to be given some of the extra "
19250
"Samba specific attributes. The <application>smbpasswd</application> utility "
19251
"can do this for you:"
19252
msgstr ""
19253
19254
#: serverguide/C/network-auth.xml:2510(command)
19255
msgid "sudo smbpasswd -a username"
19256
msgstr ""
19257
19258
#: serverguide/C/network-auth.xml:2513(para)
19259
msgid ""
19260
"You will prompted to enter a password. It will be considered as the new "
19261
"password for that user. Making it the same as before is reasonable. Note "
19262
"that this command cannot be used to create a new user from scratch in LDAP "
19263
"(unless you are using <emphasis>ldapsam:trusted</emphasis> and "
19264
"<emphasis>ldapsam:editposix</emphasis>, not covered in this guide)."
19265
msgstr ""
19266
19267
#: serverguide/C/network-auth.xml:2519(para)
19268
msgid ""
19269
"To manage user, group, and machine accounts use the utilities provided by "
19270
"the <application>smbldap-tools</application> package. Here are some examples:"
19271
msgstr ""
19272
19273
#: serverguide/C/network-auth.xml:2527(para)
19274
msgid "To add a new user with a home directory:"
19275
msgstr ""
19276
19277
#: serverguide/C/network-auth.xml:2532(command)
19278
msgid "sudo smbldap-useradd -a -P -m username"
19279
msgstr ""
19280
19281
#: serverguide/C/network-auth.xml:2535(para)
19282
msgid ""
19283
"The <emphasis>-a</emphasis> option adds the Samba attributes, and the "
19284
"<emphasis>-P</emphasis> option calls the <application>smbldap-"
19285
"passwd</application> utility after the user is created allowing you to enter "
19286
"a password for the user. Finally, <emphasis>-m</emphasis> creates a local "
19287
"home directory. Test with the <application>getent</application> command:"
19288
msgstr ""
19289
19290
#: serverguide/C/network-auth.xml:2541(screen) serverguide/C/network-auth.xml:4115(command)
19291
#, no-wrap
19292
msgid "getent passwd username"
19293
msgstr ""
19294
19295
#: serverguide/C/network-auth.xml:2542(para)
19296
msgid ""
19297
"If you don't get a response, then your <application>libnss-"
19298
"ldap</application> configuration is incorrect."
19299
msgstr ""
19300
19301
#: serverguide/C/network-auth.xml:2546(para)
19302
msgid "To remove a user:"
19303
msgstr ""
19304
19305
#: serverguide/C/network-auth.xml:2551(command)
19306
msgid "sudo smbldap-userdel username"
19307
msgstr ""
19308
19309
#: serverguide/C/network-auth.xml:2554(para)
19310
msgid ""
19311
"In the above command, use the <emphasis>-r</emphasis> option to remove the "
19312
"user's home directory."
19313
msgstr ""
19314
19315
#: serverguide/C/network-auth.xml:2560(para)
19316
msgid "To add a group:"
19317
msgstr ""
19318
19319
#: serverguide/C/network-auth.xml:2565(command)
19320
msgid "sudo smbldap-groupadd -a groupname"
19321
msgstr ""
19322
19323
#: serverguide/C/network-auth.xml:2568(para)
19324
msgid ""
19325
"As for <application>smbldap-useradd</application>, the <emphasis>-"
19326
"a</emphasis> adds the Samba attributes."
19327
msgstr ""
19328
19329
#: serverguide/C/network-auth.xml:2574(para)
19330
msgid "To make an existing user a member of a group:"
19331
msgstr ""
19332
19333
#: serverguide/C/network-auth.xml:2579(command)
19334
msgid "sudo smbldap-groupmod -m username groupname"
19335
msgstr ""
19336
19337
#: serverguide/C/network-auth.xml:2582(para)
19338
msgid ""
19339
"The <emphasis>-m</emphasis> option can add more than one user at a time by "
19340
"listing them in comma-separated format."
19341
msgstr ""
19342
19343
#: serverguide/C/network-auth.xml:2588(para)
19344
msgid "To remove a user from a group:"
19345
msgstr ""
19346
19347
#: serverguide/C/network-auth.xml:2593(command)
19348
msgid "sudo smbldap-groupmod -x username groupname"
19349
msgstr ""
19350
19351
#: serverguide/C/network-auth.xml:2599(para)
19352
msgid "To add a Samba machine account:"
19353
msgstr ""
19354
19355
#: serverguide/C/network-auth.xml:2604(command)
19356
msgid "sudo smbldap-useradd -t 0 -w username"
19357
msgstr ""
19358
19359
#: serverguide/C/network-auth.xml:2607(para)
19360
msgid ""
19361
"Replace <emphasis>username</emphasis> with the name of the workstation. The "
19362
"<emphasis>-t 0</emphasis> option creates the machine account without a "
19363
"delay, while the <emphasis>-w</emphasis> option specifies the user as a "
19364
"machine account. Also, note the <emphasis>add machine script</emphasis> "
19365
"parameter in <filename>/etc/samba/smb.conf</filename> was changed to use "
19366
"<application>smbldap-useradd</application>."
19367
msgstr ""
19368
19369
#: serverguide/C/network-auth.xml:2616(para)
19370
msgid ""
19371
"There are utilities in the <application>smbldap-tools</application> package "
19372
"that were not covered here. Here is a complete list:"
19373
msgstr ""
19374
19375
#: serverguide/C/network-auth.xml:2621(ulink)
19376
msgid "smbldap-groupadd"
19377
msgstr ""
19378
19379
#: serverguide/C/network-auth.xml:2622(ulink)
19380
msgid "smbldap-groupdel"
19381
msgstr ""
19382
19383
#: serverguide/C/network-auth.xml:2623(ulink)
19384
msgid "smbldap-groupmod"
19385
msgstr ""
19386
19387
#: serverguide/C/network-auth.xml:2624(ulink)
19388
msgid "smbldap-groupshow"
19389
msgstr ""
19390
19391
#: serverguide/C/network-auth.xml:2625(ulink)
19392
msgid "smbldap-passwd"
19393
msgstr ""
19394
19395
#: serverguide/C/network-auth.xml:2626(ulink)
19396
msgid "smbldap-populate"
19397
msgstr ""
19398
19399
#: serverguide/C/network-auth.xml:2627(ulink)
19400
msgid "smbldap-useradd"
19401
msgstr ""
19402
19403
#: serverguide/C/network-auth.xml:2628(ulink)
19404
msgid "smbldap-userdel"
19405
msgstr ""
19406
19407
#: serverguide/C/network-auth.xml:2629(ulink)
19408
msgid "smbldap-userinfo"
19409
msgstr ""
19410
19411
#: serverguide/C/network-auth.xml:2630(ulink)
19412
msgid "smbldap-userlist"
19413
msgstr ""
19414
19415
#: serverguide/C/network-auth.xml:2631(ulink)
19416
msgid "smbldap-usermod"
19417
msgstr ""
19418
19419
#: serverguide/C/network-auth.xml:2632(ulink)
19420
msgid "smbldap-usershow"
19421
msgstr ""
19422
19423
#: serverguide/C/network-auth.xml:2643(para)
19424
msgid ""
19425
"For more information on installing and configuring Samba see <xref "
19426
"linkend=\"samba\"/> of this Ubuntu Server Guide."
19427
msgstr ""
19428
19429
#: serverguide/C/network-auth.xml:2649(para)
19430
msgid ""
19431
"There are multiple places where LDAP and Samba is documented in the upstream "
19432
"<ulink url=\"http://samba.org/samba/docs/man/Samba-HOWTO-Collection/\">Samba "
19433
"HOWTO Collection</ulink>."
19434
msgstr ""
19435
19436
#: serverguide/C/network-auth.xml:2656(para)
19437
msgid ""
19438
"Regarding the above, see specifically the <ulink "
19439
"url=\"http://samba.org/samba/docs/man/Samba-HOWTO-"
19440
"Collection/passdb.html\">passdb section</ulink>."
19441
msgstr ""
19442
19443
#: serverguide/C/network-auth.xml:2662(para)
19444
msgid ""
19445
"Although dated (2007), the <ulink url=\"http://download.gna.org/smbldap-"
19446
"tools/docs/samba-ldap-howto/\">Linux Samba-OpenLDAP HOWTO</ulink> contains "
19447
"valuable notes."
19448
msgstr ""
19449
19450
#: serverguide/C/network-auth.xml:2668(para)
19451
msgid ""
19452
"The main page of the <ulink "
19453
"url=\"https://help.ubuntu.com/community/Samba#samba-ldap\">Samba Ubuntu "
19454
"community documentation</ulink> has a plethora of links to articles that may "
19455
"prove useful."
19456
msgstr ""
19457
19458
#: serverguide/C/network-auth.xml:2681(title)
19459
msgid "Kerberos"
19460
msgstr "Kerberos"
19461
19462
#: serverguide/C/network-auth.xml:2683(para)
19463
msgid ""
19464
"<application>Kerberos</application> is a network authentication system based "
19465
"on the principal of a trusted third party. The other two parties being the "
19466
"user and the service the user wishes to authenticate to. Not all services "
19467
"and applications can use Kerberos, but for those that can, it brings the "
19468
"network environment one step closer to being Single Sign On (SSO)."
19469
msgstr ""
19470
19471
#: serverguide/C/network-auth.xml:2689(para)
19472
msgid ""
19473
"This section covers installation and configuration of a Kerberos server, and "
19474
"some example client configurations."
19475
msgstr ""
19476
19477
#: serverguide/C/network-auth.xml:2694(title) serverguide/C/monitoring.xml:13(title) serverguide/C/lamp-applications.xml:15(title) serverguide/C/installation.xml:916(title) serverguide/C/dns.xml:62(title) serverguide/C/dm-multipath.xml:135(title) serverguide/C/chat.xml:15(title) serverguide/C/cgroups.xml:38(title) serverguide/C/backups.xml:551(title)
19478
msgid "Overview"
19479
msgstr ""
19480
19481
#: serverguide/C/network-auth.xml:2696(para)
19482
msgid ""
19483
"If you are new to Kerberos there are a few terms that are good to understand "
19484
"before setting up a Kerberos server. Most of the terms will relate to things "
19485
"you may be familiar with in other environments:"
19486
msgstr ""
19487
19488
#: serverguide/C/network-auth.xml:2703(para)
19489
msgid ""
19490
"<emphasis>Principal:</emphasis> any users, computers, and services provided "
19491
"by servers need to be defined as Kerberos Principals."
19492
msgstr ""
19493
19494
#: serverguide/C/network-auth.xml:2708(para)
19495
msgid ""
19496
"<emphasis>Instances:</emphasis> are used for service principals and special "
19497
"administrative principals."
19498
msgstr ""
19499
19500
#: serverguide/C/network-auth.xml:2713(para)
19501
msgid ""
19502
"<emphasis>Realms:</emphasis> the unique realm of control provided by the "
19503
"Kerberos installation. Think of it as the domain or group your hosts and "
19504
"users belong to. Convention dictates the realm should be in uppercase. By "
19505
"default, ubuntu will use the DNS domain converted to uppercase (EXAMPLE.COM) "
19506
"as the realm."
19507
msgstr ""
19508
19509
#: serverguide/C/network-auth.xml:2722(para)
19510
msgid ""
19511
"<emphasis>Key Distribution Center:</emphasis> (KDC) consist of three parts, "
19512
"a database of all principals, the authentication server, and the ticket "
19513
"granting server. For each realm there must be at least one KDC."
19514
msgstr ""
19515
19516
#: serverguide/C/network-auth.xml:2728(para)
19517
msgid ""
19518
"<emphasis>Ticket Granting Ticket:</emphasis> issued by the Authentication "
19519
"Server (AS), the Ticket Granting Ticket (TGT) is encrypted in the user's "
19520
"password which is known only to the user and the KDC."
19521
msgstr ""
19522
19523
#: serverguide/C/network-auth.xml:2734(para)
19524
msgid ""
19525
"<emphasis>Ticket Granting Server:</emphasis> (TGS) issues service tickets to "
19526
"clients upon request."
19527
msgstr ""
19528
19529
#: serverguide/C/network-auth.xml:2739(para)
19530
msgid ""
19531
"<emphasis>Tickets:</emphasis> confirm the identity of the two principals. "
19532
"One principal being a user and the other a service requested by the user. "
19533
"Tickets establish an encryption key used for secure communication during the "
19534
"authenticated session."
19535
msgstr ""
19536
19537
#: serverguide/C/network-auth.xml:2745(para)
19538
msgid ""
19539
"<emphasis>Keytab Files:</emphasis> are files extracted from the KDC "
19540
"principal database and contain the encryption key for a service or host."
19541
msgstr ""
19542
19543
#: serverguide/C/network-auth.xml:2752(para)
19544
msgid ""
19545
"To put the pieces together, a Realm has at least one KDC, preferably more "
19546
"for redundancy, which contains a database of Principals. When a user "
19547
"principal logs into a workstation that is configured for Kerberos "
19548
"authentication, the KDC issues a Ticket Granting Ticket (TGT). If the user "
19549
"supplied credentials match, the user is authenticated and can then request "
19550
"tickets for Kerberized services from the Ticket Granting Server (TGS). The "
19551
"service tickets allow the user to authenticate to the service without "
19552
"entering another username and password."
19553
msgstr ""
19554
19555
#: serverguide/C/network-auth.xml:2761(title)
19556
msgid "Kerberos Server"
19557
msgstr ""
19558
19559
#: serverguide/C/network-auth.xml:2765(para)
19560
msgid ""
19561
"For this discussion, we will create a MIT Kerberos domain with the following "
19562
"features (edit them to fit your needs):"
19563
msgstr ""
19564
19565
#: serverguide/C/network-auth.xml:2772(para)
19566
msgid "<emphasis>Realm:</emphasis> EXAMPLE.COM"
19567
msgstr ""
19568
19569
#: serverguide/C/network-auth.xml:2777(para)
19570
msgid "<emphasis>Primary KDC:</emphasis> kdc01.example.com (192.168.0.1)"
19571
msgstr ""
19572
19573
#: serverguide/C/network-auth.xml:2782(para)
19574
msgid "<emphasis>Secondary KDC:</emphasis> kdc02.example.com (192.168.0.2)"
19575
msgstr ""
19576
19577
#: serverguide/C/network-auth.xml:2787(para)
19578
msgid "<emphasis>User principal:</emphasis> steve"
19579
msgstr ""
19580
19581
#: serverguide/C/network-auth.xml:2792(para)
19582
msgid "<emphasis>Admin principal:</emphasis> steve/admin"
19583
msgstr ""
19584
19585
#: serverguide/C/network-auth.xml:2799(para)
19586
msgid ""
19587
"It is <emphasis>strongly</emphasis> recommended that your network-"
19588
"authenticated users have their uid in a different range (say, starting at "
19589
"5000) than that of your local users."
19590
msgstr ""
19591
19592
#: serverguide/C/network-auth.xml:2805(para)
19593
msgid ""
19594
"Before installing the Kerberos server a properly configured DNS server is "
19595
"needed for your domain. Since the Kerberos Realm by convention matches the "
19596
"domain name, this section uses the <emphasis>EXAMPLE.COM</emphasis> domain "
19597
"configured in <xref linkend=\"dns-primarymaster-configuration\"/> of the DNS "
19598
"documentation."
19599
msgstr ""
19600
19601
#: serverguide/C/network-auth.xml:2811(para)
19602
msgid ""
19603
"Also, Kerberos is a time sensitive protocol. So if the local system time "
19604
"between a client machine and the server differs by more than five minutes "
19605
"(by default), the workstation will not be able to authenticate. To correct "
19606
"the problem all hosts should have their time synchronized using the same "
19607
"<emphasis>Network Time Protocol (NTP)</emphasis> server. For details on "
19608
"setting up NTP see <xref linkend=\"NTP\"/>."
19609
msgstr ""
19610
19611
#: serverguide/C/network-auth.xml:2819(para)
19612
msgid ""
19613
"The first step in creating a Kerberos Realm is to install the "
19614
"<application>krb5-kdc</application> and <application>krb5-admin-"
19615
"server</application> packages. From a terminal enter:"
19616
msgstr ""
19617
19618
#: serverguide/C/network-auth.xml:2825(command) serverguide/C/network-auth.xml:3032(command)
19619
msgid "sudo apt install krb5-kdc krb5-admin-server"
19620
msgstr ""
19621
19622
#: serverguide/C/network-auth.xml:2828(para)
19623
msgid ""
19624
"You will be asked at the end of the install to supply the hostname for the "
19625
"Kerberos and Admin servers, which may or may not be the same server, for the "
19626
"realm."
19627
msgstr ""
19628
19629
#: serverguide/C/network-auth.xml:2835(para)
19630
msgid "By default the realm is created from the KDC's domain name."
19631
msgstr ""
19632
19633
#: serverguide/C/network-auth.xml:2840(para)
19634
msgid ""
19635
"Next, create the new realm with the <application>kdb5_newrealm</application> "
19636
"utility:"
19637
msgstr ""
19638
19639
#: serverguide/C/network-auth.xml:2845(command)
19640
msgid "sudo krb5_newrealm"
19641
msgstr ""
19642
19643
#: serverguide/C/network-auth.xml:2852(para)
19644
msgid ""
19645
"The questions asked during installation are used to configure the "
19646
"<filename>/etc/krb5.conf</filename> file. If you need to adjust the Key "
19647
"Distribution Center (KDC) settings simply edit the file and restart the "
19648
"<application>krb5-kdc</application> daemon. If you need to reconfigure "
19649
"Kerberos from scratch, perhaps to change the realm name, you can do so by "
19650
"typing"
19651
msgstr ""
19652
19653
#: serverguide/C/network-auth.xml:2859(command)
19654
msgid "sudo dpkg-reconfigure krb5-kdc"
19655
msgstr ""
19656
19657
#: serverguide/C/network-auth.xml:2865(para)
19658
msgid ""
19659
"Once the KDC is properly running, an admin user -- the <emphasis>admin "
19660
"principal</emphasis> -- is needed. It is recommended to use a different "
19661
"username from your everyday username. Using the "
19662
"<application>kadmin.local</application> utility in a terminal prompt enter:"
19663
msgstr ""
19664
19665
#: serverguide/C/network-auth.xml:2873(command) serverguide/C/network-auth.xml:3755(command)
19666
msgid "sudo kadmin.local"
19667
msgstr ""
19668
19669
#: serverguide/C/network-auth.xml:2874(computeroutput)
19670
#, no-wrap
19671
msgid ""
19672
"Authenticating as principal root/admin@EXAMPLE.COM with password.\n"
19673
"kadmin.local:"
19674
msgstr ""
19675
19676
#: serverguide/C/network-auth.xml:2875(userinput)
19677
#, no-wrap
19678
msgid " addprinc steve/admin"
19679
msgstr ""
19680
19681
#: serverguide/C/network-auth.xml:2876(computeroutput)
19682
#, no-wrap
19683
msgid ""
19684
"WARNING: no policy specified for steve/admin@EXAMPLE.COM; defaulting to no "
19685
"policy\n"
19686
"Enter password for principal \"steve/admin@EXAMPLE.COM\": \n"
19687
"Re-enter password for principal \"steve/admin@EXAMPLE.COM\": \n"
19688
"Principal \"steve/admin@EXAMPLE.COM\" created.\n"
19689
"kadmin.local:"
19690
msgstr ""
19691
19692
#: serverguide/C/network-auth.xml:2880(userinput)
19693
#, no-wrap
19694
msgid " quit"
19695
msgstr ""
19696
19697
#: serverguide/C/network-auth.xml:2883(para)
19698
msgid ""
19699
"In the above example <emphasis role=\"italic\">steve</emphasis> is the "
19700
"<emphasis>Principal</emphasis>, <emphasis role=\"italic\">/admin</emphasis> "
19701
"is an <emphasis>Instance</emphasis>, and <emphasis "
19702
"role=\"italic\">@EXAMPLE.COM</emphasis> signifies the realm. The <emphasis "
19703
"role=\"italic\">\"every day\"</emphasis> Principal, a.k.a. the <emphasis "
19704
"role=\"italic\">user principal</emphasis>, would be "
19705
"<emphasis>steve@EXAMPLE.COM</emphasis>, and should have only normal user "
19706
"rights."
19707
msgstr ""
19708
19709
#: serverguide/C/network-auth.xml:2893(para)
19710
msgid ""
19711
"Replace <emphasis>EXAMPLE.COM</emphasis> and <emphasis>steve</emphasis> with "
19712
"your Realm and admin username."
19713
msgstr ""
19714
19715
#: serverguide/C/network-auth.xml:2901(para)
19716
msgid ""
19717
"Next, the new admin user needs to have the appropriate Access Control List "
19718
"(ACL) permissions. The permissions are configured in the "
19719
"<filename>/etc/krb5kdc/kadm5.acl</filename> file:"
19720
msgstr ""
19721
19722
#: serverguide/C/network-auth.xml:2906(programlisting)
19723
#, no-wrap
19724
msgid ""
19725
"\n"
19726
"steve/admin@EXAMPLE.COM *\n"
19727
msgstr ""
19728
19729
#: serverguide/C/network-auth.xml:2910(para)
19730
msgid ""
19731
"This entry grants <emphasis>steve/admin</emphasis> the ability to perform "
19732
"any operation on all principals in the realm. You can configure principals "
19733
"with more restrictive privileges, which is convenient if you need an admin "
19734
"principal that junior staff can use in Kerberos clients. Please see the "
19735
"<emphasis>kadm5.acl</emphasis> man page for details."
19736
msgstr ""
19737
19738
#: serverguide/C/network-auth.xml:2922(para)
19739
msgid ""
19740
"Now restart the <application>krb5-admin-server</application> for the new ACL "
19741
"to take affect:"
19742
msgstr ""
19743
19744
#: serverguide/C/network-auth.xml:2927(command)
19745
msgid "sudo systemctl restart krb5-admin-server.service"
19746
msgstr ""
19747
19748
#: serverguide/C/network-auth.xml:2933(para)
19749
msgid ""
19750
"The new user principal can be tested using the <application>kinit "
19751
"utility</application>:"
19752
msgstr ""
19753
19754
#: serverguide/C/network-auth.xml:2938(command)
19755
msgid "kinit steve/admin"
19756
msgstr ""
19757
19758
#: serverguide/C/network-auth.xml:2939(computeroutput)
19759
#, no-wrap
19760
msgid "steve/admin@EXAMPLE.COM's Password:"
19761
msgstr ""
19762
19763
#: serverguide/C/network-auth.xml:2942(para)
19764
msgid ""
19765
"After entering the password, use the <application>klist</application> "
19766
"utility to view information about the Ticket Granting Ticket (TGT):"
19767
msgstr ""
19768
19769
#: serverguide/C/network-auth.xml:2948(command) serverguide/C/network-auth.xml:3325(command)
19770
msgid "klist"
19771
msgstr ""
19772
19773
#: serverguide/C/network-auth.xml:2949(computeroutput)
19774
#, no-wrap
19775
msgid ""
19776
"Credentials cache: FILE:/tmp/krb5cc_1000\n"
19777
" Principal: steve/admin@EXAMPLE.COM\n"
19778
"\n"
19779
" Issued Expires Principal\n"
19780
"Jul 13 17:53:34 Jul 14 03:53:34 krbtgt/EXAMPLE.COM@EXAMPLE.COM"
19781
msgstr ""
19782
19783
#: serverguide/C/network-auth.xml:2956(para)
19784
msgid ""
19785
"Where the cache filename <filename>krb5cc_1000</filename> is composed of the "
19786
"prefix <filename>krb5cc_</filename> and the user id (uid), which in this "
19787
"case is <filename>1000</filename>. You may need to add an entry into the "
19788
"<filename>/etc/hosts</filename> for the KDC so the client can find the KDC. "
19789
"For example:"
19790
msgstr ""
19791
19792
#: serverguide/C/network-auth.xml:2965(programlisting)
19793
#, no-wrap
19794
msgid ""
19795
"\n"
19796
"192.168.0.1 kdc01.example.com kdc01\n"
19797
msgstr ""
19798
19799
#: serverguide/C/network-auth.xml:2969(para)
19800
msgid ""
19801
"Replacing <emphasis>192.168.0.1</emphasis> with the IP address of your KDC. "
19802
"This usually happens when you have a Kerberos realm encompassing different "
19803
"networks separated by routers."
19804
msgstr ""
19805
19806
#: serverguide/C/network-auth.xml:2978(para)
19807
msgid ""
19808
"The best way to allow clients to automatically determine the KDC for the "
19809
"Realm is using DNS SRV records. Add the following to "
19810
"<filename>/etc/named/db.example.com</filename>:"
19811
msgstr ""
19812
19813
#: serverguide/C/network-auth.xml:2984(programlisting)
19814
#, no-wrap
19815
msgid ""
19816
"\n"
19817
"_kerberos._udp.EXAMPLE.COM. IN SRV 1 0 88 kdc01.example.com.\n"
19818
"_kerberos._tcp.EXAMPLE.COM. IN SRV 1 0 88 kdc01.example.com.\n"
19819
"_kerberos._udp.EXAMPLE.COM. IN SRV 10 0 88 kdc02.example.com. \n"
19820
"_kerberos._tcp.EXAMPLE.COM. IN SRV 10 0 88 kdc02.example.com. \n"
19821
"_kerberos-adm._tcp.EXAMPLE.COM. IN SRV 1 0 749 kdc01.example.com.\n"
19822
"_kpasswd._udp.EXAMPLE.COM. IN SRV 1 0 464 kdc01.example.com.\n"
19823
msgstr ""
19824
19825
#: serverguide/C/network-auth.xml:2994(para)
19826
msgid ""
19827
"Replace <emphasis>EXAMPLE.COM</emphasis>, <emphasis>kdc01</emphasis>, and "
19828
"<emphasis>kdc02</emphasis> with your domain name, primary KDC, and secondary "
19829
"KDC."
19830
msgstr ""
19831
19832
#: serverguide/C/network-auth.xml:3000(para)
19833
msgid ""
19834
"See <xref linkend=\"dns\"/> for detailed instructions on setting up DNS."
19835
msgstr ""
19836
19837
#: serverguide/C/network-auth.xml:3007(para)
19838
msgid "Your new Kerberos Realm is now ready to authenticate clients."
19839
msgstr ""
19840
19841
#: serverguide/C/network-auth.xml:3014(title)
19842
msgid "Secondary KDC"
19843
msgstr ""
19844
19845
#: serverguide/C/network-auth.xml:3016(para)
19846
msgid ""
19847
"Once you have one Key Distribution Center (KDC) on your network, it is good "
19848
"practice to have a Secondary KDC in case the primary becomes unavailable. "
19849
"Also, if you have Kerberos clients that are in different networks (possibly "
19850
"separated by routers using NAT), it is wise to place a secondary KDC in each "
19851
"of those networks."
19852
msgstr ""
19853
19854
#: serverguide/C/network-auth.xml:3027(para)
19855
msgid ""
19856
"First, install the packages, and when asked for the Kerberos and Admin "
19857
"server names enter the name of the Primary KDC:"
19858
msgstr ""
19859
19860
#: serverguide/C/network-auth.xml:3038(para)
19861
msgid ""
19862
"Once you have the packages installed, create the Secondary KDC's host "
19863
"principal. From a terminal prompt, enter:"
19864
msgstr ""
19865
19866
#: serverguide/C/network-auth.xml:3043(command)
19867
msgid "kadmin -q \"addprinc -randkey host/kdc02.example.com\""
19868
msgstr ""
19869
19870
#: serverguide/C/network-auth.xml:3047(para)
19871
msgid ""
19872
"After, issuing any <application>kadmin</application> commands you will be "
19873
"prompted for your <emphasis>username/admin@EXAMPLE.COM</emphasis> principal "
19874
"password."
19875
msgstr ""
19876
19877
#: serverguide/C/network-auth.xml:3056(para)
19878
msgid "Extract the <emphasis>keytab</emphasis> file:"
19879
msgstr ""
19880
19881
#: serverguide/C/network-auth.xml:3061(command)
19882
msgid "kadmin -q \"ktadd -norandkey -k keytab.kdc02 host/kdc02.example.com\""
19883
msgstr ""
19884
19885
#: serverguide/C/network-auth.xml:3067(para)
19886
msgid ""
19887
"There should now be a <filename>keytab.kdc02</filename> in the current "
19888
"directory, move the file to <filename>/etc/krb5.keytab</filename>:"
19889
msgstr ""
19890
19891
#: serverguide/C/network-auth.xml:3073(command)
19892
msgid "sudo mv keytab.kdc02 /etc/krb5.keytab"
19893
msgstr ""
19894
19895
#: serverguide/C/network-auth.xml:3077(para)
19896
msgid ""
19897
"If the path to the <filename>keytab.kdc02</filename> file is different "
19898
"adjust accordingly."
19899
msgstr ""
19900
19901
#: serverguide/C/network-auth.xml:3082(para)
19902
msgid ""
19903
"Also, you can list the principals in a Keytab file, which can be useful when "
19904
"troubleshooting, using the <application>klist</application> utility:"
19905
msgstr ""
19906
19907
#: serverguide/C/network-auth.xml:3088(command)
19908
msgid "sudo klist -k /etc/krb5.keytab"
19909
msgstr ""
19910
19911
#: serverguide/C/network-auth.xml:3091(para)
19912
msgid ""
19913
"The <application>-k</application> option indicates the file is a keytab file."
19914
msgstr ""
19915
19916
#: serverguide/C/network-auth.xml:3098(para)
19917
msgid ""
19918
"Next, there needs to be a <filename>kpropd.acl</filename> file on each KDC "
19919
"that lists all KDCs for the Realm. For example, on both primary and "
19920
"secondary KDC, create <filename>/etc/krb5kdc/kpropd.acl</filename>:"
19921
msgstr ""
19922
19923
#: serverguide/C/network-auth.xml:3103(programlisting)
19924
#, no-wrap
19925
msgid ""
19926
"\n"
19927
"host/kdc01.example.com@EXAMPLE.COM\n"
19928
"host/kdc02.example.com@EXAMPLE.COM\n"
19929
msgstr ""
19930
19931
#: serverguide/C/network-auth.xml:3111(para)
19932
msgid "Create an empty database on the <emphasis>Secondary KDC</emphasis>:"
19933
msgstr ""
19934
19935
#: serverguide/C/network-auth.xml:3116(command)
19936
msgid "sudo kdb5_util -s create"
19937
msgstr ""
19938
19939
#: serverguide/C/network-auth.xml:3122(para)
19940
msgid ""
19941
"Now start the <application>kpropd</application> daemon, which listens for "
19942
"connections from the <application>kprop</application> utility. "
19943
"<application>kprop</application> is used to transfer dump files:"
19944
msgstr ""
19945
19946
#: serverguide/C/network-auth.xml:3129(command)
19947
msgid "sudo kpropd -S"
19948
msgstr ""
19949
19950
#: serverguide/C/network-auth.xml:3135(para)
19951
msgid ""
19952
"From a terminal on the <emphasis>Primary KDC</emphasis>, create a dump file "
19953
"of the principal database:"
19954
msgstr ""
19955
19956
#: serverguide/C/network-auth.xml:3140(command)
19957
msgid "sudo kdb5_util dump /var/lib/krb5kdc/dump"
19958
msgstr ""
19959
19960
#: serverguide/C/network-auth.xml:3146(para)
19961
msgid ""
19962
"Extract the Primary KDC's <emphasis>keytab</emphasis> file and copy it to "
19963
"<filename>/etc/krb5.keytab</filename>:"
19964
msgstr ""
19965
19966
#: serverguide/C/network-auth.xml:3151(command)
19967
msgid "kadmin -q \"ktadd -k keytab.kdc01 host/kdc01.example.com\""
19968
msgstr ""
19969
19970
#: serverguide/C/network-auth.xml:3152(command)
19971
msgid "sudo mv keytab.kdc01 /etc/krb5.keytab"
19972
msgstr ""
19973
19974
#: serverguide/C/network-auth.xml:3156(para)
19975
msgid ""
19976
"Make sure there is a <emphasis>host</emphasis> for "
19977
"<emphasis>kdc01.example.com</emphasis> before extracting the Keytab."
19978
msgstr ""
19979
19980
#: serverguide/C/network-auth.xml:3164(para)
19981
msgid ""
19982
"Using the <application>kprop</application> utility push the database to the "
19983
"Secondary KDC:"
19984
msgstr ""
19985
19986
#: serverguide/C/network-auth.xml:3169(command)
19987
msgid "sudo kprop -r EXAMPLE.COM -f /var/lib/krb5kdc/dump kdc02.example.com"
19988
msgstr ""
19989
19990
#: serverguide/C/network-auth.xml:3173(para)
19991
msgid ""
19992
"There should be a <emphasis>SUCCEEDED</emphasis> message if the propagation "
19993
"worked. If there is an error message check "
19994
"<filename>/var/log/syslog</filename> on the secondary KDC for more "
19995
"information."
19996
msgstr ""
19997
19998
#: serverguide/C/network-auth.xml:3179(para)
19999
msgid ""
20000
"You may also want to create a <application>cron</application> job to "
20001
"periodically update the database on the Secondary KDC. For example, the "
20002
"following will push the database every hour (note the long line has been "
20003
"split to fit the format of this document):"
20004
msgstr ""
20005
20006
#: serverguide/C/network-auth.xml:3184(programlisting)
20007
#, no-wrap
20008
msgid ""
20009
"\n"
20010
"# m h dom mon dow command\n"
20011
"0 * * * * /usr/sbin/kdb5_util dump /var/lib/krb5kdc/dump && \n"
20012
"/usr/sbin/kprop -r EXAMPLE.COM -f /var/lib/krb5kdc/dump kdc02.example.com\n"
20013
msgstr ""
20014
20015
#: serverguide/C/network-auth.xml:3193(para)
20016
msgid ""
20017
"Back on the <emphasis>Secondary KDC</emphasis>, create a "
20018
"<emphasis>stash</emphasis> file to hold the Kerberos master key:"
20019
msgstr ""
20020
20021
#: serverguide/C/network-auth.xml:3199(command)
20022
msgid "sudo kdb5_util stash"
20023
msgstr ""
20024
20025
#: serverguide/C/network-auth.xml:3205(para)
20026
msgid ""
20027
"Finally, start the <application>krb5-kdc</application> daemon on the "
20028
"Secondary KDC:"
20029
msgstr ""
20030
20031
#: serverguide/C/network-auth.xml:3210(command) serverguide/C/network-auth.xml:3743(command) serverguide/C/network-auth.xml:3898(command)
20032
msgid "sudo systemctl start krb5-kdc.service"
20033
msgstr ""
20034
20035
#: serverguide/C/network-auth.xml:3216(para)
20036
msgid ""
20037
"The <emphasis>Secondary KDC</emphasis> should now be able to issue tickets "
20038
"for the Realm. You can test this by stopping the <application>krb5-"
20039
"kdc</application> daemon on the Primary KDC, then by using "
20040
"<application>kinit</application> to request a ticket. If all goes well you "
20041
"should receive a ticket from the Secondary KDC. Otherwise, check "
20042
"<filename>/var/log/syslog</filename> and "
20043
"<filename>/var/log/auth.log</filename> in the Secondary KDC."
20044
msgstr ""
20045
20046
#: serverguide/C/network-auth.xml:3227(title)
20047
msgid "Kerberos Linux Client"
20048
msgstr ""
20049
20050
#: serverguide/C/network-auth.xml:3229(para)
20051
msgid ""
20052
"This section covers configuring a Linux system as a "
20053
"<application>Kerberos</application> client. This will allow access to any "
20054
"kerberized services once a user has successfully logged into the system."
20055
msgstr ""
20056
20057
#: serverguide/C/network-auth.xml:3237(para)
20058
msgid ""
20059
"In order to authenticate to a Kerberos Realm, the <application>krb5-"
20060
"user</application> and <application>libpam-krb5</application> packages are "
20061
"needed, along with a few others that are not strictly necessary but make "
20062
"life easier. To install the packages enter the following in a terminal "
20063
"prompt:"
20064
msgstr ""
20065
20066
#: serverguide/C/network-auth.xml:3244(command)
20067
msgid ""
20068
"sudo apt install krb5-user libpam-krb5 libpam-ccreds auth-client-config"
20069
msgstr ""
20070
20071
#: serverguide/C/network-auth.xml:3247(para)
20072
msgid ""
20073
"The <application>auth-client-config</application> package allows simple "
20074
"configuration of PAM for authentication from multiple sources, and the "
20075
"<application>libpam-ccreds</application> will cache authentication "
20076
"credentials allowing you to login in case the Key Distribution Center (KDC) "
20077
"is unavailable. This package is also useful for laptops that may "
20078
"authenticate using Kerberos while on the corporate network, but will need to "
20079
"be accessed off the network as well."
20080
msgstr ""
20081
20082
#: serverguide/C/network-auth.xml:3258(para)
20083
msgid "To configure the client in a terminal enter:"
20084
msgstr ""
20085
20086
#: serverguide/C/network-auth.xml:3263(command)
20087
msgid "sudo dpkg-reconfigure krb5-config"
20088
msgstr ""
20089
20090
#: serverguide/C/network-auth.xml:3266(para)
20091
msgid ""
20092
"You will then be prompted to enter the name of the Kerberos Realm. Also, if "
20093
"you don't have DNS configured with Kerberos <emphasis>SRV</emphasis> "
20094
"records, the menu will prompt you for the hostname of the Key Distribution "
20095
"Center (KDC) and Realm Administration server."
20096
msgstr ""
20097
20098
#: serverguide/C/network-auth.xml:3272(para)
20099
msgid ""
20100
"The <application>dpkg-reconfigure</application> adds entries to the "
20101
"<filename>/etc/krb5.conf</filename> file for your Realm. You should have "
20102
"entries similar to the following:"
20103
msgstr ""
20104
20105
#: serverguide/C/network-auth.xml:3277(programlisting)
20106
#, no-wrap
20107
msgid ""
20108
"\n"
20109
"[libdefaults]\n"
20110
" default_realm = EXAMPLE.COM\n"
20111
"...\n"
20112
"[realms]\n"
20113
" EXAMPLE.COM = {\n"
20114
" kdc = 192.168.0.1\n"
20115
" admin_server = 192.168.0.1\n"
20116
" }\n"
20117
msgstr ""
20118
20119
#: serverguide/C/network-auth.xml:3289(para)
20120
msgid ""
20121
"If you set the uid of each of your network-authenticated users to start at "
20122
"5000, as suggested in <xref linkend=\"kerberos-server-installation\"/>, you "
20123
"can then tell pam to only try to authenticate using Kerberos users with uid "
20124
"> 5000:"
20125
msgstr ""
20126
20127
#: serverguide/C/network-auth.xml:3297(command)
20128
msgid ""
20129
"# Kerberos should only be applied to ldap/kerberos users, not local ones. "
20130
"for i in common-auth common-session common-account common-password; do sudo "
20131
"sed -i -r \\ -e 's/pam_krb5.so minimum_uid=1000/pam_krb5.so "
20132
"minimum_uid=5000/' \\ /etc/pam.d/$i done"
20133
msgstr ""
20134
20135
#: serverguide/C/network-auth.xml:3304(para)
20136
msgid ""
20137
"This will avoid being asked for the (non-existent) Kerberos password of a "
20138
"locally authenticated user when changing its password using "
20139
"<command>passwd</command>."
20140
msgstr ""
20141
20142
#: serverguide/C/network-auth.xml:3311(para)
20143
msgid ""
20144
"You can test the configuration by requesting a ticket using the "
20145
"<application>kinit</application> utility. For example:"
20146
msgstr ""
20147
20148
#: serverguide/C/network-auth.xml:3316(command)
20149
msgid "kinit steve@EXAMPLE.COM"
20150
msgstr ""
20151
20152
#: serverguide/C/network-auth.xml:3317(computeroutput)
20153
#, no-wrap
20154
msgid "Password for steve@EXAMPLE.COM:"
20155
msgstr ""
20156
20157
#: serverguide/C/network-auth.xml:3320(para)
20158
msgid ""
20159
"When a ticket has been granted, the details can be viewed using "
20160
"<application>klist</application>:"
20161
msgstr ""
20162
20163
#: serverguide/C/network-auth.xml:3326(computeroutput)
20164
#, no-wrap
20165
msgid ""
20166
"Ticket cache: FILE:/tmp/krb5cc_1000\n"
20167
"Default principal: steve@EXAMPLE.COM\n"
20168
"\n"
20169
"Valid starting Expires Service principal\n"
20170
"07/24/08 05:18:56 07/24/08 15:18:56 krbtgt/EXAMPLE.COM@EXAMPLE.COM\n"
20171
" renew until 07/25/08 05:18:57\n"
20172
"\n"
20173
"\n"
20174
"Kerberos 4 ticket cache: /tmp/tkt1000\n"
20175
"klist: You have no tickets cached"
20176
msgstr ""
20177
20178
#: serverguide/C/network-auth.xml:3338(para)
20179
msgid ""
20180
"Next, use the <application>auth-client-config</application> to configure the "
20181
"<application>libpam-krb5</application> module to request a ticket during "
20182
"login:"
20183
msgstr ""
20184
20185
#: serverguide/C/network-auth.xml:3344(command)
20186
msgid "sudo auth-client-config -a -p kerberos_example"
20187
msgstr ""
20188
20189
#: serverguide/C/network-auth.xml:3347(para)
20190
msgid ""
20191
"You will should now receive a ticket upon successful login authentication."
20192
msgstr ""
20193
20194
#: serverguide/C/network-auth.xml:3358(para)
20195
msgid ""
20196
"For more information on MIT's version of Kerberos, see the <ulink "
20197
"url=\"http://web.mit.edu/Kerberos/\">MIT Kerberos</ulink> site."
20198
msgstr ""
20199
20200
#: serverguide/C/network-auth.xml:3363(para)
20201
msgid ""
20202
"The <ulink url=\"https://help.ubuntu.com/community/Kerberos\">Ubuntu Wiki "
20203
"Kerberos</ulink> page has more details."
20204
msgstr ""
20205
20206
#: serverguide/C/network-auth.xml:3368(para)
20207
msgid ""
20208
"O'Reilly's <ulink "
20209
"url=\"http://oreilly.com/catalog/9780596004033/\">Kerberos: The Definitive "
20210
"Guide</ulink> is a great reference when setting up Kerberos."
20211
msgstr ""
20212
20213
#: serverguide/C/network-auth.xml:3374(para)
20214
msgid ""
20215
"Also, feel free to stop by the <emphasis>#ubuntu-server</emphasis> and "
20216
"<emphasis>#kerberos</emphasis> IRC channels on <ulink "
20217
"url=\"http://freenode.net/\">Freenode</ulink> if you have Kerberos questions."
20218
msgstr ""
20219
20220
#: serverguide/C/network-auth.xml:3386(title)
20221
msgid "Kerberos and LDAP"
20222
msgstr ""
20223
20224
#: serverguide/C/network-auth.xml:3388(para)
20225
msgid ""
20226
"Most people will not use Kerberos by itself; once an user is authenticated "
20227
"(Kerberos), we need to figure out what this user can do (authorization). And "
20228
"that would be the job of programs such as <application>LDAP</application>."
20229
msgstr ""
20230
20231
#: serverguide/C/network-auth.xml:3395(para)
20232
msgid ""
20233
"Replicating a Kerberos principal database between two servers can be "
20234
"complicated, and adds an additional user database to your network. "
20235
"Fortunately, MIT Kerberos can be configured to use an "
20236
"<application>LDAP</application> directory as a principal database. This "
20237
"section covers configuring a primary and secondary kerberos server to use "
20238
"<application>OpenLDAP</application> for the principal database."
20239
msgstr ""
20240
20241
#: serverguide/C/network-auth.xml:3403(para)
20242
msgid ""
20243
"The examples presented here assume <application>MIT Kerberos</application> "
20244
"and <application>OpenLDAP</application>."
20245
msgstr ""
20246
20247
#: serverguide/C/network-auth.xml:3411(title)
20248
msgid "Configuring OpenLDAP"
20249
msgstr ""
20250
20251
#: serverguide/C/network-auth.xml:3413(para)
20252
msgid ""
20253
"First, the necessary <emphasis>schema</emphasis> needs to be loaded on an "
20254
"<application>OpenLDAP</application> server that has network connectivity to "
20255
"the Primary and Secondary KDCs. The rest of this section assumes that you "
20256
"also have LDAP replication configured between at least two servers. For "
20257
"information on setting up OpenLDAP see <xref linkend=\"openldap-server\"/>."
20258
msgstr ""
20259
20260
#: serverguide/C/network-auth.xml:3419(para)
20261
msgid ""
20262
"It is also required to configure OpenLDAP for TLS and SSL connections, so "
20263
"that traffic between the KDC and LDAP server is encrypted. See <xref "
20264
"linkend=\"openldap-tls\"/> for details."
20265
msgstr ""
20266
20267
#: serverguide/C/network-auth.xml:3425(para)
20268
msgid ""
20269
"<filename>cn=admin,cn=config</filename> is a user we created with rights to "
20270
"edit the ldap database. Many times it is the RootDN. Change its value to "
20271
"reflect your setup."
20272
msgstr ""
20273
20274
#: serverguide/C/network-auth.xml:3434(para)
20275
msgid ""
20276
"To load the schema into LDAP, on the LDAP server install the "
20277
"<application>krb5-kdc-ldap</application> package. From a terminal enter:"
20278
msgstr ""
20279
20280
#: serverguide/C/network-auth.xml:3440(command)
20281
msgid "sudo apt install krb5-kdc-ldap"
20282
msgstr ""
20283
20284
#: serverguide/C/network-auth.xml:3445(para)
20285
msgid "Next, extract the <filename>kerberos.schema.gz</filename> file:"
20286
msgstr ""
20287
20288
#: serverguide/C/network-auth.xml:3450(command)
20289
msgid "sudo gzip -d /usr/share/doc/krb5-kdc-ldap/kerberos.schema.gz"
20290
msgstr ""
20291
20292
#: serverguide/C/network-auth.xml:3451(command)
20293
msgid ""
20294
"sudo cp /usr/share/doc/krb5-kdc-ldap/kerberos.schema /etc/ldap/schema/"
20295
msgstr ""
20296
20297
#: serverguide/C/network-auth.xml:3457(para)
20298
msgid ""
20299
"The <emphasis>kerberos</emphasis> schema needs to be added to the "
20300
"<emphasis>cn=config</emphasis> tree. The procedure to add a new schema to "
20301
"<application>slapd</application> is also detailed in <xref "
20302
"linkend=\"openldap-configuration\"/>."
20303
msgstr ""
20304
20305
#: serverguide/C/network-auth.xml:3465(para)
20306
msgid ""
20307
"First, create a configuration file named "
20308
"<filename>schema_convert.conf</filename>, or a similar descriptive name, "
20309
"containing the following lines:"
20310
msgstr ""
20311
20312
#: serverguide/C/network-auth.xml:3470(programlisting)
20313
#, no-wrap
20314
msgid ""
20315
"\n"
20316
"include /etc/ldap/schema/core.schema\n"
20317
"include /etc/ldap/schema/collective.schema\n"
20318
"include /etc/ldap/schema/corba.schema\n"
20319
"include /etc/ldap/schema/cosine.schema\n"
20320
"include /etc/ldap/schema/duaconf.schema\n"
20321
"include /etc/ldap/schema/dyngroup.schema\n"
20322
"include /etc/ldap/schema/inetorgperson.schema\n"
20323
"include /etc/ldap/schema/java.schema\n"
20324
"include /etc/ldap/schema/misc.schema\n"
20325
"include /etc/ldap/schema/nis.schema\n"
20326
"include /etc/ldap/schema/openldap.schema\n"
20327
"include /etc/ldap/schema/ppolicy.schema\n"
20328
"include /etc/ldap/schema/kerberos.schema\n"
20329
msgstr ""
20330
20331
#: serverguide/C/network-auth.xml:3490(para)
20332
msgid "Create a temporary directory to hold the LDIF files:"
20333
msgstr ""
20334
20335
#: serverguide/C/network-auth.xml:3494(command)
20336
msgid "mkdir /tmp/ldif_output"
20337
msgstr ""
20338
20339
#: serverguide/C/network-auth.xml:3500(para)
20340
msgid ""
20341
"Now use <application>slapcat</application> to convert the schema files:"
20342
msgstr ""
20343
20344
#: serverguide/C/network-auth.xml:3505(command)
20345
msgid ""
20346
"slapcat -f schema_convert.conf -F /tmp/ldif_output -n0 -s \\ "
20347
"\"cn={12}kerberos,cn=schema,cn=config\" > /tmp/cn=kerberos.ldif"
20348
msgstr ""
20349
20350
#: serverguide/C/network-auth.xml:3509(para)
20351
msgid ""
20352
"Change the above file and path names to match your own if they are different."
20353
msgstr ""
20354
20355
#: serverguide/C/network-auth.xml:3516(para)
20356
msgid ""
20357
"Edit the generated <filename>/tmp/cn\\=kerberos.ldif</filename> file, "
20358
"changing the following attributes:"
20359
msgstr ""
20360
20361
#: serverguide/C/network-auth.xml:3520(programlisting)
20362
#, no-wrap
20363
msgid ""
20364
"\n"
20365
"dn: cn=kerberos,cn=schema,cn=config\n"
20366
"...\n"
20367
"cn: kerberos\n"
20368
msgstr ""
20369
20370
#: serverguide/C/network-auth.xml:3526(para)
20371
msgid "And remove the following lines from the end of the file:"
20372
msgstr ""
20373
20374
#: serverguide/C/network-auth.xml:3530(programlisting)
20375
#, no-wrap
20376
msgid ""
20377
"\n"
20378
"structuralObjectClass: olcSchemaConfig\n"
20379
"entryUUID: 18ccd010-746b-102d-9fbe-3760cca765dc\n"
20380
"creatorsName: cn=config\n"
20381
"createTimestamp: 20090111203515Z\n"
20382
"entryCSN: 20090111203515.326445Z#000000#000#000000\n"
20383
"modifiersName: cn=config\n"
20384
"modifyTimestamp: 20090111203515Z\n"
20385
msgstr ""
20386
20387
#: serverguide/C/network-auth.xml:3540(para)
20388
msgid ""
20389
"The attribute values will vary, just be sure the attributes are removed."
20390
msgstr ""
20391
20392
#: serverguide/C/network-auth.xml:3547(para)
20393
msgid "Load the new schema with <application>ldapadd</application>:"
20394
msgstr ""
20395
20396
#: serverguide/C/network-auth.xml:3552(command)
20397
msgid "sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /tmp/cn\\=kerberos.ldif"
20398
msgstr ""
20399
20400
#: serverguide/C/network-auth.xml:3558(para)
20401
msgid ""
20402
"Add an index for the <emphasis>krb5principalname</emphasis> attribute:"
20403
msgstr ""
20404
20405
#: serverguide/C/network-auth.xml:3563(command) serverguide/C/network-auth.xml:3580(command)
20406
msgid "sudo ldapmodify -Q -Y EXTERNAL -H ldapi:///"
20407
msgstr ""
20408
20409
#: serverguide/C/network-auth.xml:3565(userinput)
20410
#, no-wrap
20411
msgid ""
20412
"dn: olcDatabase={1}mdb,cn=config\n"
20413
"add: olcDbIndex\n"
20414
"olcDbIndex: krbPrincipalName eq,pres,sub"
20415
msgstr ""
20416
20417
#: serverguide/C/network-auth.xml:3564(computeroutput)
20418
#, no-wrap
20419
msgid ""
20420
"\n"
20421
"<placeholder-1/>\n"
20422
"\n"
20423
"modifying entry \"olcDatabase={1}mdb,cn=config\""
20424
msgstr ""
20425
20426
#: serverguide/C/network-auth.xml:3575(para)
20427
msgid "Finally, update the Access Control Lists (ACL):"
20428
msgstr ""
20429
20430
#: serverguide/C/network-auth.xml:3582(userinput)
20431
#, no-wrap
20432
msgid ""
20433
"dn: olcDatabase={1}mdb,cn=config\n"
20434
"replace: olcAccess\n"
20435
"olcAccess: to attrs=userPassword,shadowLastChange,krbPrincipalKey by\n"
20436
" dn=\"cn=admin,dc=example,dc=com\" write by anonymous auth by self write by "
20437
"* none\n"
20438
"-\n"
20439
"add: olcAccess\n"
20440
"olcAccess: to dn.base=\"\" by * read\n"
20441
"-\n"
20442
"add: olcAccess\n"
20443
"olcAccess: to * by dn=\"cn=admin,dc=example,dc=com\" write by * read"
20444
msgstr ""
20445
20446
#: serverguide/C/network-auth.xml:3581(computeroutput)
20447
#, no-wrap
20448
msgid ""
20449
"\n"
20450
"<placeholder-1/>\n"
20451
"\n"
20452
"modifying entry \"olcDatabase={1}mdb,cn=config\"\n"
20453
msgstr ""
20454
20455
#: serverguide/C/network-auth.xml:3602(para)
20456
msgid ""
20457
"That's it, your LDAP directory is now ready to serve as a Kerberos principal "
20458
"database."
20459
msgstr ""
20460
20461
#: serverguide/C/network-auth.xml:3608(title)
20462
msgid "Primary KDC Configuration"
20463
msgstr ""
20464
20465
#: serverguide/C/network-auth.xml:3610(para)
20466
msgid ""
20467
"With <application>OpenLDAP</application> configured it is time to configure "
20468
"the KDC."
20469
msgstr ""
20470
20471
#: serverguide/C/network-auth.xml:3616(para)
20472
msgid "First, install the necessary packages, from a terminal enter:"
20473
msgstr ""
20474
20475
#: serverguide/C/network-auth.xml:3621(command) serverguide/C/network-auth.xml:3792(command)
20476
msgid "sudo apt install krb5-kdc krb5-admin-server krb5-kdc-ldap"
20477
msgstr ""
20478
20479
#: serverguide/C/network-auth.xml:3627(para)
20480
msgid ""
20481
"Now edit <filename>/etc/krb5.conf</filename> adding the following options to "
20482
"under the appropriate sections:"
20483
msgstr ""
20484
20485
#: serverguide/C/network-auth.xml:3631(programlisting)
20486
#, no-wrap
20487
msgid ""
20488
"\n"
20489
"[libdefaults]\n"
20490
" default_realm = EXAMPLE.COM\n"
20491
"\n"
20492
"...\n"
20493
"\n"
20494
"[realms]\n"
20495
" EXAMPLE.COM = {\n"
20496
" kdc = kdc01.example.com\n"
20497
" kdc = kdc02.example.com\n"
20498
" admin_server = kdc01.example.com\n"
20499
" admin_server = kdc02.example.com\n"
20500
" default_domain = example.com\n"
20501
" database_module = openldap_ldapconf\n"
20502
" }\n"
20503
"\n"
20504
"...\n"
20505
"\n"
20506
"[domain_realm]\n"
20507
" .example.com = EXAMPLE.COM\n"
20508
"\n"
20509
"\n"
20510
"...\n"
20511
"\n"
20512
"[dbdefaults]\n"
20513
" ldap_kerberos_container_dn = cn=krbContainer,dc=example,dc=com\n"
20514
"\n"
20515
"[dbmodules]\n"
20516
" openldap_ldapconf = {\n"
20517
" db_library = kldap\n"
20518
" ldap_kdc_dn = \"cn=admin,dc=example,dc=com\"\n"
20519
"\n"
20520
" # this object needs to have read rights on\n"
20521
" # the realm container, principal container and realm sub-"
20522
"trees\n"
20523
" ldap_kadmind_dn = \"cn=admin,dc=example,dc=com\"\n"
20524
"\n"
20525
" # this object needs to have read and write rights on\n"
20526
" # the realm container, principal container and realm sub-"
20527
"trees\n"
20528
" ldap_service_password_file = /etc/krb5kdc/service.keyfile\n"
20529
" ldap_servers = ldaps://ldap01.example.com "
20530
"ldaps://ldap02.example.com\n"
20531
" ldap_conns_per_server = 5\n"
20532
" }\n"
20533
msgstr ""
20534
20535
#: serverguide/C/network-auth.xml:3676(para)
20536
msgid ""
20537
"Change <emphasis>example.com</emphasis>, "
20538
"<emphasis>dc=example,dc=com</emphasis>, "
20539
"<emphasis>cn=admin,dc=example,dc=com</emphasis>, and "
20540
"<emphasis>ldap01.example.com</emphasis> to the appropriate domain, LDAP "
20541
"object, and LDAP server for your network."
20542
msgstr ""
20543
20544
#: serverguide/C/network-auth.xml:3685(para)
20545
msgid ""
20546
"Next, use the <application>kdb5_ldap_util</application> utility to create "
20547
"the realm:"
20548
msgstr ""
20549
20550
#: serverguide/C/network-auth.xml:3690(command)
20551
msgid ""
20552
"sudo kdb5_ldap_util -D cn=admin,dc=example,dc=com create -subtrees \\ "
20553
"dc=example,dc=com -r EXAMPLE.COM -s -H ldap://ldap01.example.com"
20554
msgstr ""
20555
20556
#: serverguide/C/network-auth.xml:3697(para)
20557
msgid ""
20558
"Create a stash of the password used to bind to the LDAP server. This "
20559
"password is used by the <emphasis>ldap_kdc_dn</emphasis> and "
20560
"<emphasis>ldap_kadmin_dn</emphasis> options in "
20561
"<filename>/etc/krb5.conf</filename>:"
20562
msgstr ""
20563
20564
#: serverguide/C/network-auth.xml:3703(command) serverguide/C/network-auth.xml:3854(command)
20565
msgid ""
20566
"sudo kdb5_ldap_util -D cn=admin,dc=example,dc=com stashsrvpw -f \\ "
20567
"/etc/krb5kdc/service.keyfile cn=admin,dc=example,dc=com"
20568
msgstr ""
20569
20570
#: serverguide/C/network-auth.xml:3710(para)
20571
msgid "Copy the CA certificate from the LDAP server:"
20572
msgstr ""
20573
20574
#: serverguide/C/network-auth.xml:3715(command)
20575
msgid "scp ldap01:/etc/ssl/certs/cacert.pem ."
20576
msgstr ""
20577
20578
#: serverguide/C/network-auth.xml:3716(command)
20579
msgid "sudo cp cacert.pem /etc/ssl/certs"
20580
msgstr ""
20581
20582
#: serverguide/C/network-auth.xml:3719(para)
20583
msgid ""
20584
"And edit <filename>/etc/ldap/ldap.conf</filename> to use the certificate:"
20585
msgstr ""
20586
20587
#: serverguide/C/network-auth.xml:3723(programlisting)
20588
#, no-wrap
20589
msgid ""
20590
"\n"
20591
"TLS_CACERT /etc/ssl/certs/cacert.pem\n"
20592
msgstr ""
20593
20594
#: serverguide/C/network-auth.xml:3728(para)
20595
msgid ""
20596
"The certificate will also need to be copied to the Secondary KDC, to allow "
20597
"the connection to the LDAP servers using LDAPS."
20598
msgstr ""
20599
20600
#: serverguide/C/network-auth.xml:3738(para)
20601
msgid "Start the Kerberos KDC and admin server:"
20602
msgstr ""
20603
20604
#: serverguide/C/network-auth.xml:3744(command)
20605
msgid "sudo systemctl start krb5-admin-server.service"
20606
msgstr ""
20607
20608
#: serverguide/C/network-auth.xml:3749(para)
20609
msgid ""
20610
"You can now add Kerberos principals to the LDAP database, and they will be "
20611
"copied to any other LDAP servers configured for replication. To add a "
20612
"principal using the <application>kadmin.local</application> utility enter:"
20613
msgstr ""
20614
20615
#: serverguide/C/network-auth.xml:3757(userinput)
20616
#, no-wrap
20617
msgid "addprinc -x dn=\"uid=steve,ou=people,dc=example,dc=com\" steve"
20618
msgstr ""
20619
20620
#: serverguide/C/network-auth.xml:3756(computeroutput)
20621
#, no-wrap
20622
msgid ""
20623
"Authenticating as principal root/admin@EXAMPLE.COM with password.\n"
20624
"kadmin.local: <placeholder-1/>\n"
20625
"WARNING: no policy specified for steve@EXAMPLE.COM; defaulting to no policy\n"
20626
"Enter password for principal \"steve@EXAMPLE.COM\": \n"
20627
"Re-enter password for principal \"steve@EXAMPLE.COM\": \n"
20628
"Principal \"steve@EXAMPLE.COM\" created."
20629
msgstr ""
20630
20631
#: serverguide/C/network-auth.xml:3764(para)
20632
msgid ""
20633
"There should now be krbPrincipalName, krbPrincipalKey, krbLastPwdChange, and "
20634
"krbExtraData attributes added to the "
20635
"<emphasis>uid=steve,ou=people,dc=example,dc=com</emphasis> user object. Use "
20636
"the <application>kinit</application> and <application>klist</application> "
20637
"utilities to test that the user is indeed issued a ticket."
20638
msgstr ""
20639
20640
#: serverguide/C/network-auth.xml:3771(para)
20641
msgid ""
20642
"If the user object is already created the <emphasis>-x dn=\"...\"</emphasis> "
20643
"option is needed to add the Kerberos attributes. Otherwise a new "
20644
"<emphasis>principal</emphasis> object will be created in the realm subtree."
20645
msgstr ""
20646
20647
#: serverguide/C/network-auth.xml:3779(title)
20648
msgid "Secondary KDC Configuration"
20649
msgstr ""
20650
20651
#: serverguide/C/network-auth.xml:3781(para)
20652
msgid ""
20653
"Configuring a Secondary KDC using the LDAP backend is similar to configuring "
20654
"one using the normal Kerberos database."
20655
msgstr ""
20656
20657
#: serverguide/C/network-auth.xml:3787(para)
20658
msgid "First, install the necessary packages. In a terminal enter:"
20659
msgstr ""
20660
20661
#: serverguide/C/network-auth.xml:3798(para)
20662
msgid ""
20663
"Next, edit <filename>/etc/krb5.conf</filename> to use the LDAP backend:"
20664
msgstr ""
20665
20666
#: serverguide/C/network-auth.xml:3802(programlisting)
20667
#, no-wrap
20668
msgid ""
20669
"\n"
20670
"[libdefaults]\n"
20671
" default_realm = EXAMPLE.COM\n"
20672
"\n"
20673
"...\n"
20674
"\n"
20675
"[realms]\n"
20676
" EXAMPLE.COM = {\n"
20677
" kdc = kdc01.example.com\n"
20678
" kdc = kdc02.example.com\n"
20679
" admin_server = kdc01.example.com\n"
20680
" admin_server = kdc02.example.com\n"
20681
" default_domain = example.com\n"
20682
" database_module = openldap_ldapconf\n"
20683
" }\n"
20684
"\n"
20685
"...\n"
20686
"\n"
20687
"[domain_realm]\n"
20688
" .example.com = EXAMPLE.COM\n"
20689
"\n"
20690
"...\n"
20691
"\n"
20692
"[dbdefaults]\n"
20693
" ldap_kerberos_container_dn = dc=example,dc=com\n"
20694
"\n"
20695
"[dbmodules]\n"
20696
" openldap_ldapconf = {\n"
20697
" db_library = kldap\n"
20698
" ldap_kdc_dn = \"cn=admin,dc=example,dc=com\"\n"
20699
"\n"
20700
" # this object needs to have read rights on\n"
20701
" # the realm container, principal container and realm sub-"
20702
"trees\n"
20703
" ldap_kadmind_dn = \"cn=admin,dc=example,dc=com\"\n"
20704
"\n"
20705
" # this object needs to have read and write rights on\n"
20706
" # the realm container, principal container and realm sub-"
20707
"trees\n"
20708
" ldap_service_password_file = /etc/krb5kdc/service.keyfile\n"
20709
" ldap_servers = ldaps://ldap01.example.com "
20710
"ldaps://ldap02.example.com\n"
20711
" ldap_conns_per_server = 5\n"
20712
" }\n"
20713
msgstr ""
20714
20715
#: serverguide/C/network-auth.xml:3849(para)
20716
msgid "Create the stash for the LDAP bind password:"
20717
msgstr ""
20718
20719
#: serverguide/C/network-auth.xml:3861(para)
20720
msgid ""
20721
"Now, on the <emphasis>Primary KDC</emphasis> copy the "
20722
"<filename>/etc/krb5kdc/.k5.EXAMPLE.COM</filename><emphasis>Master "
20723
"Key</emphasis> stash to the Secondary KDC. Be sure to copy the file over an "
20724
"encrypted connection such as <application>scp</application>, or on physical "
20725
"media."
20726
msgstr ""
20727
20728
#: serverguide/C/network-auth.xml:3868(command)
20729
msgid "sudo scp /etc/krb5kdc/.k5.EXAMPLE.COM steve@kdc02.example.com:~"
20730
msgstr ""
20731
20732
#: serverguide/C/network-auth.xml:3869(command)
20733
msgid "sudo mv .k5.EXAMPLE.COM /etc/krb5kdc/"
20734
msgstr ""
20735
20736
#: serverguide/C/network-auth.xml:3873(para)
20737
msgid ""
20738
"Again, replace <emphasis>EXAMPLE.COM</emphasis> with your actual realm."
20739
msgstr ""
20740
20741
#: serverguide/C/network-auth.xml:3881(para)
20742
msgid ""
20743
"Back on the <emphasis>Secondary KDC</emphasis>, (re)start the ldap server "
20744
"only,"
20745
msgstr ""
20746
20747
#: serverguide/C/network-auth.xml:3893(para)
20748
msgid "Finally, start the <application>krb5-kdc</application> daemon:"
20749
msgstr ""
20750
20751
#: serverguide/C/network-auth.xml:3904(para)
20752
msgid "Verify the two ldap servers (and kerberos by extension) are in sync."
20753
msgstr ""
20754
20755
#: serverguide/C/network-auth.xml:3911(para)
20756
msgid ""
20757
"You now have redundant KDCs on your network, and with redundant LDAP servers "
20758
"you should be able to continue to authenticate users if one LDAP server, one "
20759
"Kerberos server, or one LDAP and one Kerberos server become unavailable."
20760
msgstr ""
20761
20762
#: serverguide/C/network-auth.xml:3923(para)
20763
msgid ""
20764
"The <ulink url=\"http://web.mit.edu/Kerberos/krb5-1.6/krb5-1.6.3/doc/krb5-"
20765
"admin.html#Configuring-Kerberos-with-OpenLDAP-back_002dend\"> Kerberos Admin "
20766
"Guide</ulink> has some additional details."
20767
msgstr ""
20768
20769
#: serverguide/C/network-auth.xml:3929(para)
20770
msgid ""
20771
"For more information on <application>kdb5_ldap_util</application> see <ulink "
20772
"url=\"http://web.mit.edu/Kerberos/krb5-1.6/krb5-1.6.3/doc/krb5-"
20773
"admin.html#Global-Operations-on-the-Kerberos-LDAP-Database\"> Section "
20774
"5.6</ulink> and the <ulink "
20775
"url=\"http://manpages.ubuntu.com/manpages/xenial/en/man8/kdb5_ldap_util.8.htm"
20776
"l\">kdb5_ldap_util man page</ulink>."
20777
msgstr ""
20778
20779
#: serverguide/C/network-auth.xml:3937(para)
20780
msgid ""
20781
"Another useful link is the <ulink "
20782
"url=\"http://manpages.ubuntu.com/manpages/xenial/en/man5/krb5.conf.5.html\">k"
20783
"rb5.conf man page</ulink>."
20784
msgstr ""
20785
20786
#: serverguide/C/network-auth.xml:3942(para)
20787
msgid ""
20788
"Also, see the <ulink "
20789
"url=\"https://help.ubuntu.com/community/Kerberos#kerberos-ldap\">Kerberos "
20790
"and LDAP</ulink> Ubuntu wiki page."
20791
msgstr ""
20792
20793
#: serverguide/C/network-auth.xml:3951(title)
20794
msgid "SSSD and Active Directory"
20795
msgstr ""
20796
20797
#: serverguide/C/network-auth.xml:3952(para)
20798
msgid ""
20799
"This section describes the use of sssd to authenticate user logins against "
20800
"an Active Directory via using sssd's \"ad\" provider. In previous versions "
20801
"of sssd, it was possible to authenticate using the \"ldap\" provider. "
20802
"However, when authenticating against a Microsoft Windows AD Domain "
20803
"Controller, it was generally necessary to install the POSIX AD extensions on "
20804
"the Domain Controller. The \"ad\" provider simplifies the configuration and "
20805
"requires no modifications to the AD structure."
20806
msgstr ""
20807
20808
#: serverguide/C/network-auth.xml:3956(title)
20809
msgid "Prerequisites, Assumptions, and Requirements"
20810
msgstr ""
20811
20812
#: serverguide/C/network-auth.xml:3959(para)
20813
msgid ""
20814
"This guide does not explain Active Directory, how it works, how to set one "
20815
"up, or how to maintain it. It may not provide <quote>best practices</quote> "
20816
"for your environment."
20817
msgstr ""
20818
20819
#: serverguide/C/network-auth.xml:3961(para)
20820
msgid ""
20821
"This guide assumes that a working Active Directory domain is already "
20822
"configured."
20823
msgstr ""
20824
20825
#: serverguide/C/network-auth.xml:3963(para)
20826
msgid ""
20827
"The domain controller is acting as an authoritative DNS server for the "
20828
"domain."
20829
msgstr ""
20830
20831
#: serverguide/C/network-auth.xml:3965(para)
20832
msgid ""
20833
"The domain controller is the primary DNS resolver as specified in "
20834
"<filename>/etc/resolv.conf</filename>."
20835
msgstr ""
20836
20837
#: serverguide/C/network-auth.xml:3968(para)
20838
msgid ""
20839
"The appropriate <emphasis>_kerberos</emphasis>, <emphasis>_ldap</emphasis>, "
20840
"<emphasis>_kpasswd</emphasis>, etc. entries are configured in the DNS zone "
20841
"(see Resources section for external links)."
20842
msgstr ""
20843
20844
#: serverguide/C/network-auth.xml:3970(para)
20845
msgid ""
20846
"System time is synchronized on the domain controller (necessary for "
20847
"Kerberos)."
20848
msgstr ""
20849
20850
#: serverguide/C/network-auth.xml:3972(para)
20851
msgid ""
20852
"The domain used in this example is <emphasis>myubuntu.example.com</emphasis> "
20853
"."
20854
msgstr ""
20855
20856
#: serverguide/C/network-auth.xml:3977(para)
20857
msgid ""
20858
"The following packages are needed: <emphasis>krb5-user</emphasis>, "
20859
"<emphasis>samba</emphasis>, <emphasis>sssd</emphasis>, and "
20860
"<emphasis>ntp</emphasis>. Samba needs to be installed, even if the system is "
20861
"not exporting shares. The Kerberos realm and FQDN or IP of the domain "
20862
"controllers are needed for this step."
20863
msgstr ""
20864
20865
#: serverguide/C/network-auth.xml:3978(para)
20866
msgid "Install these packages now."
20867
msgstr ""
20868
20869
#: serverguide/C/network-auth.xml:3980(command)
20870
msgid "sudo apt install krb5-user samba sssd ntp"
20871
msgstr ""
20872
20873
#: serverguide/C/network-auth.xml:3981(para)
20874
msgid ""
20875
"See the next section for the answers to the questions asked by the "
20876
"<emphasis>krb5-user</emphasis> postinstall script."
20877
msgstr ""
20878
20879
#: serverguide/C/network-auth.xml:3984(title)
20880
msgid "Kerberos Configuration"
20881
msgstr ""
20882
20883
#: serverguide/C/network-auth.xml:3985(para)
20884
msgid ""
20885
"The installation of <emphasis>krb5-user</emphasis> will prompt for the realm "
20886
"name (in ALL UPPERCASE), the kdc server (i.e. domain controller) and admin "
20887
"server (also the domain controller in this example.) This will write the "
20888
"[realm] and [domain_realm] sections in <filename>/etc/krb5.conf</filename>. "
20889
"These sections may not be necessary if domain autodiscovery is working. If "
20890
"not, then both are needed."
20891
msgstr ""
20892
20893
#: serverguide/C/network-auth.xml:3986(para)
20894
msgid ""
20895
"If the domain is <emphasis>myubuntu.example.com</emphasis>, enter the realm "
20896
"as <emphasis>MYUBUNTU.EXAMPLE.COM</emphasis>"
20897
msgstr ""
20898
20899
#: serverguide/C/network-auth.xml:3989(para)
20900
msgid ""
20901
"Optionally, edit <emphasis>/etc/krb5.conf</emphasis> with a few additional "
20902
"settings to specify Kerberos ticket lifetime (these values are safe to use "
20903
"as defaults):"
20904
msgstr ""
20905
20906
#: serverguide/C/network-auth.xml:3990(programlisting)
20907
#, no-wrap
20908
msgid ""
20909
"\n"
20910
"[libdefaults]\n"
20911
"\n"
20912
"default_realm = MYUBUNTU.EXAMPLE.COM\n"
20913
"ticket_lifetime = 24h #\n"
20914
"renew_lifetime = 7d\n"
20915
"\t\t"
20916
msgstr ""
20917
20918
#: serverguide/C/network-auth.xml:3998(para)
20919
msgid ""
20920
"If default_realm is not specified, it may be necessary to log in with "
20921
"<quote>username@domain</quote> instead of <quote>username</quote>."
20922
msgstr ""
20923
20924
#: serverguide/C/network-auth.xml:4000(para)
20925
msgid ""
20926
"The system time on the Active Directory member needs to be consistent with "
20927
"that of the domain controller, or Kerberos authentication may fail. Ideally, "
20928
"the domain controller server itself will provide the NTP service. Edit "
20929
"<filename>/etc/ntp.conf</filename>:"
20930
msgstr ""
20931
20932
#: serverguide/C/network-auth.xml:4002(programlisting)
20933
#, no-wrap
20934
msgid ""
20935
"\n"
20936
"server dc.myubuntu.example.com\n"
20937
msgstr ""
20938
20939
#: serverguide/C/network-auth.xml:4009(para)
20940
msgid ""
20941
"Samba will be used to perform netbios/nmbd services related to Active "
20942
"Directory authentication, even if no file shares are exported. Edit the file "
20943
"/etc/samba/smb.conf and add the following to the "
20944
"<emphasis>[global]</emphasis> section:"
20945
msgstr ""
20946
20947
#: serverguide/C/network-auth.xml:4011(programlisting)
20948
#, no-wrap
20949
msgid ""
20950
"\n"
20951
"[global]\n"
20952
"\n"
20953
"workgroup = MYUBUNTU\n"
20954
"client signing = yes\n"
20955
"client use spnego = yes\n"
20956
"kerberos method = secrets and keytab\n"
20957
"realm = MYUBUNTU.EXAMPLE.COM\n"
20958
"security = ads\n"
20959
msgstr ""
20960
20961
#: serverguide/C/network-auth.xml:4022(para)
20962
msgid ""
20963
"Some guides specify that \"password server\" should be specified and pointed "
20964
"to the domain controller. This is only necessary if DNS is not properly set "
20965
"up to find the DC. By default, Samba will display a warning if \"password "
20966
"server\" is specified with \"security = ads\"."
20967
msgstr ""
20968
20969
#: serverguide/C/network-auth.xml:4027(title)
20970
msgid "SSSD Configuration"
20971
msgstr ""
20972
20973
#: serverguide/C/network-auth.xml:4029(para)
20974
msgid ""
20975
"There is no default/example config file for "
20976
"<filename>/etc/sssd/sssd.conf</filename> included in the sssd package. It is "
20977
"necessary to create one. This is a minimal working config file:"
20978
msgstr ""
20979
20980
#: serverguide/C/network-auth.xml:4031(programlisting)
20981
#, no-wrap
20982
msgid ""
20983
"\n"
20984
"[sssd]\n"
20985
"services = nss, pam\n"
20986
"config_file_version = 2\n"
20987
"domains = MYUBUNTU.EXAMPLE.COM\n"
20988
"\n"
20989
"[domain/MYUBUNTU.EXAMPLE.COM]\n"
20990
"id_provider = ad\n"
20991
"access_provider = ad\n"
20992
"\n"
20993
"# Use this if users are being logged in at /.\n"
20994
"# This example specifies /home/DOMAIN-FQDN/user as $HOME. Use with "
20995
"pam_mkhomedir.so\n"
20996
"override_homedir = /home/%d/%u\n"
20997
"\n"
20998
"# Uncomment if the client machine hostname doesn't match the computer object "
20999
"on the DC.\n"
21000
"# ad_hostname = mymachine.myubuntu.example.com\n"
21001
"\n"
21002
"# Uncomment if DNS SRV resolution is not working\n"
21003
"# ad_server = dc.mydomain.example.com\n"
21004
"\n"
21005
"# Uncomment if the AD domain is named differently than the Samba domain\n"
21006
"# ad_domain = MYUBUNTU.EXAMPLE.COM\n"
21007
"\n"
21008
"# Enumeration is discouraged for performance reasons.\n"
21009
"# enumerate = true\n"
21010
msgstr ""
21011
21012
#: serverguide/C/network-auth.xml:4058(para)
21013
msgid ""
21014
"After saving this file, set the ownership to root and the file permissions "
21015
"to 600:"
21016
msgstr ""
21017
21018
#: serverguide/C/network-auth.xml:4059(command)
21019
msgid "sudo chown root:root /etc/sssd/sssd.conf"
21020
msgstr ""
21021
21022
#: serverguide/C/network-auth.xml:4060(command)
21023
msgid "sudo chmod 600 /etc/sssd/sssd.conf"
21024
msgstr ""
21025
21026
#: serverguide/C/network-auth.xml:4062(para)
21027
msgid ""
21028
"If the ownership or permissions are not correct, sssd will refuse to start."
21029
msgstr ""
21030
21031
#: serverguide/C/network-auth.xml:4066(title)
21032
msgid "Verify nsswitch.conf Configuration"
21033
msgstr ""
21034
21035
#: serverguide/C/network-auth.xml:4067(para)
21036
msgid ""
21037
"The post-install script for the sssd package makes some modifications to "
21038
"/etc/nsswitch.conf automatically. It should look something like this:"
21039
msgstr ""
21040
21041
#: serverguide/C/network-auth.xml:4069(programlisting)
21042
#, no-wrap
21043
msgid ""
21044
"\n"
21045
"passwd: compat sss\n"
21046
"group: compat sss\n"
21047
"...\n"
21048
"netgroup: nis sss\n"
21049
"sudoers: files sss\n"
21050
msgstr ""
21051
21052
#: serverguide/C/network-auth.xml:4079(title)
21053
msgid "Modify /etc/hosts"
21054
msgstr ""
21055
21056
#: serverguide/C/network-auth.xml:4080(para)
21057
msgid ""
21058
"Add an alias to the localhost entry in /etc/hosts specifying the FQDN. For "
21059
"example:"
21060
msgstr ""
21061
21062
#: serverguide/C/network-auth.xml:4081(programlisting)
21063
#, no-wrap
21064
msgid "192.168.1.10 myserver myserver.myubuntu.example.com"
21065
msgstr ""
21066
21067
#: serverguide/C/network-auth.xml:4083(para)
21068
msgid "This is useful in conjunction with dynamic DNS updates."
21069
msgstr ""
21070
21071
#: serverguide/C/network-auth.xml:4087(title)
21072
msgid "Join the Active Directory"
21073
msgstr ""
21074
21075
#: serverguide/C/network-auth.xml:4088(para)
21076
msgid "Now, restart ntp and samba and start sssd."
21077
msgstr ""
21078
21079
#: serverguide/C/network-auth.xml:4089(command)
21080
msgid "sudo systemctl restart ntp.service"
21081
msgstr ""
21082
21083
#: serverguide/C/network-auth.xml:4091(command)
21084
msgid "sudo systemctl start sssd.service"
21085
msgstr ""
21086
21087
#: serverguide/C/network-auth.xml:4093(para)
21088
msgid "Test the configuration by obtaining a Kerberos ticket:"
21089
msgstr ""
21090
21091
#: serverguide/C/network-auth.xml:4095(command)
21092
msgid "sudo kinit Administrator"
21093
msgstr ""
21094
21095
#: serverguide/C/network-auth.xml:4097(para)
21096
msgid "Verify the ticket with:"
21097
msgstr ""
21098
21099
#: serverguide/C/network-auth.xml:4098(command)
21100
msgid "sudo klist"
21101
msgstr ""
21102
21103
#: serverguide/C/network-auth.xml:4100(para)
21104
msgid ""
21105
"If there is a ticket with an expiration date listed, then it is time to join "
21106
"the domain:"
21107
msgstr ""
21108
21109
#: serverguide/C/network-auth.xml:4102(command)
21110
msgid "sudo net ads join -k"
21111
msgstr ""
21112
21113
#: serverguide/C/network-auth.xml:4104(para)
21114
msgid ""
21115
"A warning about \"No DNS domain configured. Unable to perform DNS Update.\" "
21116
"probably means that there is no (correct) alias in "
21117
"<filename>/etc/hosts</filename>, and the system could not provide its own "
21118
"FQDN as part of the Active Directory update. This is needed for dynamic DNS "
21119
"updates. Verify the alias in <filename>/etc/hosts</filename> described in "
21120
"\"Modify /etc/hosts\" above."
21121
msgstr ""
21122
21123
#: serverguide/C/network-auth.xml:4106(para)
21124
msgid ""
21125
"(The message \"NT_STATUS_UNSUCCESSFUL\" indicates the domain join failed and "
21126
"something is incorrect. Review the prior steps before proceeding)."
21127
msgstr ""
21128
21129
#: serverguide/C/network-auth.xml:4108(para)
21130
msgid ""
21131
"Here are a couple of (optional) checks to verify that the domain join was "
21132
"successful. Note that if the domain was successfully joined but one or both "
21133
"of these steps fail, it may be necessary to wait 1-2 minutes and try again. "
21134
"Some of the changes appear to be asynchronous."
21135
msgstr ""
21136
21137
#: serverguide/C/network-auth.xml:4110(para)
21138
msgid "Verification option #1:"
21139
msgstr ""
21140
21141
#: serverguide/C/network-auth.xml:4111(para)
21142
msgid ""
21143
"Check the default Organizational Unit for computer accounts in the Active "
21144
"Directory to verify that the computer account was created. (Organizational "
21145
"Units in Active Directory is a topic outside the scope of this guide)."
21146
msgstr ""
21147
21148
#: serverguide/C/network-auth.xml:4113(para)
21149
msgid "Verification option #2"
21150
msgstr ""
21151
21152
#: serverguide/C/network-auth.xml:4114(para)
21153
msgid "Execute this command for a specific AD user (e.g. administrator)"
21154
msgstr ""
21155
21156
#: serverguide/C/network-auth.xml:4117(para)
21157
msgid ""
21158
"If <emphasis>enumerate = true</emphasis> is set in "
21159
"<filename>sssd.conf</filename>, <emphasis>getent passwd</emphasis> with no "
21160
"username argument will list all domain users. This may be useful for "
21161
"testing, but is slow and not recommended for production."
21162
msgstr ""
21163
21164
#: serverguide/C/network-auth.xml:4121(title)
21165
msgid "Test Authentication"
21166
msgstr ""
21167
21168
#: serverguide/C/network-auth.xml:4122(para)
21169
msgid ""
21170
"It should now be possible to authenticate using an Active Directory User's "
21171
"credentials:"
21172
msgstr ""
21173
21174
#: serverguide/C/network-auth.xml:4124(command)
21175
msgid "su - username"
21176
msgstr ""
21177
21178
#: serverguide/C/network-auth.xml:4126(para)
21179
msgid ""
21180
"If this works, then other login methods (getty, ssh) should also work."
21181
msgstr ""
21182
21183
#: serverguide/C/network-auth.xml:4128(para)
21184
msgid ""
21185
"If the computer account was created, indicating that the system was "
21186
"\"joined\" to the domain, but authentication is unsuccessful, it may be "
21187
"helpful to review <filename>/etc/pam.d</filename> and "
21188
"<filename>nssswitch.conf</filename> as well as the file changes described "
21189
"earlier in this guide."
21190
msgstr ""
21191
21192
#: serverguide/C/network-auth.xml:4132(title)
21193
msgid "Home directories with pam_mkhomedir (optional)"
21194
msgstr ""
21195
21196
#: serverguide/C/network-auth.xml:4133(para)
21197
msgid ""
21198
"When logging in using an Active Directory user account, it is likely that "
21199
"user has no home directory. This can be fixed with pam_mkdhomedir.so, which "
21200
"will create the user's home directory on login. Edit "
21201
"<filename>/etc/pam.d/common-session</filename>, and add this line directly "
21202
"after <emphasis>session required pam_unix.so:</emphasis>"
21203
msgstr ""
21204
21205
#: serverguide/C/network-auth.xml:4134(programlisting)
21206
#, no-wrap
21207
msgid ""
21208
"\n"
21209
"session required pam_mkhomedir.so skel=/etc/skel/ umask=0022\n"
21210
msgstr ""
21211
21212
#: serverguide/C/network-auth.xml:4138(para)
21213
msgid ""
21214
"This may also need <emphasis>override_homedir</emphasis> in "
21215
"<filename>sssd.conf</filename> to function correctly, so make sure that's "
21216
"set."
21217
msgstr ""
21218
21219
#: serverguide/C/network-auth.xml:4142(title)
21220
msgid "Desktop Ubuntu Authentication"
21221
msgstr ""
21222
21223
#: serverguide/C/network-auth.xml:4143(para)
21224
msgid ""
21225
"It is possible to also authenticate logins to Ubuntu Desktop using Active "
21226
"Directory accounts. The AD accounts will not show up in the pick list with "
21227
"local users, so lightdm will need to be modified. Edit the file "
21228
"<filename>/etc/lightdm/lightdm.conf.d/50-unity-greeter.conf</filename> and "
21229
"append the following two lines:"
21230
msgstr ""
21231
21232
#: serverguide/C/network-auth.xml:4145(programlisting)
21233
#, no-wrap
21234
msgid ""
21235
"\n"
21236
"greeter-show-manual-login=true\n"
21237
"greeter-hide-users=true\n"
21238
msgstr ""
21239
21240
#: serverguide/C/network-auth.xml:4150(para)
21241
msgid ""
21242
"Reboot to restart lightdm. It should now be possible to log in using a "
21243
"domain account using either <emphasis>username</emphasis> or "
21244
"<emphasis>username/username@domain</emphasis> format."
21245
msgstr ""
21246
21247
#: serverguide/C/network-auth.xml:4156(ulink)
21248
msgid "GitHub SSSD Project"
21249
msgstr ""
21250
21251
#: serverguide/C/network-auth.xml:4157(ulink)
21252
msgid "Active Directory DNS Zone Entries"
21253
msgstr ""
21254
21255
#: serverguide/C/network-auth.xml:4158(ulink)
21256
msgid "Kerberos config options"
21257
msgstr ""
21258
21259
#: serverguide/C/multipath-device-attributes-table.xml:2(title)
21260
msgid "Device Attributes"
21261
msgstr ""
21262
21263
#: serverguide/C/multipath-device-attributes-table.xml:8(entry) serverguide/C/multipath-config-defaults-table.xml:12(entry) serverguide/C/multipath-attributes-table.xml:8(entry)
21264
msgid "Attribute"
21265
msgstr ""
21266
21267
#: serverguide/C/multipath-device-attributes-table.xml:9(entry) serverguide/C/multipath-config-defaults-table.xml:14(entry) serverguide/C/multipath-components-table.xml:12(entry) serverguide/C/multipath-attributes-table.xml:9(entry) serverguide/C/dm-multipath.xml:1623(entry)
21268
msgid "Description"
21269
msgstr ""
21270
21271
#: serverguide/C/multipath-device-attributes-table.xml:15(emphasis)
21272
msgid "vendor"
21273
msgstr ""
21274
21275
#: serverguide/C/multipath-device-attributes-table.xml:17(emphasis)
21276
msgid "COMPAQ"
21277
msgstr ""
21278
21279
#: serverguide/C/multipath-device-attributes-table.xml:17(entry)
21280
msgid ""
21281
"Specifies the vendor name of the storage device to which the device "
21282
"attributes apply, for example <placeholder-1/>."
21283
msgstr ""
21284
21285
#: serverguide/C/multipath-device-attributes-table.xml:21(emphasis)
21286
msgid "product"
21287
msgstr ""
21288
21289
#: serverguide/C/multipath-device-attributes-table.xml:23(emphasis)
21290
msgid "HSV110 (C)COMPAQ"
21291
msgstr ""
21292
21293
#: serverguide/C/multipath-device-attributes-table.xml:23(entry)
21294
msgid ""
21295
"Specifies the product name of the storage device to which the device "
21296
"attributes apply, for example <placeholder-1/>."
21297
msgstr ""
21298
21299
#: serverguide/C/multipath-device-attributes-table.xml:27(emphasis)
21300
msgid "revision"
21301
msgstr ""
21302
21303
#: serverguide/C/multipath-device-attributes-table.xml:29(entry)
21304
msgid "Specifies the product revision identifier of the storage device."
21305
msgstr ""
21306
21307
#: serverguide/C/multipath-device-attributes-table.xml:33(emphasis)
21308
msgid "product_blacklist"
21309
msgstr ""
21310
21311
#: serverguide/C/multipath-device-attributes-table.xml:35(entry)
21312
msgid "Specifies a regular expression used to blacklist devices by product."
21313
msgstr ""
21314
21315
#: serverguide/C/multipath-device-attributes-table.xml:39(emphasis)
21316
msgid "hardware_handler"
21317
msgstr ""
21318
21319
#: serverguide/C/multipath-device-attributes-table.xml:41(para)
21320
msgid ""
21321
"Specifies a module that will be used to perform hardware specific actions "
21322
"when switching path groups or handling I/O errors. Possible values include:"
21323
msgstr ""
21324
21325
#: serverguide/C/multipath-device-attributes-table.xml:44(para)
21326
msgid ""
21327
"<emphasis role=\"bold\">1 emc</emphasis>: hardware handler for EMC storage "
21328
"arrays"
21329
msgstr ""
21330
21331
#: serverguide/C/multipath-device-attributes-table.xml:47(para)
21332
msgid ""
21333
"<emphasis role=\"bold\">1 alua</emphasis>: hardware handler for SCSI-3 ALUA "
21334
"arrays."
21335
msgstr ""
21336
21337
#: serverguide/C/multipath-device-attributes-table.xml:49(para)
21338
msgid ""
21339
"<emphasis role=\"bold\">1 hp_sw</emphasis>: hardware handler for Compaq/HP "
21340
"controllers."
21341
msgstr ""
21342
21343
#: serverguide/C/multipath-device-attributes-table.xml:53(para)
21344
msgid ""
21345
"<emphasis role=\"bold\">1 rdac</emphasis>: hardware handler for the "
21346
"LSI/Engenio RDAC controllers."
21347
msgstr ""
21348
21349
#: serverguide/C/multipath-config-defaults-table.xml:3(title)
21350
msgid "Multipath Configuration Defaults"
21351
msgstr ""
21352
21353
#: serverguide/C/multipath-config-defaults-table.xml:21(emphasis) serverguide/C/multipath-config-defaults-table.xml:26(emphasis)
21354
msgid "polling_interval"
21355
msgstr ""
21356
21357
#: serverguide/C/multipath-config-defaults-table.xml:27(emphasis)
21358
msgid "5"
21359
msgstr ""
21360
21361
#: serverguide/C/multipath-config-defaults-table.xml:24(entry)
21362
msgid ""
21363
"Specifies the interval between two path checks in seconds. For properly "
21364
"functioning paths, the interval between checks will gradually increase to (4 "
21365
"* <placeholder-1/>). The default value is <placeholder-2/>."
21366
msgstr ""
21367
21368
#: serverguide/C/multipath-config-defaults-table.xml:32(emphasis)
21369
msgid "udev_dir"
21370
msgstr ""
21371
21372
#: serverguide/C/multipath-config-defaults-table.xml:35(entry)
21373
msgid ""
21374
"The directory where udev device nodes are created. The default value is /dev."
21375
msgstr ""
21376
21377
#: serverguide/C/multipath-config-defaults-table.xml:41(emphasis)
21378
msgid "multipath_dir"
21379
msgstr ""
21380
21381
#: serverguide/C/multipath-config-defaults-table.xml:46(filename)
21382
msgid "/lib/multipath"
21383
msgstr ""
21384
21385
#: serverguide/C/multipath-config-defaults-table.xml:44(entry)
21386
msgid ""
21387
"The directory where the dynamic shared objects are stored. The default value "
21388
"is system dependent, commonly <placeholder-1/>."
21389
msgstr ""
21390
21391
#: serverguide/C/multipath-config-defaults-table.xml:51(emphasis)
21392
msgid "verbosity"
21393
msgstr ""
21394
21395
#: serverguide/C/multipath-config-defaults-table.xml:54(entry)
21396
msgid ""
21397
"The default verbosity. Higher values increase the verbosity level. Valid "
21398
"levels are between 0 and 6. The default value is 2."
21399
msgstr ""
21400
21401
#: serverguide/C/multipath-config-defaults-table.xml:61(emphasis) serverguide/C/multipath-config-defaults-table.xml:323(emphasis) serverguide/C/dm-multipath.xml:1049(parameter) serverguide/C/dm-multipath.xml:1204(parameter)
21402
msgid "path_selector"
21403
msgstr ""
21404
21405
#: serverguide/C/multipath-config-defaults-table.xml:65(para)
21406
msgid ""
21407
"Specifies the default algorithm to use in determining what path to use for "
21408
"the next I/O operation. Possible values include:"
21409
msgstr ""
21410
21411
#: serverguide/C/multipath-config-defaults-table.xml:71(para)
21412
msgid ""
21413
"<emphasis role=\"bold\">round-robin 0</emphasis>: Loop through every path in "
21414
"the path group, sending the same amount of I/O to each."
21415
msgstr ""
21416
21417
#: serverguide/C/multipath-config-defaults-table.xml:77(para)
21418
msgid ""
21419
"<emphasis role=\"bold\">queue-length 0</emphasis>: Send the next bunch of "
21420
"I/O down the path with the least number of outstanding I/O requests."
21421
msgstr ""
21422
21423
#: serverguide/C/multipath-config-defaults-table.xml:83(para)
21424
msgid ""
21425
"<emphasis role=\"bold\">service-time 0</emphasis>: Send the next bunch of "
21426
"I/O down the path with the shortest estimated service time, which is "
21427
"determined by dividing the total size of the outstanding I/O to each path by "
21428
"its relative throughput."
21429
msgstr ""
21430
21431
#: serverguide/C/multipath-config-defaults-table.xml:91(para)
21432
msgid ""
21433
"The default value is <emphasis role=\"bold\">round-robin 0</emphasis>."
21434
msgstr ""
21435
21436
#: serverguide/C/multipath-config-defaults-table.xml:98(emphasis) serverguide/C/dm-multipath.xml:1044(parameter) serverguide/C/dm-multipath.xml:1194(parameter)
21437
msgid "path_grouping_policy"
21438
msgstr ""
21439
21440
#: serverguide/C/multipath-config-defaults-table.xml:102(para)
21441
msgid ""
21442
"Specifies the default path grouping policy to apply to unspecified "
21443
"multipaths. Possible values include:"
21444
msgstr ""
21445
21446
#: serverguide/C/multipath-config-defaults-table.xml:107(para)
21447
msgid ""
21448
"<emphasis role=\"bold\">failover</emphasis> = 1 path per priority group"
21449
msgstr ""
21450
21451
#: serverguide/C/multipath-config-defaults-table.xml:112(para)
21452
msgid ""
21453
"<emphasis role=\"bold\">multibus</emphasis> = all valid paths in 1 priority "
21454
"group"
21455
msgstr ""
21456
21457
#: serverguide/C/multipath-config-defaults-table.xml:117(para)
21458
msgid ""
21459
"<emphasis role=\"bold\">group_by_serial</emphasis> = 1 priority group per "
21460
"detected serial number"
21461
msgstr ""
21462
21463
#: serverguide/C/multipath-config-defaults-table.xml:122(para)
21464
msgid ""
21465
"<emphasis role=\"bold\">group_by_prio</emphasis> = 1 priority group per path "
21466
"priority value"
21467
msgstr ""
21468
21469
#: serverguide/C/multipath-config-defaults-table.xml:127(para)
21470
msgid ""
21471
"<emphasis role=\"bold\">group_by_node_name</emphasis> = 1 priority group per "
21472
"target node name."
21473
msgstr ""
21474
21475
#: serverguide/C/multipath-config-defaults-table.xml:132(para)
21476
msgid "The default value is <emphasis role=\"bold\">failover.</emphasis>"
21477
msgstr ""
21478
21479
#: serverguide/C/multipath-config-defaults-table.xml:139(emphasis) serverguide/C/dm-multipath.xml:1199(parameter)
21480
msgid "getuid_callout"
21481
msgstr ""
21482
21483
#: serverguide/C/multipath-config-defaults-table.xml:144(para)
21484
msgid ""
21485
"The default value is <emphasis role=\"bold\">/lib/udev/scsi_id --whitelisted "
21486
"--device=/dev/%n.</emphasis>"
21487
msgstr ""
21488
21489
#: serverguide/C/multipath-config-defaults-table.xml:142(entry)
21490
msgid ""
21491
"Specifies the default program and arguments to call out to obtain a unique "
21492
"path identifier. An absolute path is required. <placeholder-1/>"
21493
msgstr ""
21494
21495
#: serverguide/C/multipath-config-defaults-table.xml:150(emphasis) serverguide/C/dm-multipath.xml:1058(parameter) serverguide/C/dm-multipath.xml:1223(parameter)
21496
msgid "prio"
21497
msgstr ""
21498
21499
#: serverguide/C/multipath-config-defaults-table.xml:154(para)
21500
msgid ""
21501
"Specifies the default function to call to obtain a path priority value. For "
21502
"example, the ALUA bits in SPC-3 provide an exploitable prio value. Possible "
21503
"values include:"
21504
msgstr ""
21505
21506
#: serverguide/C/multipath-config-defaults-table.xml:160(para)
21507
msgid ""
21508
"<emphasis role=\"bold\">const</emphasis>: Set a priority of 1 to all paths."
21509
msgstr ""
21510
21511
#: serverguide/C/multipath-config-defaults-table.xml:165(para)
21512
msgid ""
21513
"<emphasis role=\"bold\">emc</emphasis>: Generate the path priority for EMC "
21514
"arrays."
21515
msgstr ""
21516
21517
#: serverguide/C/multipath-config-defaults-table.xml:170(para)
21518
msgid ""
21519
"<emphasis role=\"bold\">alua</emphasis>: Generate the path priority based on "
21520
"the SCSI-3 ALUA settings."
21521
msgstr ""
21522
21523
#: serverguide/C/multipath-config-defaults-table.xml:175(para)
21524
msgid ""
21525
"<emphasis role=\"bold\">netapp</emphasis>: Generate the path priority for "
21526
"NetApp arrays."
21527
msgstr ""
21528
21529
#: serverguide/C/multipath-config-defaults-table.xml:180(para)
21530
msgid ""
21531
"<emphasis role=\"bold\">rdac</emphasis>: Generate the path priority for "
21532
"LSI/Engenio RDAC controller."
21533
msgstr ""
21534
21535
#: serverguide/C/multipath-config-defaults-table.xml:185(para)
21536
msgid ""
21537
"<emphasis role=\"bold\">hp_sw</emphasis>: Generate the path priority for "
21538
"Compaq/HP controller in active/standby mode."
21539
msgstr ""
21540
21541
#: serverguide/C/multipath-config-defaults-table.xml:190(para)
21542
msgid ""
21543
"<emphasis role=\"bold\">hds</emphasis>: Generate the path priority for "
21544
"Hitachi HDS Modular storage arrays."
21545
msgstr ""
21546
21547
#: serverguide/C/multipath-config-defaults-table.xml:195(para)
21548
msgid "The default value is <emphasis role=\"bold\">const</emphasis>."
21549
msgstr ""
21550
21551
#: serverguide/C/multipath-config-defaults-table.xml:202(emphasis) serverguide/C/dm-multipath.xml:1063(parameter) serverguide/C/dm-multipath.xml:1228(parameter)
21552
msgid "prio_args"
21553
msgstr ""
21554
21555
#: serverguide/C/multipath-config-defaults-table.xml:206(para)
21556
msgid ""
21557
"The arguments string passed to the prio function Most prio functions do not "
21558
"need arguments. The datacore prioritizer need one. Example, <emphasis "
21559
"role=\"bold\">\"timeout=1000 preferredsds=foo\"</emphasis>. The default "
21560
"value is (null) <emphasis role=\"bold\">\"\"</emphasis>."
21561
msgstr ""
21562
21563
#: serverguide/C/multipath-config-defaults-table.xml:216(emphasis) serverguide/C/dm-multipath.xml:1214(parameter)
21564
msgid "features"
21565
msgstr ""
21566
21567
#: serverguide/C/multipath-config-defaults-table.xml:220(emphasis)
21568
msgid "queue_if_no_path"
21569
msgstr ""
21570
21571
#: serverguide/C/multipath-config-defaults-table.xml:221(emphasis) serverguide/C/multipath-config-defaults-table.xml:334(emphasis) serverguide/C/dm-multipath.xml:1068(parameter) serverguide/C/dm-multipath.xml:1233(parameter)
21572
msgid "no_path_retry"
21573
msgstr ""
21574
21575
#: serverguide/C/multipath-config-defaults-table.xml:222(emphasis) serverguide/C/multipath-config-defaults-table.xml:341(emphasis)
21576
msgid "queue"
21577
msgstr ""
21578
21579
#: serverguide/C/multipath-config-defaults-table.xml:223(link)
21580
msgid "\"Issues with queue_if_no_path feature\""
21581
msgstr ""
21582
21583
#: serverguide/C/multipath-config-defaults-table.xml:219(entry)
21584
msgid ""
21585
"The extra features of multipath devices. The only existing feature is "
21586
"<placeholder-1/>, which is the same as setting <placeholder-2/> to "
21587
"<placeholder-3/>. For information on issues that may arise when using this "
21588
"feature, see Section, <placeholder-4/>."
21589
msgstr ""
21590
21591
#: serverguide/C/multipath-config-defaults-table.xml:228(emphasis) serverguide/C/dm-multipath.xml:1209(parameter)
21592
msgid "path_checker"
21593
msgstr ""
21594
21595
#: serverguide/C/multipath-config-defaults-table.xml:232(para)
21596
msgid ""
21597
"Specifies the default method used to determine the state of the paths. "
21598
"Possible values include:"
21599
msgstr ""
21600
21601
#: serverguide/C/multipath-config-defaults-table.xml:237(para)
21602
msgid ""
21603
"<emphasis role=\"bold\">readsector0</emphasis>: Read the first sector of the "
21604
"device."
21605
msgstr ""
21606
21607
#: serverguide/C/multipath-config-defaults-table.xml:242(para)
21608
msgid ""
21609
"<emphasis role=\"bold\">tur</emphasis>: Issue a TEST UNIT READY to the "
21610
"device."
21611
msgstr ""
21612
21613
#: serverguide/C/multipath-config-defaults-table.xml:247(para)
21614
msgid ""
21615
"<emphasis role=\"bold\">emc_clariion</emphasis>: Query the EMC Clariion "
21616
"specific EVPD page 0xC0 to determine the path."
21617
msgstr ""
21618
21619
#: serverguide/C/multipath-config-defaults-table.xml:253(para)
21620
msgid ""
21621
"<emphasis role=\"bold\">hp_sw</emphasis>: Check the path state for HP "
21622
"storage arrays with Active/Standby firmware."
21623
msgstr ""
21624
21625
#: serverguide/C/multipath-config-defaults-table.xml:258(para)
21626
msgid ""
21627
"<emphasis role=\"bold\">rdac</emphasis>: Check the path status for "
21628
"LSI/Engenio RDAC storage controller."
21629
msgstr ""
21630
21631
#: serverguide/C/multipath-config-defaults-table.xml:263(para)
21632
msgid ""
21633
"<emphasis role=\"bold\">directio</emphasis>: Read the first sector with "
21634
"direct I/O."
21635
msgstr ""
21636
21637
#: serverguide/C/multipath-config-defaults-table.xml:268(para)
21638
msgid "The default value is <emphasis role=\"bold\">directio</emphasis>."
21639
msgstr ""
21640
21641
#: serverguide/C/multipath-config-defaults-table.xml:275(emphasis) serverguide/C/dm-multipath.xml:1054(parameter) serverguide/C/dm-multipath.xml:1219(parameter)
21642
msgid "failback"
21643
msgstr ""
21644
21645
#: serverguide/C/multipath-config-defaults-table.xml:279(para)
21646
msgid "Manages path group failback."
21647
msgstr ""
21648
21649
#: serverguide/C/multipath-config-defaults-table.xml:283(para)
21650
msgid ""
21651
"A value of <emphasis role=\"bold\">immediate</emphasis> specifies immediate "
21652
"failback to the highest priority path group that contains active paths."
21653
msgstr ""
21654
21655
#: serverguide/C/multipath-config-defaults-table.xml:289(para)
21656
msgid ""
21657
"A value of <emphasis role=\"bold\">manual</emphasis> specifies that there "
21658
"should not be immediate failback but that failback can happen only with "
21659
"operator intervention."
21660
msgstr ""
21661
21662
#: serverguide/C/multipath-config-defaults-table.xml:295(para)
21663
msgid ""
21664
"A numeric value greater than zero specifies deferred failback, expressed in "
21665
"seconds."
21666
msgstr ""
21667
21668
#: serverguide/C/multipath-config-defaults-table.xml:300(para)
21669
msgid "The default value is <emphasis role=\"bold\">manual</emphasis>."
21670
msgstr ""
21671
21672
#: serverguide/C/multipath-config-defaults-table.xml:307(emphasis) serverguide/C/multipath-config-defaults-table.xml:321(emphasis) serverguide/C/multipath-config-defaults-table.xml:325(emphasis) serverguide/C/dm-multipath.xml:1073(parameter) serverguide/C/dm-multipath.xml:1238(parameter)
21673
msgid "rr_min_io"
21674
msgstr ""
21675
21676
#: serverguide/C/multipath-config-defaults-table.xml:311(para)
21677
msgid "The default value is <literal>1000</literal>."
21678
msgstr ""
21679
21680
#: serverguide/C/multipath-config-defaults-table.xml:310(entry)
21681
msgid ""
21682
"Specifies the number of I/O requests to route to a path before switching to "
21683
"the next path in the current path group.<placeholder-1/>"
21684
msgstr ""
21685
21686
#: serverguide/C/multipath-config-defaults-table.xml:317(emphasis) serverguide/C/dm-multipath.xml:1078(parameter) serverguide/C/dm-multipath.xml:1243(parameter)
21687
msgid "rr_weight"
21688
msgstr ""
21689
21690
#: serverguide/C/multipath-config-defaults-table.xml:320(emphasis)
21691
msgid "priorities"
21692
msgstr ""
21693
21694
#: serverguide/C/multipath-config-defaults-table.xml:327(emphasis)
21695
msgid "uniform"
21696
msgstr ""
21697
21698
#: serverguide/C/multipath-config-defaults-table.xml:327(para)
21699
msgid "The default value is <emphasis role=\"bold\">uniform</emphasis>."
21700
msgstr ""
21701
21702
#: serverguide/C/multipath-config-defaults-table.xml:320(entry)
21703
msgid ""
21704
"If set to <placeholder-1/>, then instead of sending <placeholder-2/> "
21705
"requests to a path before calling <placeholder-3/> to choose the next path, "
21706
"the number of requests to send is determined by <placeholder-4/> times the "
21707
"path's priority, as determined by the prio function. If set to <placeholder-"
21708
"5/>, all path weights are equal. <placeholder-6/>"
21709
msgstr ""
21710
21711
#: serverguide/C/multipath-config-defaults-table.xml:340(emphasis)
21712
msgid "immediate"
21713
msgstr ""
21714
21715
#: serverguide/C/multipath-config-defaults-table.xml:342(para)
21716
msgid "The default value is <literal>0</literal>."
21717
msgstr ""
21718
21719
#: serverguide/C/multipath-config-defaults-table.xml:337(entry)
21720
msgid ""
21721
"A numeric value for this attribute specifies the number of times the system "
21722
"should attempt to use a failed path before disabling queueing. A value of "
21723
"fail indicates <placeholder-1/> failure, without queueing. A value of "
21724
"<placeholder-2/> indicates that queueing should not stop until the path is "
21725
"fixed. <placeholder-3/>"
21726
msgstr ""
21727
21728
#: serverguide/C/multipath-config-defaults-table.xml:348(emphasis) serverguide/C/multipath-attributes-table.xml:30(emphasis)
21729
msgid "user_friendly_names"
21730
msgstr ""
21731
21732
#: serverguide/C/multipath-config-defaults-table.xml:352(filename)
21733
msgid "/etc/multipath/bindings"
21734
msgstr ""
21735
21736
#: serverguide/C/multipath-config-defaults-table.xml:353(emphasis) serverguide/C/multipath-config-defaults-table.xml:356(emphasis) serverguide/C/multipath-attributes-table.xml:25(emphasis)
21737
msgid "alias"
21738
msgstr ""
21739
21740
#: serverguide/C/multipath-config-defaults-table.xml:354(emphasis) serverguide/C/multipath-config-defaults-table.xml:357(emphasis) serverguide/C/multipath-config-defaults-table.xml:379(emphasis) serverguide/C/multipath-config-defaults-table.xml:391(emphasis) serverguide/C/multipath-components-table.xml:31(emphasis) serverguide/C/multipath-components-table.xml:44(emphasis) serverguide/C/multipath-attributes-table.xml:18(emphasis) serverguide/C/multipath-attributes-table.xml:19(emphasis) serverguide/C/multipath-attributes-table.xml:28(emphasis) serverguide/C/multipath-attributes-table.xml:29(emphasis) serverguide/C/dm-multipath.xml:764(emphasis)
21741
msgid "multipath"
21742
msgstr ""
21743
21744
#: serverguide/C/multipath-config-defaults-table.xml:359(para) serverguide/C/multipath-config-defaults-table.xml:381(para)
21745
msgid "The default value is <emphasis role=\"bold\">no</emphasis>."
21746
msgstr ""
21747
21748
#: serverguide/C/multipath-config-defaults-table.xml:351(entry)
21749
msgid ""
21750
"If set to yes, specifies that the system should use the <placeholder-1/> "
21751
"file to assign a persistent and unique <placeholder-2/> to the <placeholder-"
21752
"3/>, in the form of mpathn. If set to no, specifies that the system should "
21753
"use the WWID as the <placeholder-4/> for the <placeholder-5/>. In either "
21754
"case, what is specified here will be overridden by any device-specific "
21755
"aliases you specify in the multipaths section of the configuration file. "
21756
"<placeholder-6/>"
21757
msgstr ""
21758
21759
#: serverguide/C/multipath-config-defaults-table.xml:365(emphasis)
21760
msgid "queue_without_daemon"
21761
msgstr ""
21762
21763
#: serverguide/C/multipath-config-defaults-table.xml:368(emphasis) serverguide/C/multipath-config-defaults-table.xml:392(emphasis)
21764
msgid "multipathd"
21765
msgstr ""
21766
21767
#: serverguide/C/multipath-config-defaults-table.xml:370(para)
21768
msgid "The default value is <emphasis role=\"bold\">yes</emphasis>."
21769
msgstr ""
21770
21771
#: serverguide/C/multipath-config-defaults-table.xml:368(entry)
21772
msgid ""
21773
"If set to no, the <placeholder-1/> daemon will disable queueing for all "
21774
"devices when it is shut down. <placeholder-2/>"
21775
msgstr ""
21776
21777
#: serverguide/C/multipath-config-defaults-table.xml:376(emphasis) serverguide/C/dm-multipath.xml:1083(parameter) serverguide/C/dm-multipath.xml:1258(parameter)
21778
msgid "flush_on_last_del"
21779
msgstr ""
21780
21781
#: serverguide/C/multipath-config-defaults-table.xml:379(entry)
21782
msgid ""
21783
"If set to yes, then <placeholder-1/> will disable queueing when the last "
21784
"path to a device has been deleted. <placeholder-2/>"
21785
msgstr ""
21786
21787
#: serverguide/C/multipath-config-defaults-table.xml:387(emphasis)
21788
msgid "max_fds"
21789
msgstr ""
21790
21791
#: serverguide/C/multipath-config-defaults-table.xml:394(filename)
21792
msgid "/proc/sys/fs/nr_open"
21793
msgstr ""
21794
21795
#: serverguide/C/multipath-config-defaults-table.xml:390(entry)
21796
msgid ""
21797
"Sets the maximum number of open file descriptors that can be opened by "
21798
"<placeholder-1/> and the <placeholder-2/> daemon. This is equivalent to the "
21799
"ulimit -n command. A value of max will set this to the system limit from "
21800
"<placeholder-3/>. If this is not set, the maximum number of open file "
21801
"descriptors is taken from the calling process; it is usually 1024. To be "
21802
"safe, this should be set to the maximum number of paths plus 32, if that "
21803
"number is greater than 1024."
21804
msgstr ""
21805
21806
#: serverguide/C/multipath-config-defaults-table.xml:402(emphasis)
21807
msgid "checker_timer"
21808
msgstr ""
21809
21810
#: serverguide/C/multipath-config-defaults-table.xml:406(para)
21811
msgid ""
21812
"The default value is taken from "
21813
"<filename>/sys/block/sdx/device/timeout</filename>, which is "
21814
"<literal>30</literal> seconds as of 12.04 LTS"
21815
msgstr ""
21816
21817
#: serverguide/C/multipath-config-defaults-table.xml:405(entry)
21818
msgid ""
21819
"The timeout to use for path checkers that issue SCSI commands with an "
21820
"explicit timeout, in seconds. <placeholder-1/>"
21821
msgstr ""
21822
21823
#: serverguide/C/multipath-config-defaults-table.xml:413(emphasis) serverguide/C/dm-multipath.xml:1248(parameter)
21824
msgid "fast_io_fail_tmo"
21825
msgstr ""
21826
21827
#: serverguide/C/multipath-config-defaults-table.xml:419(para)
21828
msgid "The default value is determined by the OS."
21829
msgstr ""
21830
21831
#: serverguide/C/multipath-config-defaults-table.xml:416(entry)
21832
msgid ""
21833
"The number of seconds the SCSI layer will wait after a problem has been "
21834
"detected on an FC remote port before failing I/O to devices on that remote "
21835
"port. This value should be smaller than the value of dev_loss_tmo. Setting "
21836
"this to off will disable the timeout. <placeholder-1/>"
21837
msgstr ""
21838
21839
#: serverguide/C/multipath-config-defaults-table.xml:425(emphasis) serverguide/C/dm-multipath.xml:1253(parameter)
21840
msgid "dev_loss_tmo"
21841
msgstr ""
21842
21843
#: serverguide/C/multipath-config-defaults-table.xml:428(entry)
21844
msgid ""
21845
"The number of seconds the SCSI layer will wait after a problem has been "
21846
"detected on an FC remote port before removing it from the system. Setting "
21847
"this to infinity will set this to 2147483647 seconds, or 68 years. The "
21848
"default value is determined by the OS."
21849
msgstr ""
21850
21851
#: serverguide/C/multipath-components-table.xml:3(title)
21852
msgid "DM-Multipath Components"
21853
msgstr ""
21854
21855
#: serverguide/C/multipath-components-table.xml:11(entry)
21856
msgid "Component"
21857
msgstr ""
21858
21859
#: serverguide/C/multipath-components-table.xml:19(emphasis)
21860
msgid "dm_multipath kernel module"
21861
msgstr ""
21862
21863
#: serverguide/C/multipath-components-table.xml:23(emphasis)
21864
msgid "failover"
21865
msgstr ""
21866
21867
#: serverguide/C/multipath-components-table.xml:22(entry)
21868
msgid "Reroutes I/O and supports <placeholder-1/> for paths and path groups."
21869
msgstr ""
21870
21871
#: serverguide/C/multipath-components-table.xml:28(emphasis)
21872
msgid "multipath command"
21873
msgstr ""
21874
21875
#: serverguide/C/multipath-components-table.xml:32(filename)
21876
msgid "/etc/rc.sysinit"
21877
msgstr ""
21878
21879
#: serverguide/C/multipath-components-table.xml:31(entry)
21880
msgid ""
21881
"Lists and configures <placeholder-1/> devices. Normally started up with "
21882
"<placeholder-2/>, it can also be started up by a udev program whenever a "
21883
"block device is added or it can be run by the initramfs file system."
21884
msgstr ""
21885
21886
#: serverguide/C/multipath-components-table.xml:39(emphasis)
21887
msgid "multipathd daemon"
21888
msgstr ""
21889
21890
#: serverguide/C/multipath-components-table.xml:45(filename)
21891
msgid "/etc/multipath.conf"
21892
msgstr ""
21893
21894
#: serverguide/C/multipath-components-table.xml:42(entry)
21895
msgid ""
21896
"Monitors paths; as paths fail and come back, it may initiate path group "
21897
"switches. Provides for interactive changes to <placeholder-1/> devices. This "
21898
"daemon must be restarted for any changes to the <placeholder-2/> file to "
21899
"take effect."
21900
msgstr ""
21901
21902
#: serverguide/C/multipath-components-table.xml:50(emphasis)
21903
msgid "kpartx command"
21904
msgstr ""
21905
21906
#: serverguide/C/multipath-components-table.xml:56(emphasis)
21907
msgid "multipath-tools"
21908
msgstr ""
21909
21910
#: serverguide/C/multipath-components-table.xml:53(entry)
21911
msgid ""
21912
"Creates device mapper devices for the partitions on a device It is necessary "
21913
"to use this command for DOS-based partitions with DM-Multipath. The kpartx "
21914
"is provided in its own package, but the <placeholder-1/> package depends on "
21915
"it."
21916
msgstr ""
21917
21918
#: serverguide/C/multipath-attributes-table.xml:2(title)
21919
msgid "Multipath Attributes"
21920
msgstr ""
21921
21922
#: serverguide/C/multipath-attributes-table.xml:15(emphasis)
21923
msgid "wwid"
21924
msgstr ""
21925
21926
#: serverguide/C/multipath-attributes-table.xml:21(filename)
21927
msgid "multipath.conf"
21928
msgstr ""
21929
21930
#: serverguide/C/multipath-attributes-table.xml:17(entry)
21931
msgid ""
21932
"Specifies the WWID of the <placeholder-1/> device to which the <placeholder-"
21933
"2/> attributes apply. This parameter is mandatory for this section of the "
21934
"<placeholder-3/> file."
21935
msgstr ""
21936
21937
#: serverguide/C/multipath-attributes-table.xml:27(entry)
21938
msgid ""
21939
"Specifies the symbolic name for the <placeholder-1/> device to which the "
21940
"<placeholder-2/> attributes apply. If you are using <placeholder-3/>, do not "
21941
"set this value to mpathn; this may conflict with an automatically assigned "
21942
"user friendly name and give you incorrect device node names."
21943
msgstr ""
21944
21945
#: serverguide/C/monitoring.xml:11(title)
21946
msgid "Monitoring"
21947
msgstr ""
21948
21949
#: serverguide/C/monitoring.xml:15(para)
21950
msgid ""
21951
"The monitoring of essential servers and services is an important part of "
21952
"system administration. Most network services are monitored for performance, "
21953
"availability, or both. This section will cover installation and "
21954
"configuration of <application>Nagios</application> for availability "
21955
"monitoring, and <application>Munin</application> for performance monitoring."
21956
msgstr ""
21957
21958
#: serverguide/C/monitoring.xml:22(para)
21959
msgid ""
21960
"The examples in this section will use two servers with hostnames "
21961
"<emphasis>server01</emphasis> and <emphasis>server02</emphasis>. "
21962
"<emphasis>Server01</emphasis> will be configured with "
21963
"<application>Nagios</application> to monitor services on itself and "
21964
"<emphasis>server02</emphasis>. Server01 will also be setup with the "
21965
"<application>munin</application> package to gather information from the "
21966
"network. Using the <application>munin-node</application> package, "
21967
"<emphasis>server02</emphasis> will be configured to send information to "
21968
"<emphasis>server01</emphasis>."
21969
msgstr ""
21970
21971
#: serverguide/C/monitoring.xml:31(para)
21972
msgid ""
21973
"Hopefully these simple examples will allow you to monitor additional servers "
21974
"and services on your network."
21975
msgstr ""
21976
21977
#: serverguide/C/monitoring.xml:37(title)
21978
msgid "Nagios"
21979
msgstr ""
21980
21981
#: serverguide/C/monitoring.xml:42(para)
21982
msgid ""
21983
"First, on <emphasis>server01</emphasis> install the "
21984
"<application>nagios</application> package. In a terminal enter:"
21985
msgstr ""
21986
21987
#: serverguide/C/monitoring.xml:48(command)
21988
msgid "sudo apt install nagios3 nagios-nrpe-plugin"
21989
msgstr ""
21990
21991
#: serverguide/C/monitoring.xml:51(para)
21992
msgid ""
21993
"You will be asked to enter a password for the "
21994
"<emphasis>nagiosadmin</emphasis> user. The user's credentials are stored in "
21995
"<filename>/etc/nagios3/htpasswd.users</filename>. To change the "
21996
"<emphasis>nagiosadmin</emphasis> password, or add additional users to the "
21997
"Nagios CGI scripts, use the <application>htpasswd</application> that is part "
21998
"of the <application>apache2-utils</application> package."
21999
msgstr ""
22000
22001
#: serverguide/C/monitoring.xml:58(para)
22002
msgid ""
22003
"For example, to change the password for the <emphasis>nagiosadmin</emphasis> "
22004
"user enter:"
22005
msgstr ""
22006
22007
#: serverguide/C/monitoring.xml:63(command)
22008
msgid "sudo htpasswd /etc/nagios3/htpasswd.users nagiosadmin"
22009
msgstr ""
22010
22011
#: serverguide/C/monitoring.xml:66(para)
22012
msgid "To add a user:"
22013
msgstr ""
22014
22015
#: serverguide/C/monitoring.xml:71(command)
22016
msgid "sudo htpasswd /etc/nagios3/htpasswd.users steve"
22017
msgstr ""
22018
22019
#: serverguide/C/monitoring.xml:74(para)
22020
msgid ""
22021
"Next, on <emphasis>server02</emphasis> install the <application>nagios-nrpe-"
22022
"server</application> package. From a terminal on server02 enter:"
22023
msgstr ""
22024
22025
#: serverguide/C/monitoring.xml:80(command)
22026
msgid "sudo apt install nagios-nrpe-server"
22027
msgstr ""
22028
22029
#: serverguide/C/monitoring.xml:84(para)
22030
msgid ""
22031
"<application>NRPE</application> allows you to execute local checks on remote "
22032
"hosts. There are other ways of accomplishing this through other Nagios "
22033
"plugins as well as other checks."
22034
msgstr ""
22035
22036
#: serverguide/C/monitoring.xml:92(title)
22037
msgid "Configuration Overview"
22038
msgstr ""
22039
22040
#: serverguide/C/monitoring.xml:94(para)
22041
msgid ""
22042
"There are a couple of directories containing "
22043
"<application>Nagios</application> configuration and check files."
22044
msgstr ""
22045
22046
#: serverguide/C/monitoring.xml:100(para)
22047
msgid ""
22048
"<filename>/etc/nagios3</filename>: contains configuration files for the "
22049
"operation of the <application>nagios</application> daemon, CGI files, hosts, "
22050
"etc."
22051
msgstr ""
22052
22053
#: serverguide/C/monitoring.xml:106(para)
22054
msgid ""
22055
"<filename>/etc/nagios-plugins</filename>: houses configuration files for the "
22056
"service checks."
22057
msgstr ""
22058
22059
#: serverguide/C/monitoring.xml:111(para)
22060
msgid ""
22061
"<filename>/etc/nagios</filename>: on the remote host contains the "
22062
"<application>nagios-nrpe-server</application> configuration files."
22063
msgstr ""
22064
22065
#: serverguide/C/monitoring.xml:116(para)
22066
msgid ""
22067
"<filename>/usr/lib/nagios/plugins/</filename>: where the check binaries are "
22068
"stored. To see the options of a check use the <emphasis>-h</emphasis> option."
22069
msgstr ""
22070
22071
#: serverguide/C/monitoring.xml:121(para)
22072
msgid "For example: <command>/usr/lib/nagios/plugins/check_dhcp -h</command>"
22073
msgstr ""
22074
22075
#: serverguide/C/monitoring.xml:127(para)
22076
msgid ""
22077
"There are a plethora of checks <application>Nagios</application> can be "
22078
"configured to execute for any given host. For this example Nagios will be "
22079
"configured to check disk space, DNS, and a MySQL hostgroup. The DNS check "
22080
"will be on <emphasis>server02</emphasis>, and the MySQL hostgroup will "
22081
"include both <emphasis>server01</emphasis> and <emphasis>server02</emphasis>."
22082
msgstr ""
22083
22084
#: serverguide/C/monitoring.xml:134(para)
22085
msgid ""
22086
"See <xref linkend=\"httpd\"/> for details on setting up Apache, <xref "
22087
"linkend=\"dns\"/> for DNS, and <xref linkend=\"mysql\"/> for MySQL."
22088
msgstr ""
22089
22090
#: serverguide/C/monitoring.xml:139(para)
22091
msgid ""
22092
"Additionally, there are some terms that once explained will hopefully make "
22093
"understanding Nagios configuration easier:"
22094
msgstr ""
22095
22096
#: serverguide/C/monitoring.xml:145(para)
22097
msgid ""
22098
"<emphasis>Host</emphasis>: a server, workstation, network device, etc that "
22099
"is being monitored."
22100
msgstr ""
22101
22102
#: serverguide/C/monitoring.xml:150(para)
22103
msgid ""
22104
"<emphasis>Host Group</emphasis>: a group of similar hosts. For example, you "
22105
"could group all web servers, file server, etc."
22106
msgstr ""
22107
22108
#: serverguide/C/monitoring.xml:155(para)
22109
msgid ""
22110
"<emphasis>Service</emphasis>: the service being monitored on the host. Such "
22111
"as HTTP, DNS, NFS, etc."
22112
msgstr ""
22113
22114
#: serverguide/C/monitoring.xml:160(para)
22115
msgid ""
22116
"<emphasis>Service Group</emphasis>: allows you to group multiple services "
22117
"together. This is useful for grouping multiple HTTP for example."
22118
msgstr ""
22119
22120
#: serverguide/C/monitoring.xml:166(para)
22121
msgid ""
22122
"<emphasis>Contact</emphasis>: person to be notified when an event takes "
22123
"place. Nagios can be configured to send emails, SMS messages, etc."
22124
msgstr ""
22125
22126
#: serverguide/C/monitoring.xml:172(para)
22127
msgid ""
22128
"By default Nagios is configured to check HTTP, disk space, SSH, current "
22129
"users, processes, and load on the <emphasis>localhost</emphasis>. Nagios "
22130
"will also <application>ping</application> check the "
22131
"<emphasis>gateway</emphasis>."
22132
msgstr ""
22133
22134
#: serverguide/C/monitoring.xml:177(para)
22135
msgid ""
22136
"Large Nagios installations can be quite complex to configure. It is usually "
22137
"best to start small, one or two hosts, get things configured the way you "
22138
"like then expand."
22139
msgstr ""
22140
22141
#: serverguide/C/monitoring.xml:192(para)
22142
msgid ""
22143
"First, create a <emphasis>host</emphasis> configuration file for "
22144
"<emphasis>server02</emphasis>. Unless otherwise specified, run all these "
22145
"commands on <emphasis>server01</emphasis>. In a terminal enter:"
22146
msgstr ""
22147
22148
#: serverguide/C/monitoring.xml:199(command)
22149
msgid ""
22150
"sudo cp /etc/nagios3/conf.d/localhost_nagios2.cfg \\ "
22151
"/etc/nagios3/conf.d/server02.cfg"
22152
msgstr ""
22153
22154
#: serverguide/C/monitoring.xml:204(para)
22155
msgid ""
22156
"In the above and following command examples, replace "
22157
"<emphasis>\"server01\"</emphasis>, "
22158
"<emphasis>\"server02\"</emphasis><emphasis>172.18.100.100</emphasis>, and "
22159
"<emphasis>172.18.100.101</emphasis> with the host names and IP addresses of "
22160
"your servers."
22161
msgstr ""
22162
22163
#: serverguide/C/monitoring.xml:213(para)
22164
msgid "Next, edit <filename>/etc/nagios3/conf.d/server02.cfg</filename>:"
22165
msgstr ""
22166
22167
#: serverguide/C/monitoring.xml:217(programlisting)
22168
#, no-wrap
22169
msgid ""
22170
"\n"
22171
"define host{\n"
22172
" use generic-host ; Name of host template to "
22173
"use\n"
22174
" host_name server02\n"
22175
" alias Server 02\n"
22176
" address 172.18.100.101\n"
22177
"}\n"
22178
"\n"
22179
"# check DNS service.\n"
22180
"define service {\n"
22181
" use generic-service\n"
22182
" host_name server02\n"
22183
" service_description DNS\n"
22184
" check_command check_dns!172.18.100.101\n"
22185
"}\n"
22186
msgstr ""
22187
22188
#: serverguide/C/monitoring.xml:237(para)
22189
msgid ""
22190
"Restart the <application>nagios</application> daemon to enable the new "
22191
"configuration:"
22192
msgstr ""
22193
22194
#: serverguide/C/monitoring.xml:242(command)
22195
msgid "sudo systemctl restart nagio3.service"
22196
msgstr ""
22197
22198
#: serverguide/C/monitoring.xml:252(para)
22199
msgid ""
22200
"Now add a service definition for the MySQL check by adding the following to "
22201
"<filename>/etc/nagios3/conf.d/services_nagios2.cfg</filename>:"
22202
msgstr ""
22203
22204
#: serverguide/C/monitoring.xml:256(programlisting)
22205
#, no-wrap
22206
msgid ""
22207
"\n"
22208
"# check MySQL servers.\n"
22209
"define service {\n"
22210
" hostgroup_name mysql-servers\n"
22211
" service_description MySQL\n"
22212
" check_command "
22213
"check_mysql_cmdlinecred!nagios!secret!$HOSTADDRESS\n"
22214
" use generic-service\n"
22215
" notification_interval 0 ; set > 0 if you want to be renotified\n"
22216
"}\n"
22217
msgstr ""
22218
22219
#: serverguide/C/monitoring.xml:270(para)
22220
msgid ""
22221
"A <emphasis>mysql-servers</emphasis> hostgroup now needs to be defined. Edit "
22222
"<filename>/etc/nagios3/conf.d/hostgroups_nagios2.cfg</filename> adding:"
22223
msgstr ""
22224
22225
#: serverguide/C/monitoring.xml:275(programlisting)
22226
#, no-wrap
22227
msgid ""
22228
"\n"
22229
"# MySQL hostgroup.\n"
22230
"define hostgroup {\n"
22231
" hostgroup_name mysql-servers\n"
22232
" alias MySQL servers\n"
22233
" members localhost, server02\n"
22234
" }\n"
22235
msgstr ""
22236
22237
#: serverguide/C/monitoring.xml:287(para)
22238
msgid ""
22239
"The Nagios check needs to authenticate to MySQL. To add a "
22240
"<emphasis>nagios</emphasis> user to MySQL enter:"
22241
msgstr ""
22242
22243
#: serverguide/C/monitoring.xml:292(command)
22244
msgid "mysql -u root -p -e \"create user nagios identified by 'secret';\""
22245
msgstr ""
22246
22247
#: serverguide/C/monitoring.xml:296(para)
22248
msgid ""
22249
"The <emphasis>nagios</emphasis> user will need to be added all hosts in the "
22250
"<emphasis>mysql-servers</emphasis> hostgroup."
22251
msgstr ""
22252
22253
#: serverguide/C/monitoring.xml:304(para)
22254
msgid ""
22255
"Restart <application>nagios</application> to start checking the MySQL "
22256
"servers."
22257
msgstr ""
22258
22259
#: serverguide/C/monitoring.xml:309(command) serverguide/C/monitoring.xml:376(command)
22260
msgid "sudo systemctl restart nagios3.service"
22261
msgstr ""
22262
22263
#: serverguide/C/monitoring.xml:319(para)
22264
msgid ""
22265
"Lastly configure NRPE to check the disk space on "
22266
"<emphasis>server02</emphasis>."
22267
msgstr ""
22268
22269
#: serverguide/C/monitoring.xml:323(para)
22270
msgid ""
22271
"On <emphasis>server01</emphasis> add the service check to "
22272
"<filename>/etc/nagios3/conf.d/server02.cfg</filename>:"
22273
msgstr ""
22274
22275
#: serverguide/C/monitoring.xml:328(programlisting)
22276
#, no-wrap
22277
msgid ""
22278
"\n"
22279
"# NRPE disk check.\n"
22280
"define service {\n"
22281
" use generic-service\n"
22282
" host_name server02\n"
22283
" service_description nrpe-disk\n"
22284
" check_command "
22285
"check_nrpe_1arg!check_all_disks!172.18.100.101\n"
22286
"}\n"
22287
msgstr ""
22288
22289
#: serverguide/C/monitoring.xml:341(para)
22290
msgid ""
22291
"Now on <emphasis>server02</emphasis> edit "
22292
"<filename>/etc/nagios/nrpe.cfg</filename> changing:"
22293
msgstr ""
22294
22295
#: serverguide/C/monitoring.xml:345(programlisting)
22296
#, no-wrap
22297
msgid ""
22298
"\n"
22299
"allowed_hosts=172.18.100.100\n"
22300
msgstr ""
22301
22302
#: serverguide/C/monitoring.xml:349(para)
22303
msgid "And below in the command definition area add:"
22304
msgstr ""
22305
22306
#: serverguide/C/monitoring.xml:353(programlisting)
22307
#, no-wrap
22308
msgid ""
22309
"\n"
22310
"command[check_all_disks]=/usr/lib/nagios/plugins/check_disk -w 20% -c 10% -"
22311
"e\n"
22312
msgstr ""
22313
22314
#: serverguide/C/monitoring.xml:360(para)
22315
msgid "Finally, restart <application>nagios-nrpe-server</application>:"
22316
msgstr ""
22317
22318
#: serverguide/C/monitoring.xml:365(command)
22319
msgid "sudo systemctl restart nagios-nrpe-server.service"
22320
msgstr ""
22321
22322
#: serverguide/C/monitoring.xml:371(para)
22323
msgid ""
22324
"Also, on <emphasis>server01</emphasis> restart "
22325
"<application>nagios</application>:"
22326
msgstr ""
22327
22328
#: serverguide/C/monitoring.xml:384(para)
22329
msgid ""
22330
"You should now be able to see the host and service checks in the Nagios CGI "
22331
"files. To access them point a browser to http://server01/nagios3. You will "
22332
"then be prompted for the <emphasis>nagiosadmin</emphasis> username and "
22333
"password."
22334
msgstr ""
22335
22336
#: serverguide/C/monitoring.xml:394(para)
22337
msgid ""
22338
"This section has just scratched the surface of Nagios' features. The "
22339
"<application>nagios-plugins-extra</application> and <application>nagios-snmp-"
22340
"plugins</application> contain many more service checks."
22341
msgstr ""
22342
22343
#: serverguide/C/monitoring.xml:401(para)
22344
msgid ""
22345
"For more information see <ulink "
22346
"url=\"http://www.nagios.org/\">Nagios</ulink> website."
22347
msgstr ""
22348
22349
#: serverguide/C/monitoring.xml:406(para)
22350
msgid ""
22351
"Specifically the <ulink "
22352
"url=\"http://nagios.sourceforge.net/docs/3_0/\">Online Documentation</ulink> "
22353
"site."
22354
msgstr ""
22355
22356
#: serverguide/C/monitoring.xml:411(para)
22357
msgid ""
22358
"There is also a list of <ulink "
22359
"url=\"http://www.nagios.org/propaganda/books/\">books</ulink> related to "
22360
"Nagios and network monitoring:"
22361
msgstr ""
22362
22363
#: serverguide/C/monitoring.xml:417(para)
22364
msgid ""
22365
"The <ulink url=\"https://help.ubuntu.com/community/Nagios3\">Nagios Ubuntu "
22366
"Wiki</ulink> page also has more details."
22367
msgstr ""
22368
22369
#: serverguide/C/monitoring.xml:426(title)
22370
msgid "Munin"
22371
msgstr ""
22372
22373
#: serverguide/C/monitoring.xml:431(para)
22374
msgid ""
22375
"Before installing <application>Munin</application> on "
22376
"<emphasis>server01</emphasis><application>apache2</application> will need to "
22377
"be installed. The default configuration is fine for running a "
22378
"<application>munin</application> server. For more information see <xref "
22379
"linkend=\"httpd\"/>."
22380
msgstr ""
22381
22382
#: serverguide/C/monitoring.xml:437(para)
22383
msgid ""
22384
"First, on <emphasis>server01</emphasis> install "
22385
"<application>munin</application>. In a terminal enter:"
22386
msgstr ""
22387
22388
#: serverguide/C/monitoring.xml:442(command)
22389
msgid "sudo apt install munin"
22390
msgstr ""
22391
22392
#: serverguide/C/monitoring.xml:445(para)
22393
msgid ""
22394
"Now on <emphasis>server02</emphasis> install the <application>munin-"
22395
"node</application> package:"
22396
msgstr ""
22397
22398
#: serverguide/C/monitoring.xml:450(command)
22399
msgid "sudo apt install munin-node"
22400
msgstr ""
22401
22402
#: serverguide/C/monitoring.xml:457(para)
22403
msgid ""
22404
"On <emphasis>server01</emphasis> edit the "
22405
"<filename>/etc/munin/munin.conf</filename> adding the IP address for "
22406
"<emphasis>server02</emphasis>:"
22407
msgstr ""
22408
22409
#: serverguide/C/monitoring.xml:462(programlisting)
22410
#, no-wrap
22411
msgid ""
22412
"\n"
22413
"## First our \"normal\" host.\n"
22414
"[server02]\n"
22415
" address 172.18.100.101\n"
22416
msgstr ""
22417
22418
#: serverguide/C/monitoring.xml:469(para)
22419
msgid ""
22420
"Replace <emphasis>server02</emphasis> and "
22421
"<emphasis>172.18.100.101</emphasis> with the actual hostname and IP address "
22422
"for your server."
22423
msgstr ""
22424
22425
#: serverguide/C/monitoring.xml:475(para)
22426
msgid ""
22427
"Next, configure <application>munin-node</application> on "
22428
"<emphasis>server02</emphasis>. Edit <filename>/etc/munin/munin-"
22429
"node.conf</filename> to allow access by <emphasis>server01</emphasis>:"
22430
msgstr ""
22431
22432
#: serverguide/C/monitoring.xml:480(programlisting)
22433
#, no-wrap
22434
msgid ""
22435
"\n"
22436
"allow ^172\\.18\\.100\\.100$\n"
22437
msgstr ""
22438
22439
#: serverguide/C/monitoring.xml:485(para)
22440
msgid ""
22441
"Replace <emphasis>^172\\.18\\.100\\.100$</emphasis> with IP address for your "
22442
"<application>munin</application> server."
22443
msgstr ""
22444
22445
#: serverguide/C/monitoring.xml:490(para)
22446
msgid ""
22447
"Now restart <application>munin-node</application> on "
22448
"<emphasis>server02</emphasis> for the changes to take effect:"
22449
msgstr ""
22450
22451
#: serverguide/C/monitoring.xml:495(command)
22452
msgid "sudo systemctl restart munini-node.service"
22453
msgstr ""
22454
22455
#: serverguide/C/monitoring.xml:498(para)
22456
msgid ""
22457
"Finally, in a browser go to <emphasis>http://server01/munin</emphasis>, and "
22458
"you should see links to nice graphs displaying information from the standard "
22459
"<emphasis>munin-plugins</emphasis> for disk, network, processes, and system."
22460
msgstr ""
22461
22462
#: serverguide/C/monitoring.xml:504(para)
22463
msgid ""
22464
"Since this is a new install it may take some time for the graphs to display "
22465
"anything useful."
22466
msgstr ""
22467
22468
#: serverguide/C/monitoring.xml:511(title)
22469
msgid "Additional Plugins"
22470
msgstr ""
22471
22472
#: serverguide/C/monitoring.xml:513(para)
22473
msgid ""
22474
"The <application>munin-plugins-extra</application> package contains "
22475
"performance checks additional services such as DNS, DHCP, Samba, etc. To "
22476
"install the package, from a terminal enter:"
22477
msgstr ""
22478
22479
#: serverguide/C/monitoring.xml:519(command)
22480
msgid "sudo apt install munin-plugins-extra"
22481
msgstr ""
22482
22483
#: serverguide/C/monitoring.xml:522(para)
22484
msgid "Be sure to install the package on both the server and node machines."
22485
msgstr ""
22486
22487
#: serverguide/C/monitoring.xml:532(para)
22488
msgid ""
22489
"See the <ulink url=\"http://munin-monitoring.org/\">Munin</ulink> website "
22490
"for more details."
22491
msgstr ""
22492
22493
#: serverguide/C/monitoring.xml:537(para)
22494
msgid ""
22495
"Specifically the <ulink "
22496
"url=\"https://munin.readthedocs.io/en/latest/\">Munin Documentation</ulink> "
22497
"page includes information on additional plugins, writing plugins, etc."
22498
msgstr ""
22499
22500
#: serverguide/C/mail.xml:11(title)
22501
msgid "Email Services"
22502
msgstr "Layanan Imel"
22503
22504
#: serverguide/C/mail.xml:12(para)
22505
msgid ""
22506
"The process of getting an email from one person to another over a network or "
22507
"the Internet involves many systems working together. Each of these systems "
22508
"must be correctly configured for the process to work. The sender uses a "
22509
"<emphasis>Mail User Agent</emphasis> (MUA), or email client, to send the "
22510
"message through one or more <emphasis>Mail Transfer Agents</emphasis> (MTA), "
22511
"the last of which will hand it off to a <emphasis>Mail Delivery "
22512
"Agent</emphasis> (MDA) for delivery to the recipient's mailbox, from which "
22513
"it will be retrieved by the recipient's email client, usually via a POP3 or "
22514
"IMAP server."
22515
msgstr ""
22516
22517
#: serverguide/C/mail.xml:22(title) serverguide/C/mail.xml:896(application) serverguide/C/mail.xml:928(title) serverguide/C/mail.xml:1006(title) serverguide/C/mail.xml:1577(title)
22518
msgid "Postfix"
22519
msgstr "Postfix"
22520
22521
#: serverguide/C/mail.xml:23(para)
22522
msgid ""
22523
"<application>Postfix</application> is the default Mail Transfer Agent (MTA) "
22524
"in Ubuntu. It attempts to be fast and easy to administer and secure. It is "
22525
"compatible with the MTA <application>sendmail</application>. This section "
22526
"explains how to install and configure <application>postfix</application>. It "
22527
"also explains how to set it up as an SMTP server using a secure connection "
22528
"(for sending emails securely)."
22529
msgstr ""
22530
22531
#: serverguide/C/mail.xml:32(para)
22532
msgid ""
22533
"This guide does not cover setting up Postfix <emphasis>Virtual "
22534
"Domains</emphasis>, for information on Virtual Domains and other advanced "
22535
"configurations see <xref linkend=\"postfix-references\"/>."
22536
msgstr ""
22537
22538
#: serverguide/C/mail.xml:39(para)
22539
msgid ""
22540
"To install <application>postfix</application> run the following command:"
22541
msgstr ""
22542
22543
#: serverguide/C/mail.xml:45(para)
22544
msgid ""
22545
"Simply press return when the installation process asks questions, the "
22546
"configuration will be done in greater detail in the next stage."
22547
msgstr ""
22548
22549
#: serverguide/C/mail.xml:50(title)
22550
msgid "Basic Configuration"
22551
msgstr "Konfigurasi Dasar"
22552
22553
#: serverguide/C/mail.xml:51(para)
22554
msgid ""
22555
"To configure <application>postfix</application>, run the following command:"
22556
msgstr ""
22557
22558
#: serverguide/C/mail.xml:55(command)
22559
msgid "sudo dpkg-reconfigure postfix"
22560
msgstr ""
22561
22562
#: serverguide/C/mail.xml:61(para)
22563
msgid "Internet Site"
22564
msgstr "Situs Internet"
22565
22566
#: serverguide/C/mail.xml:62(para)
22567
msgid "mail.example.com"
22568
msgstr "mail.contoh.com"
22569
22570
#: serverguide/C/mail.xml:63(para)
22571
msgid "steve"
22572
msgstr ""
22573
22574
#: serverguide/C/mail.xml:64(para)
22575
msgid "mail.example.com, localhost.localdomain, localhost"
22576
msgstr "mail.contoh.com, localhost.localdomain, localhost"
22577
22578
#: serverguide/C/mail.xml:65(para)
22579
msgid "No"
22580
msgstr "No"
22581
22582
#: serverguide/C/mail.xml:66(para)
22583
msgid "127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.0.0/24"
22584
msgstr ""
22585
22586
#: serverguide/C/mail.xml:67(para)
22587
msgid "0"
22588
msgstr "0"
22589
22590
#: serverguide/C/mail.xml:68(para)
22591
msgid "+"
22592
msgstr "+"
22593
22594
#: serverguide/C/mail.xml:69(para)
22595
msgid "all"
22596
msgstr "all"
22597
22598
#: serverguide/C/mail.xml:57(para)
22599
msgid ""
22600
"The user interface will be displayed. On each screen, select the following "
22601
"values: <placeholder-1/>"
22602
msgstr ""
22603
22604
#: serverguide/C/mail.xml:73(para)
22605
msgid ""
22606
"Replace mail.example.com with the domain for which you'll accept email, "
22607
"192.168.0.0/24 with the actual network and class range of your mail server, "
22608
"and steve with the appropriate username."
22609
msgstr ""
22610
22611
#: serverguide/C/mail.xml:79(para)
22612
msgid ""
22613
"Now is a good time to decide which mailbox format you want to use. By "
22614
"default Postfix will use <emphasis role=\"strong\">mbox</emphasis> for the "
22615
"mailbox format. Rather than editing the configuration file directly, you can "
22616
"use the <command>postconf</command> command to configure all "
22617
"<application>postfix</application> parameters. The configuration parameters "
22618
"will be stored in <filename>/etc/postfix/main.cf</filename> file. Later if "
22619
"you wish to re-configure a particular parameter, you can either run the "
22620
"command or change it manually in the file."
22621
msgstr ""
22622
22623
#: serverguide/C/mail.xml:90(para)
22624
msgid ""
22625
"To configure the mailbox format for <emphasis "
22626
"role=\"strong\">Maildir:</emphasis>"
22627
msgstr ""
22628
22629
#: serverguide/C/mail.xml:95(command)
22630
msgid "sudo postconf -e 'home_mailbox = Maildir/'"
22631
msgstr "sudo postconf -e 'home_mailbox = Maildir/'"
22632
22633
#: serverguide/C/mail.xml:98(para)
22634
msgid ""
22635
"This will place new mail in /home/<emphasis "
22636
"role=\"italic\">username</emphasis>/Maildir so you will need to configure "
22637
"your Mail Delivery Agent (MDA) to use the same path."
22638
msgstr ""
22639
22640
#: serverguide/C/mail.xml:106(title) serverguide/C/mail.xml:608(title)
22641
msgid "SMTP Authentication"
22642
msgstr "Autentifikasi SMTP"
22643
22644
#: serverguide/C/mail.xml:108(para)
22645
msgid ""
22646
"SMTP-AUTH allows a client to identify itself through an authentication "
22647
"mechanism (SASL). Transport Layer Security (TLS) should be used to encrypt "
22648
"the authentication process. Once authenticated the SMTP server will allow "
22649
"the client to relay mail."
22650
msgstr ""
22651
22652
#: serverguide/C/mail.xml:115(para)
22653
msgid "Configure Postfix for SMTP-AUTH using SASL (Dovecot SASL):"
22654
msgstr ""
22655
22656
#: serverguide/C/mail.xml:118(screen)
22657
#, no-wrap
22658
msgid ""
22659
"\n"
22660
"sudo postconf -e 'smtpd_sasl_type = dovecot'\n"
22661
"sudo postconf -e 'smtpd_sasl_path = private/auth'\n"
22662
"sudo postconf -e 'smtpd_sasl_local_domain ='\n"
22663
"sudo postconf -e 'smtpd_sasl_security_options = noanonymous'\n"
22664
"sudo postconf -e 'broken_sasl_auth_clients = yes'\n"
22665
"sudo postconf -e 'smtpd_sasl_auth_enable = yes'\n"
22666
"sudo postconf -e 'smtpd_recipient_restrictions = \\\n"
22667
"permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination'\n"
22668
msgstr ""
22669
22670
#: serverguide/C/mail.xml:129(para)
22671
msgid ""
22672
"The <emphasis>smtpd_sasl_path</emphasis> configuration is a path relative to "
22673
"the Postfix queue directory."
22674
msgstr ""
22675
22676
#: serverguide/C/mail.xml:135(para)
22677
msgid ""
22678
"Next, generate or obtain a digital certificate for TLS. See <xref "
22679
"linkend=\"certificates-and-security\"/> for details. This example also uses "
22680
"a Certificate Authority (CA). For information on generating a CA certificate "
22681
"see <xref linkend=\"certificate-authority\"/>."
22682
msgstr ""
22683
22684
#: serverguide/C/mail.xml:141(para)
22685
msgid ""
22686
"MUAs connecting to your mail server via TLS will need to recognize the "
22687
"certificate used for TLS. This can either be done using a certificate from a "
22688
"commercial CA or with a self-signed certificate that users manually "
22689
"install/accept. For MTA to MTA TLS certficates are never validated without "
22690
"advance agreement from the affected organizations. For MTA to MTA TLS, "
22691
"unless local policy requires it, there is no reason not to use a self-signed "
22692
"certificate. Refer to <xref linkend=\"creating-a-self-signed-certificate\"/> "
22693
"for more details."
22694
msgstr ""
22695
22696
#: serverguide/C/mail.xml:151(para)
22697
msgid ""
22698
"Once you have a certificate, configure Postfix to provide TLS encryption for "
22699
"both incoming and outgoing mail:"
22700
msgstr ""
22701
22702
#: serverguide/C/mail.xml:154(screen)
22703
#, no-wrap
22704
msgid ""
22705
"\n"
22706
"sudo postconf -e 'smtp_tls_security_level = may'\n"
22707
"sudo postconf -e 'smtpd_tls_security_level = may'\n"
22708
"sudo postconf -e 'smtp_tls_note_starttls_offer = yes'\n"
22709
"sudo postconf -e 'smtpd_tls_key_file = /etc/ssl/private/server.key'\n"
22710
"sudo postconf -e 'smtpd_tls_cert_file = /etc/ssl/certs/server.crt'\n"
22711
"sudo postconf -e 'smtpd_tls_loglevel = 1'\n"
22712
"sudo postconf -e 'smtpd_tls_received_header = yes'\n"
22713
"sudo postconf -e 'myhostname = mail.example.com'\n"
22714
msgstr ""
22715
22716
#: serverguide/C/mail.xml:166(para)
22717
msgid ""
22718
"If you are using your own <emphasis>Certificate Authority</emphasis> to sign "
22719
"the certificate enter:"
22720
msgstr ""
22721
22722
#: serverguide/C/mail.xml:170(command)
22723
msgid "sudo postconf -e 'smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem'"
22724
msgstr ""
22725
22726
#: serverguide/C/mail.xml:173(para)
22727
msgid ""
22728
"Again, for more details about certificates see <xref linkend=\"certificates-"
22729
"and-security\"/>."
22730
msgstr ""
22731
22732
#: serverguide/C/mail.xml:179(para)
22733
msgid ""
22734
"After running all the commands, <application>Postfix</application> is "
22735
"configured for SMTP-AUTH and a self-signed certificate has been created for "
22736
"TLS encryption."
22737
msgstr ""
22738
22739
#: serverguide/C/mail.xml:184(para)
22740
msgid ""
22741
"Now, the file <filename>/etc/postfix/main.cf</filename> should look like "
22742
"this:"
22743
msgstr ""
22744
22745
#: serverguide/C/mail.xml:187(programlisting)
22746
#, no-wrap
22747
msgid ""
22748
"\n"
22749
"# See /usr/share/postfix/main.cf.dist for a commented, more complete\n"
22750
"# version\n"
22751
"\n"
22752
"smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)\n"
22753
"biff = no\n"
22754
"\n"
22755
"# appending .domain is the MUA's job.\n"
22756
"append_dot_mydomain = no\n"
22757
"\n"
22758
"# Uncomment the next line to generate \"delayed mail\" warnings\n"
22759
"#delay_warning_time = 4h\n"
22760
"\n"
22761
"myhostname = server1.example.com\n"
22762
"alias_maps = hash:/etc/aliases\n"
22763
"alias_database = hash:/etc/aliases\n"
22764
"myorigin = /etc/mailname\n"
22765
"mydestination = server1.example.com, localhost.example.com, localhost\n"
22766
"relayhost =\n"
22767
"mynetworks = 127.0.0.0/8\n"
22768
"mailbox_command = procmail -a \"$EXTENSION\"\n"
22769
"mailbox_size_limit = 0\n"
22770
"recipient_delimiter = +\n"
22771
"inet_interfaces = all\n"
22772
"smtpd_sasl_local_domain =\n"
22773
"smtpd_sasl_auth_enable = yes\n"
22774
"smtpd_sasl_security_options = noanonymous\n"
22775
"broken_sasl_auth_clients = yes\n"
22776
"smtpd_recipient_restrictions =\n"
22777
"permit_sasl_authenticated,permit_mynetworks,reject _unauth_destination\n"
22778
"smtpd_tls_auth_only = no\n"
22779
"smtp_tls_security_level = may\n"
22780
"smtpd_tls_security_level = may\n"
22781
"smtp_tls_note_starttls_offer = yes\n"
22782
"smtpd_tls_key_file = /etc/ssl/private/smtpd.key\n"
22783
"smtpd_tls_cert_file = /etc/ssl/certs/smtpd.crt\n"
22784
"smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem\n"
22785
"smtpd_tls_loglevel = 1\n"
22786
"smtpd_tls_received_header = yes\n"
22787
"smtpd_tls_session_cache_timeout = 3600s\n"
22788
"tls_random_source = dev:/dev/urandom\n"
22789
msgstr ""
22790
22791
#: serverguide/C/mail.xml:229(para)
22792
msgid ""
22793
"The postfix initial configuration is complete. Run the following command to "
22794
"restart the postfix daemon:"
22795
msgstr ""
22796
22797
#: serverguide/C/mail.xml:235(command) serverguide/C/mail.xml:354(command) serverguide/C/mail.xml:417(command) serverguide/C/mail.xml:1046(command) serverguide/C/mail.xml:1628(command)
22798
msgid "sudo systemctl restart postfix.service"
22799
msgstr ""
22800
22801
#: serverguide/C/mail.xml:238(para)
22802
msgid ""
22803
"<application>Postfix</application> supports SMTP-AUTH as defined in <ulink "
22804
"url=\"http://www.ietf.org/rfc/rfc2554.txt\">RFC2554</ulink>. It is based on "
22805
"<ulink url=\"http://www.ietf.org/rfc/rfc2222.txt\">SASL</ulink>. However it "
22806
"is still necessary to set up SASL authentication before you can use SMTP-"
22807
"AUTH."
22808
msgstr ""
22809
22810
#: serverguide/C/mail.xml:248(title) serverguide/C/mail.xml:672(title)
22811
msgid "Configuring SASL"
22812
msgstr "Mengkonfigurasi SASL"
22813
22814
#: serverguide/C/mail.xml:249(para)
22815
msgid ""
22816
"Postfix supports two SASL implementations Cyrus SASL and Dovecot SASL. To "
22817
"enable Dovecot SASL the <application>dovecot-core</application> package will "
22818
"need to be installed. From a terminal prompt enter the following:"
22819
msgstr ""
22820
22821
#: serverguide/C/mail.xml:255(command)
22822
msgid "sudo apt install dovecot-core"
22823
msgstr ""
22824
22825
#: serverguide/C/mail.xml:257(para)
22826
msgid ""
22827
"Next you will need to edit <filename>/etc/dovecot/conf.d/10-"
22828
"master.conf</filename>. Change the following:"
22829
msgstr ""
22830
22831
#: serverguide/C/mail.xml:260(programlisting)
22832
#, no-wrap
22833
msgid ""
22834
"\n"
22835
"service auth {\n"
22836
" # auth_socket_path points to this userdb socket by default. It's "
22837
"typically\n"
22838
" # used by dovecot-lda, doveadm, possibly imap process, etc. Its default\n"
22839
" # permissions make it readable only by root, but you may need to relax "
22840
"these\n"
22841
" # permissions. Users that have access to this socket are able to get a "
22842
"list\n"
22843
" # of all usernames and get results of everyone's userdb lookups.\n"
22844
" unix_listener auth-userdb {\n"
22845
" #mode = 0600\n"
22846
" #user = \n"
22847
" #group = \n"
22848
" }\n"
22849
"\n"
22850
" # Postfix smtp-auth\n"
22851
" unix_listener /var/spool/postfix/private/auth {\n"
22852
" mode = 0660\n"
22853
" user = postfix\n"
22854
" group = postfix\n"
22855
" }\n"
22856
msgstr ""
22857
22858
#: serverguide/C/mail.xml:281(para)
22859
msgid ""
22860
"In order to let <application>Outlook</application> clients use SMTP-AUTH, in "
22861
"the <emphasis>authentication mechanisms</emphasis> section of "
22862
"/etc/dovecot/conf.d/10-auth.conf change this line:"
22863
msgstr ""
22864
22865
#: serverguide/C/mail.xml:286(programlisting)
22866
#, no-wrap
22867
msgid ""
22868
"\n"
22869
"auth_mechanisms = plain\n"
22870
msgstr ""
22871
22872
#: serverguide/C/mail.xml:290(para)
22873
msgid "To this:"
22874
msgstr ""
22875
22876
#: serverguide/C/mail.xml:294(programlisting)
22877
#, no-wrap
22878
msgid ""
22879
"\n"
22880
"auth_mechanisms = plain login\n"
22881
msgstr ""
22882
22883
#: serverguide/C/mail.xml:298(para)
22884
msgid ""
22885
"Once you have <application>Dovecot</application> configured restart it with:"
22886
msgstr ""
22887
22888
#: serverguide/C/mail.xml:302(command) serverguide/C/mail.xml:798(command)
22889
msgid "sudo systemctl restart dovecot.service"
22890
msgstr ""
22891
22892
#: serverguide/C/mail.xml:307(title)
22893
msgid "Mail-Stack Delivery"
22894
msgstr ""
22895
22896
#: serverguide/C/mail.xml:309(para)
22897
msgid ""
22898
"Another option for configuring <application>Postfix</application> for SMTP-"
22899
"AUTH is using the <application>mail-stack-delivery</application> package "
22900
"(previously packaged as dovecot-postfix). This package will install "
22901
"<application>Dovecot</application> and configure "
22902
"<application>Postfix</application> to use it for both SASL authentication "
22903
"and as a Mail Delivery Agent (MDA). The package also configures "
22904
"<application>Dovecot</application> for IMAP, IMAPS, POP3, and POP3S."
22905
msgstr ""
22906
22907
#: serverguide/C/mail.xml:319(para)
22908
msgid ""
22909
"You may or may not want to run IMAP, IMAPS, POP3, or POP3S on your mail "
22910
"server. For example, if you are configuring your server to be a mail "
22911
"gateway, spam/virus filter, etc. If this is the case it may be easier to use "
22912
"the above commands to configure Postfix for SMTP-AUTH."
22913
msgstr ""
22914
22915
#: serverguide/C/mail.xml:326(para)
22916
msgid "To install the package, from a terminal prompt enter:"
22917
msgstr ""
22918
22919
#: serverguide/C/mail.xml:331(command)
22920
msgid "sudo apt install mail-stack-delivery"
22921
msgstr ""
22922
22923
#: serverguide/C/mail.xml:334(para)
22924
msgid ""
22925
"You should now have a working mail server, but there are a few options that "
22926
"you may wish to further customize. For example, the package uses the "
22927
"certificate and key from the <application>ssl-cert</application> package, "
22928
"and in a production environment you should use a certificate and key "
22929
"generated for the host. See <xref linkend=\"certificates-and-security\"/> "
22930
"for more details."
22931
msgstr ""
22932
22933
#: serverguide/C/mail.xml:340(para)
22934
msgid ""
22935
"Once you have a customized certificate and key for the host, change the "
22936
"following options in <filename>/etc/postfix/main.cf</filename>:"
22937
msgstr ""
22938
22939
#: serverguide/C/mail.xml:344(programlisting)
22940
#, no-wrap
22941
msgid ""
22942
"\n"
22943
"smtpd_tls_cert_file = /etc/ssl/certs/ssl-mail.pem\n"
22944
"smtpd_tls_key_file = /etc/ssl/private/ssl-mail.key\n"
22945
msgstr ""
22946
22947
#: serverguide/C/mail.xml:349(para)
22948
msgid "Then restart Postfix:"
22949
msgstr ""
22950
22951
#: serverguide/C/mail.xml:360(para)
22952
msgid ""
22953
"SMTP-AUTH configuration is complete. Now it is time to test the setup."
22954
msgstr ""
22955
22956
#: serverguide/C/mail.xml:363(para)
22957
msgid "To see if SMTP-AUTH and TLS work properly, run the following command:"
22958
msgstr ""
22959
22960
#: serverguide/C/mail.xml:368(command)
22961
msgid "telnet mail.example.com 25"
22962
msgstr ""
22963
22964
#: serverguide/C/mail.xml:370(para)
22965
msgid ""
22966
"After you have established the connection to the postfix mail server, type:"
22967
msgstr ""
22968
22969
#: serverguide/C/mail.xml:374(screen)
22970
#, no-wrap
22971
msgid ""
22972
"\n"
22973
"ehlo mail.example.com\n"
22974
msgstr ""
22975
22976
#: serverguide/C/mail.xml:377(para)
22977
msgid ""
22978
"If you see the following lines among others, then everything is working "
22979
"perfectly. Type <command>quit</command> to exit."
22980
msgstr ""
22981
22982
#: serverguide/C/mail.xml:381(programlisting)
22983
#, no-wrap
22984
msgid ""
22985
"\n"
22986
"250-STARTTLS\n"
22987
"250-AUTH LOGIN PLAIN\n"
22988
"250-AUTH=LOGIN PLAIN\n"
22989
"250 8BITMIME\n"
22990
msgstr ""
22991
"\n"
22992
"250-STARTTLS\n"
22993
"250-AUTH LOGIN PLAIN\n"
22994
"250-AUTH=LOGIN PLAIN\n"
22995
"250 8BITMIME\n"
22996
22997
#: serverguide/C/mail.xml:391(para)
22998
msgid ""
22999
"This section introduces some common ways to determine the cause if problems "
23000
"arise."
23001
msgstr ""
23002
23003
#: serverguide/C/mail.xml:395(title)
23004
msgid "Escaping chroot"
23005
msgstr ""
23006
23007
#: serverguide/C/mail.xml:396(para)
23008
msgid ""
23009
"The Ubuntu <application>postfix</application> package will by default "
23010
"install into a <emphasis>chroot</emphasis> environment for security reasons. "
23011
"This can add greater complexity when troubleshooting problems."
23012
msgstr ""
23013
23014
#: serverguide/C/mail.xml:400(para)
23015
msgid ""
23016
"To turn off the chroot operation locate for the following line in the "
23017
"<filename>/etc/postfix/master.cf</filename> configuration file:"
23018
msgstr ""
23019
23020
#: serverguide/C/mail.xml:404(screen)
23021
#, no-wrap
23022
msgid ""
23023
"\n"
23024
"smtp inet n - - - - smtpd\n"
23025
msgstr ""
23026
"\n"
23027
"smtp inet n - - - - smtpd\n"
23028
23029
#: serverguide/C/mail.xml:407(para)
23030
msgid "and modify it as follows:"
23031
msgstr ""
23032
23033
#: serverguide/C/mail.xml:410(screen)
23034
#, no-wrap
23035
msgid ""
23036
"\n"
23037
"smtp inet n - n - - smtpd\n"
23038
msgstr ""
23039
"\n"
23040
"smtp inet n - n - - smtpd\n"
23041
23042
#: serverguide/C/mail.xml:413(para)
23043
msgid ""
23044
"You will then need to restart Postfix to use the new configuration. From a "
23045
"terminal prompt enter:"
23046
msgstr ""
23047
23048
#: serverguide/C/mail.xml:421(title)
23049
msgid "Smtps"
23050
msgstr ""
23051
23052
#: serverguide/C/mail.xml:422(para)
23053
msgid ""
23054
"If you need smtps, edit <filename>/etc/postfix/master.cf</filename> and "
23055
"uncomment the following line:"
23056
msgstr ""
23057
23058
#: serverguide/C/mail.xml:425(programlisting)
23059
#, no-wrap
23060
msgid ""
23061
"\n"
23062
"smtps inet n - - - - smtpd\n"
23063
" -o smtpd_tls_wrappermode=yes\n"
23064
" -o smtpd_sasl_auth_enable=yes\n"
23065
" -o smtpd_client_restrictions=permit_sasl_authenticated,reject\n"
23066
" -o milter_macro_daemon_name=ORIGINATING\n"
23067
"\t "
23068
msgstr ""
23069
23070
#: serverguide/C/mail.xml:434(title)
23071
msgid "Log Files"
23072
msgstr ""
23073
23074
#: serverguide/C/mail.xml:435(para)
23075
msgid ""
23076
"<application>Postfix</application> sends all log messages to "
23077
"<filename>/var/log/mail.log</filename>. However error and warning messages "
23078
"can sometimes get lost in the normal log output so they are also logged to "
23079
"<filename>/var/log/mail.err</filename> and "
23080
"<filename>/var/log/mail.warn</filename> respectively."
23081
msgstr ""
23082
23083
#: serverguide/C/mail.xml:440(para)
23084
msgid ""
23085
"To see messages entered into the logs in real time you can use the "
23086
"<application>tail -f</application> command:"
23087
msgstr ""
23088
23089
#: serverguide/C/mail.xml:445(command)
23090
msgid "tail -f /var/log/mail.err"
23091
msgstr ""
23092
23093
#: serverguide/C/mail.xml:447(para)
23094
msgid ""
23095
"The amount of detail that is recorded in the logs can be increased. Below "
23096
"are some configuration options for increasing the log level for some of the "
23097
"areas covered above."
23098
msgstr ""
23099
23100
#: serverguide/C/mail.xml:453(para)
23101
msgid ""
23102
"To increase <emphasis>TLS</emphasis> activity logging set the "
23103
"<emphasis>smtpd_tls_loglevel</emphasis> option to a value from 1 to 4."
23104
msgstr ""
23105
23106
#: serverguide/C/mail.xml:457(command)
23107
msgid "sudo postconf -e 'smtpd_tls_loglevel = 4'"
23108
msgstr ""
23109
23110
#: serverguide/C/mail.xml:461(para)
23111
msgid ""
23112
"If you are having trouble sending or receiving mail from a specific domain "
23113
"you can add the domain to the <emphasis>debug_peer_list</emphasis> parameter."
23114
msgstr ""
23115
23116
#: serverguide/C/mail.xml:466(command)
23117
msgid "sudo postconf -e 'debug_peer_list = problem.domain'"
23118
msgstr ""
23119
23120
#: serverguide/C/mail.xml:470(para)
23121
msgid ""
23122
"You can increase the verbosity of any <application>Postfix</application> "
23123
"daemon process by editing the <filename>/etc/postfix/master.cf</filename> "
23124
"and adding a <emphasis>-v</emphasis> after the entry. For example edit the "
23125
"<emphasis>smtp</emphasis> entry:"
23126
msgstr ""
23127
23128
#: serverguide/C/mail.xml:474(programlisting)
23129
#, no-wrap
23130
msgid ""
23131
"\n"
23132
"smtp unix - - - - - smtp -v\n"
23133
msgstr ""
23134
23135
#: serverguide/C/mail.xml:480(para)
23136
msgid ""
23137
"It is important to note that after making one of the logging changes above "
23138
"the <application>Postfix</application> process will need to be reloaded in "
23139
"order to recognize the new configuration: <command>sudo systemctl reload "
23140
"postfix.service</command>"
23141
msgstr ""
23142
23143
#: serverguide/C/mail.xml:487(para)
23144
msgid ""
23145
"To increase the amount of information logged when troubleshooting "
23146
"<emphasis>SASL</emphasis> issues you can set the following options in "
23147
"<filename>/etc/dovecot/conf.d/10-logging.conf</filename>"
23148
msgstr ""
23149
23150
#: serverguide/C/mail.xml:491(programlisting)
23151
#, no-wrap
23152
msgid ""
23153
"\n"
23154
"auth_debug=yes\n"
23155
"auth_debug_passwords=yes\n"
23156
msgstr ""
23157
23158
#: serverguide/C/mail.xml:498(para)
23159
msgid ""
23160
"Just like <application>Postfix</application> if you change a "
23161
"<application>Dovecot</application> configuration the process will need to be "
23162
"reloaded: <command>sudo systemctl reload dovecot.service</command>."
23163
msgstr ""
23164
23165
#: serverguide/C/mail.xml:504(para)
23166
msgid ""
23167
"Some of the options above can drastically increase the amount of information "
23168
"sent to the log files. Remember to return the log level back to normal after "
23169
"you have corrected the problem. Then reload the appropriate daemon for the "
23170
"new configuration to take affect."
23171
msgstr ""
23172
23173
#: serverguide/C/mail.xml:512(para)
23174
msgid ""
23175
"Administering a <application>Postfix</application> server can be a very "
23176
"complicated task. At some point you may need to turn to the Ubuntu community "
23177
"for more experienced help."
23178
msgstr ""
23179
23180
#: serverguide/C/mail.xml:516(para)
23181
msgid ""
23182
"A great place to ask for <application>Postfix</application> assistance, and "
23183
"get involved with the Ubuntu Server community, is the <emphasis>#ubuntu-"
23184
"server</emphasis> IRC channel on <ulink "
23185
"url=\"http://freenode.net\">freenode</ulink>. You can also post a message to "
23186
"one of the <ulink "
23187
"url=\"http://www.ubuntu.com/support/community/webforums\">Web Forums</ulink>."
23188
msgstr ""
23189
23190
#: serverguide/C/mail.xml:521(para)
23191
msgid ""
23192
"For in depth <application>Postfix</application> information Ubuntu "
23193
"developers highly recommend: <ulink url=\"http://www.postfix-book.com/\">The "
23194
"Book of Postfix</ulink>."
23195
msgstr ""
23196
23197
#: serverguide/C/mail.xml:525(para)
23198
msgid ""
23199
"Finally, the <ulink "
23200
"url=\"http://www.postfix.org/documentation.html\">Postfix</ulink> website "
23201
"also has great documentation on all the different configuration options "
23202
"available."
23203
msgstr ""
23204
23205
#: serverguide/C/mail.xml:529(para)
23206
msgid ""
23207
"Also, the <ulink url=\"https://help.ubuntu.com/community/Postfix\">Ubuntu "
23208
"Wiki Postfix</ulink> page has more information."
23209
msgstr ""
23210
23211
#: serverguide/C/mail.xml:537(title) serverguide/C/mail.xml:934(title) serverguide/C/mail.xml:1050(title)
23212
msgid "Exim4"
23213
msgstr "Exim4"
23214
23215
#: serverguide/C/mail.xml:538(para)
23216
msgid ""
23217
"<application>Exim4</application> is another Message Transfer Agent (MTA) "
23218
"developed at the University of Cambridge for use on Unix systems connected "
23219
"to the Internet. Exim can be installed in place of "
23220
"<application>sendmail</application>, although the configuration of "
23221
"<application>exim</application> is quite different to that of "
23222
"<application>sendmail</application>."
23223
msgstr ""
23224
23225
#: serverguide/C/mail.xml:549(para)
23226
msgid ""
23227
"To install <application>exim4</application>, run the following command: "
23228
"<screen>\n"
23229
"<command>sudo apt install exim4</command>\n"
23230
"</screen>"
23231
msgstr ""
23232
23233
#: serverguide/C/mail.xml:558(para)
23234
msgid ""
23235
"To configure <application>Exim4</application>, run the following command:"
23236
msgstr ""
23237
23238
#: serverguide/C/mail.xml:562(command)
23239
msgid "sudo dpkg-reconfigure exim4-config"
23240
msgstr ""
23241
23242
#: serverguide/C/mail.xml:564(para)
23243
msgid ""
23244
"The user interface will be displayed. The user interface lets you configure "
23245
"many parameters. For example, In <application>Exim4</application> the "
23246
"configuration files are split among multiple files. If you wish to have them "
23247
"in one file you can configure accordingly in this user interface."
23248
msgstr ""
23249
23250
#: serverguide/C/mail.xml:572(para)
23251
msgid ""
23252
"All the parameters you configure in the user interface are stored in "
23253
"<filename>/etc/exim4/update-exim4.conf.conf</filename> file. If you wish to "
23254
"re-configure, either you re-run the configuration wizard or manually edit "
23255
"this file using your favorite editor. Once you configure, you can run the "
23256
"following command to generate the master configuration file:"
23257
msgstr ""
23258
23259
#: serverguide/C/mail.xml:583(command) serverguide/C/mail.xml:667(command)
23260
msgid "sudo update-exim4.conf"
23261
msgstr ""
23262
23263
#: serverguide/C/mail.xml:585(para)
23264
msgid ""
23265
"The master configuration file, is generated and it is stored in "
23266
"<filename>/var/lib/exim4/config.autogenerated</filename>."
23267
msgstr ""
23268
23269
#: serverguide/C/mail.xml:591(para)
23270
msgid ""
23271
"At any time, you should not edit the master configuration file, "
23272
"<filename>/var/lib/exim4/config.autogenerated</filename> manually. It is "
23273
"updated automatically every time you run <command>update-exim4.conf</command>"
23274
msgstr ""
23275
23276
#: serverguide/C/mail.xml:599(para)
23277
msgid ""
23278
"You can run the following command to start <application>Exim4</application> "
23279
"daemon."
23280
msgstr ""
23281
23282
#: serverguide/C/mail.xml:604(command) serverguide/C/mail.xml:1056(command)
23283
msgid "sudo systemctl start exim4.service"
23284
msgstr ""
23285
23286
#: serverguide/C/mail.xml:609(para)
23287
msgid ""
23288
"This section covers configuring Exim4 to use SMTP-AUTH with TLS and SASL."
23289
msgstr ""
23290
23291
#: serverguide/C/mail.xml:612(para)
23292
msgid ""
23293
"The first step is to create a certificate for use with TLS. Enter the "
23294
"following into a terminal prompt:"
23295
msgstr ""
23296
23297
#: serverguide/C/mail.xml:616(command)
23298
msgid "sudo /usr/share/doc/exim4-base/examples/exim-gencert"
23299
msgstr ""
23300
23301
#: serverguide/C/mail.xml:618(para)
23302
msgid ""
23303
"Now Exim4 needs to be configured for TLS by editing "
23304
"<filename>/etc/exim4/conf.d/main/03_exim4-config_tlsoptions</filename> add "
23305
"the following:"
23306
msgstr ""
23307
23308
#: serverguide/C/mail.xml:622(programlisting)
23309
#, no-wrap
23310
msgid ""
23311
"\n"
23312
"MAIN_TLS_ENABLE = yes\n"
23313
msgstr ""
23314
23315
#: serverguide/C/mail.xml:625(para)
23316
msgid ""
23317
"Next you need to configure <application>Exim4</application> to use the "
23318
"<application>saslauthd</application> for authentication. Edit "
23319
"<filename>/etc/exim4/conf.d/auth/30_exim4-config_examples</filename> and "
23320
"uncomment the <emphasis>plain_saslauthd_server</emphasis> and "
23321
"<emphasis>login_saslauthd_server</emphasis> sections:"
23322
msgstr ""
23323
23324
#: serverguide/C/mail.xml:630(programlisting)
23325
#, no-wrap
23326
msgid ""
23327
"\n"
23328
" plain_saslauthd_server:\n"
23329
" driver = plaintext\n"
23330
" public_name = PLAIN\n"
23331
" server_condition = ${if saslauthd{{$auth2}{$auth3}}{1}{0}}\n"
23332
" server_set_id = $auth2\n"
23333
" server_prompts = :\n"
23334
" .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS\n"
23335
" server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}\n"
23336
" .endif\n"
23337
"#\n"
23338
" login_saslauthd_server:\n"
23339
" driver = plaintext\n"
23340
" public_name = LOGIN\n"
23341
" server_prompts = \"Username:: : Password::\"\n"
23342
" # don't send system passwords over unencrypted connections\n"
23343
" server_condition = ${if saslauthd{{$auth1}{$auth2}}{1}{0}}\n"
23344
" server_set_id = $auth1\n"
23345
" .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS\n"
23346
" server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}\n"
23347
" .endif\n"
23348
msgstr ""
23349
23350
#: serverguide/C/mail.xml:652(para)
23351
msgid ""
23352
"Additionally, in order for outside mail client to be able to connect to new "
23353
"exim server, new user needs to be added into exim by using the following "
23354
"commands."
23355
msgstr ""
23356
23357
#: serverguide/C/mail.xml:656(command)
23358
msgid "sudo /usr/share/doc/exim4-base/examples/exim-adduser"
23359
msgstr ""
23360
23361
#: serverguide/C/mail.xml:658(para)
23362
msgid ""
23363
"Users should protect the new exim password files with the following commands."
23364
msgstr ""
23365
23366
#: serverguide/C/mail.xml:660(command)
23367
msgid "sudo chown root:Debian-exim /etc/exim4/passwd"
23368
msgstr ""
23369
23370
#: serverguide/C/mail.xml:661(command)
23371
msgid "sudo chmod 640 /etc/exim4/passwd"
23372
msgstr ""
23373
23374
#: serverguide/C/mail.xml:663(para)
23375
msgid "Finally, update the Exim4 configuration and restart the service:"
23376
msgstr ""
23377
23378
#: serverguide/C/mail.xml:668(command)
23379
msgid "sudo systemctl restart exim4.service"
23380
msgstr ""
23381
23382
#: serverguide/C/mail.xml:673(para)
23383
msgid ""
23384
"This section provides details on configuring the saslauthd to provide "
23385
"authentication for <application>Exim4</application>."
23386
msgstr ""
23387
23388
#: serverguide/C/mail.xml:676(para)
23389
msgid ""
23390
"The first step is to install the sasl2-bin package. From a terminal prompt "
23391
"enter the following:"
23392
msgstr ""
23393
23394
#: serverguide/C/mail.xml:680(command)
23395
msgid "sudo apt install sasl2-bin"
23396
msgstr ""
23397
23398
#: serverguide/C/mail.xml:682(para)
23399
msgid ""
23400
"To configure saslauthd edit the /etc/default/saslauthd configuration file "
23401
"and set START=no to:"
23402
msgstr ""
23403
23404
#: serverguide/C/mail.xml:688(para)
23405
msgid ""
23406
"Next the <emphasis>Debian-exim</emphasis> user needs to be part of the "
23407
"<emphasis>sasl</emphasis> group in order for Exim4 to use the saslauthd "
23408
"service:"
23409
msgstr ""
23410
23411
#: serverguide/C/mail.xml:693(command)
23412
msgid "sudo adduser Debian-exim sasl"
23413
msgstr ""
23414
23415
#: serverguide/C/mail.xml:695(para)
23416
msgid "Now start the <application>saslauthd</application> service:"
23417
msgstr ""
23418
23419
#: serverguide/C/mail.xml:699(command)
23420
msgid "sudo systemctl start saslauthd.service"
23421
msgstr ""
23422
23423
#: serverguide/C/mail.xml:701(para)
23424
msgid ""
23425
"<application>Exim4</application> is now configured with SMTP-AUTH using TLS "
23426
"and SASL authentication."
23427
msgstr ""
23428
23429
#: serverguide/C/mail.xml:710(para)
23430
msgid ""
23431
"See <ulink url=\"http://www.exim.org/\">exim.org</ulink> for more "
23432
"information."
23433
msgstr ""
23434
23435
#: serverguide/C/mail.xml:715(para)
23436
msgid ""
23437
"There is also an <ulink url=\"http://www.uit.co.uk/content/exim-smtp-mail-"
23438
"server\">Exim4 Book</ulink> available."
23439
msgstr ""
23440
23441
#: serverguide/C/mail.xml:720(para)
23442
msgid ""
23443
"Another resource is the <ulink "
23444
"url=\"https://help.ubuntu.com/community/Exim4\">Exim4 Ubuntu Wiki </ulink> "
23445
"page."
23446
msgstr ""
23447
23448
#: serverguide/C/mail.xml:729(title)
23449
msgid "Dovecot Server"
23450
msgstr "Server Dovecot"
23451
23452
#: serverguide/C/mail.xml:730(para)
23453
msgid ""
23454
"<application>Dovecot</application> is a Mail Delivery Agent, written with "
23455
"security primarily in mind. It supports the major mailbox formats: mbox or "
23456
"Maildir. This section explain how to set it up as an imap or pop3 server."
23457
msgstr ""
23458
23459
#: serverguide/C/mail.xml:738(para)
23460
msgid ""
23461
"To install <application>dovecot</application>, run the following command in "
23462
"the command prompt:"
23463
msgstr ""
23464
23465
#: serverguide/C/mail.xml:743(command)
23466
msgid "sudo apt install dovecot-imapd dovecot-pop3d"
23467
msgstr ""
23468
23469
#: serverguide/C/mail.xml:748(para)
23470
msgid ""
23471
"To configure <application>dovecot</application>, you can edit the file "
23472
"<filename>/etc/dovecot/dovecot.conf</filename>. You can choose the protocol "
23473
"you use. It could be pop3, pop3s (pop3 secure), imap and imaps (imap "
23474
"secure). A description of these protocols is beyond the scope of this guide. "
23475
"For further information, refer to the Wikipedia articles on <ulink "
23476
"url=\"http://en.wikipedia.org/wiki/POP3\">POP3</ulink> and <ulink "
23477
"url=\"http://en.wikipedia.org/wiki/Internet_Message_Access_Protocol\">IMAP</u"
23478
"link>."
23479
msgstr ""
23480
23481
#: serverguide/C/mail.xml:758(para)
23482
msgid ""
23483
"IMAPS and POP3S are more secure that the simple IMAP and POP3 because they "
23484
"use SSL encryption to connect. Once you have chosen the protocol, amend the "
23485
"following line in the file <filename>/etc/dovecot/dovecot.conf</filename>:"
23486
msgstr ""
23487
23488
#: serverguide/C/mail.xml:764(programlisting)
23489
#, no-wrap
23490
msgid ""
23491
"\n"
23492
"protocols = pop3 pop3s imap imaps\n"
23493
msgstr ""
23494
"\n"
23495
"protocols = pop3 pop3s imap imaps\n"
23496
23497
#: serverguide/C/mail.xml:767(para)
23498
msgid ""
23499
"Next, choose the mailbox you would like to use. "
23500
"<application>Dovecot</application> supports <emphasis "
23501
"role=\"strong\">maildir</emphasis> and <emphasis "
23502
"role=\"strong\">mbox</emphasis> formats. These are the most commonly used "
23503
"mailbox formats. They both have their own benefits and are discussed on "
23504
"<ulink url=\"http://wiki2.dovecot.org/MailboxFormat\">the Dovecot web "
23505
"site</ulink>."
23506
msgstr ""
23507
23508
#: serverguide/C/mail.xml:775(para)
23509
msgid ""
23510
"Once you have chosen your mailbox type, edit the file "
23511
"<filename>/etc/dovecot/conf.d/10-mail.conf</filename> and change the "
23512
"following line:"
23513
msgstr ""
23514
23515
#: serverguide/C/mail.xml:780(programlisting)
23516
#, no-wrap
23517
msgid ""
23518
"\n"
23519
"mail_location = maildir:~/Maildir # (for maildir)\n"
23520
"or\n"
23521
"mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u # (for mbox)\n"
23522
msgstr ""
23523
"\n"
23524
"mail_location = maildir:~/Maildir # (for maildir)\n"
23525
"or\n"
23526
"mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u # (for mbox)\n"
23527
23528
#: serverguide/C/mail.xml:786(para)
23529
msgid ""
23530
"You should configure your Mail Transport Agent (MTA) to transfer the "
23531
"incoming mail to this type of mailbox if it is different from the one you "
23532
"have configured."
23533
msgstr ""
23534
23535
#: serverguide/C/mail.xml:792(para)
23536
msgid ""
23537
"Once you have configured dovecot, restart the "
23538
"<application>dovecot</application> daemon in order to test your setup:"
23539
msgstr ""
23540
23541
#: serverguide/C/mail.xml:801(para)
23542
msgid ""
23543
"If you have enabled imap, or pop3, you can also try to log in with the "
23544
"commands <command>telnet localhost pop3</command> or <command>telnet "
23545
"localhost imap2</command>. If you see something like the following, the "
23546
"installation has been successful:"
23547
msgstr ""
23548
23549
#: serverguide/C/mail.xml:808(programlisting)
23550
#, no-wrap
23551
msgid ""
23552
"\n"
23553
"bhuvan@rainbow:~$ telnet localhost pop3\n"
23554
"Trying 127.0.0.1...\n"
23555
"Connected to localhost.localdomain.\n"
23556
"Escape character is '^]'.\n"
23557
"+OK Dovecot ready.\n"
23558
msgstr ""
23559
"\n"
23560
"bhuvan@rainbow:~$ telnet localhost pop3\n"
23561
"Trying 127.0.0.1...\n"
23562
"Connected to localhost.localdomain.\n"
23563
"Escape character is '^]'.\n"
23564
"+OK Dovecot ready.\n"
23565
23566
#: serverguide/C/mail.xml:817(title)
23567
msgid "Dovecot SSL Configuration"
23568
msgstr "Konfigurasi SSL Dovecot"
23569
23570
#: serverguide/C/mail.xml:818(para)
23571
msgid ""
23572
"To configure <application>dovecot</application> to use SSL, you can edit the "
23573
"file <filename>/etc/dovecot/conf.d/10-ssl.conf</filename> and amend "
23574
"following lines:"
23575
msgstr ""
23576
23577
#: serverguide/C/mail.xml:830(para)
23578
msgid ""
23579
"You can get the SSL certificate from a Certificate Issuing Authority or you "
23580
"can create self signed SSL certificate. The latter is a good option for "
23581
"email, because SMTP clients rarely complain about \"self-signed "
23582
"certificates\". Please refer to <xref linkend=\"certificates-and-"
23583
"security\"/> for details about how to create self signed SSL certificate. "
23584
"Once you create the certificate, you will have a key file and a certificate "
23585
"file. Please copy them to the location pointed in the "
23586
"<filename>/etc/dovecot/conf.d/10-ssl.conf</filename> configuration file."
23587
msgstr ""
23588
23589
#: serverguide/C/mail.xml:845(title)
23590
msgid "Firewall Configuration for an Email Server"
23591
msgstr "Konfigurasi Firewall untuk Server Imel"
23592
23593
#: serverguide/C/mail.xml:851(para)
23594
msgid "IMAP - 143"
23595
msgstr "IMAP - 143"
23596
23597
#: serverguide/C/mail.xml:852(para)
23598
msgid "IMAPS - 993"
23599
msgstr "IMAPS - 993"
23600
23601
#: serverguide/C/mail.xml:853(para)
23602
msgid "POP3 - 110"
23603
msgstr "POP3 - 110"
23604
23605
#: serverguide/C/mail.xml:854(para)
23606
msgid "POP3S - 995"
23607
msgstr "POP3S - 995"
23608
23609
#: serverguide/C/mail.xml:846(para)
23610
msgid ""
23611
"To access your mail server from another computer, you must configure your "
23612
"firewall to allow connections to the server on the necessary ports. "
23613
"<placeholder-1/>"
23614
msgstr ""
23615
"Untuk mengakses mail server dari komputer lain, Anda harus mengkonfigurasi "
23616
"firewall agar mengizinkan koneksi ke server pada port yang diperlukan. "
23617
"<placeholder-1/>"
23618
23619
#: serverguide/C/mail.xml:863(para)
23620
msgid ""
23621
"See the <ulink url=\"http://www.dovecot.org/\">Dovecot website</ulink> for "
23622
"more information."
23623
msgstr ""
23624
23625
#: serverguide/C/mail.xml:868(para)
23626
msgid ""
23627
"Also, the <ulink url=\"https://help.ubuntu.com/community/Dovecot\">Dovecot "
23628
"Ubuntu Wiki</ulink> page has more details."
23629
msgstr ""
23630
23631
#: serverguide/C/mail.xml:877(title) serverguide/C/mail.xml:952(title) serverguide/C/mail.xml:1175(title)
23632
msgid "Mailman"
23633
msgstr "Mailman"
23634
23635
#: serverguide/C/mail.xml:878(para)
23636
msgid ""
23637
"Mailman is an open source program for managing electronic mail discussions "
23638
"and e-newsletter lists. Many open source mailing lists (including all the "
23639
"<ulink url=\"http://lists.ubuntu.com\">Ubuntu mailing lists</ulink>) use "
23640
"Mailman as their mailing list software. It is powerful and easy to install "
23641
"and maintain."
23642
msgstr ""
23643
"Mailman adalah program open source untuk mengelola diskusi surat elektronik "
23644
"dan daftar e-newsletter. Kebanyakan milis open source (termasuk seluruh "
23645
"<ulink url=\"http://lists.ubuntu.com\">milis Ubuntu</ulink>) menggunakan "
23646
"Mailman sebagai perangkat lunak untuk milis mereka. Mailman sangat handal "
23647
"dan mudah untuk diinstal dan dikelola."
23648
23649
#: serverguide/C/mail.xml:888(para)
23650
msgid ""
23651
"Mailman provides a web interface for the administrators and users, using an "
23652
"external mail server to send and receive emails. It works perfectly with the "
23653
"following mail servers:"
23654
msgstr ""
23655
23656
#: serverguide/C/mail.xml:899(application)
23657
msgid "Exim"
23658
msgstr "Exim"
23659
23660
#: serverguide/C/mail.xml:902(application)
23661
msgid "Sendmail"
23662
msgstr "Sendmail"
23663
23664
#: serverguide/C/mail.xml:905(application)
23665
msgid "Qmail"
23666
msgstr "Qmail"
23667
23668
#: serverguide/C/mail.xml:910(para)
23669
msgid ""
23670
"We will see how to install and configure Mailman with, the Apache web "
23671
"server, and either the Postfix or Exim mail server. If you wish to install "
23672
"Mailman with a different mail server, please refer to the references section."
23673
msgstr ""
23674
23675
#: serverguide/C/mail.xml:917(para)
23676
msgid ""
23677
"You only need to install one mail server and "
23678
"<application>Postfix</application> is the default Ubuntu Mail Transfer Agent."
23679
msgstr ""
23680
23681
#: serverguide/C/mail.xml:922(title) serverguide/C/mail.xml:979(title)
23682
msgid "Apache2"
23683
msgstr "Apache2"
23684
23685
#: serverguide/C/mail.xml:923(para)
23686
msgid ""
23687
"To install apache2 you refer to <xref linkend=\"http-installation\"/> for "
23688
"details."
23689
msgstr ""
23690
23691
#: serverguide/C/mail.xml:929(para)
23692
msgid ""
23693
"For instructions on installing and configuring Postfix refer to <xref "
23694
"linkend=\"postfix\"/>"
23695
msgstr ""
23696
23697
#: serverguide/C/mail.xml:935(para)
23698
msgid "To install Exim4 refer to <xref linkend=\"exim4\"/>."
23699
msgstr ""
23700
23701
#: serverguide/C/mail.xml:938(para)
23702
msgid ""
23703
"Once exim4 is installed, the configuration files are stored in the "
23704
"<filename>/etc/exim4</filename> directory. In Ubuntu, by default, the exim4 "
23705
"configuration files are split across different files. You can change this "
23706
"behavior by changing the following variable in the "
23707
"<filename>/etc/exim4/update-exim4.conf</filename> file:"
23708
msgstr ""
23709
23710
#: serverguide/C/mail.xml:945(programlisting)
23711
#, no-wrap
23712
msgid ""
23713
"\n"
23714
"dc_use_split_config='true'\n"
23715
msgstr ""
23716
23717
#: serverguide/C/mail.xml:953(para)
23718
msgid ""
23719
"To install <application>Mailman</application>, run following command at a "
23720
"terminal prompt:"
23721
msgstr ""
23722
23723
#: serverguide/C/mail.xml:957(command)
23724
msgid "sudo apt install mailman"
23725
msgstr ""
23726
23727
#: serverguide/C/mail.xml:959(para)
23728
msgid ""
23729
"It copies the installation files in "
23730
"<application>/var/lib/mailman</application> directory. It installs the CGI "
23731
"scripts in <application>/usr/lib/cgi-bin/mailman</application> directory. It "
23732
"creates <emphasis>list</emphasis> linux user. It creates the "
23733
"<emphasis>list</emphasis> linux group. The mailman process will be owned by "
23734
"this user."
23735
msgstr ""
23736
23737
#: serverguide/C/mail.xml:971(para)
23738
msgid ""
23739
"This section assumes you have successfully installed "
23740
"<application>mailman</application>, <application>apache2</application>, and "
23741
"<application>postfix</application> or <application>exim4</application>. Now "
23742
"you just need to configure them."
23743
msgstr ""
23744
23745
#: serverguide/C/mail.xml:980(para)
23746
msgid ""
23747
"An example Apache configuration file comes with "
23748
"<application>Mailman</application> and is placed in "
23749
"<filename>/etc/mailman/apache.conf</filename>. In order for Apache to use "
23750
"the config file it needs to be copied to <filename>/etc/apache2/sites-"
23751
"available</filename>:"
23752
msgstr ""
23753
23754
#: serverguide/C/mail.xml:986(command)
23755
msgid ""
23756
"sudo cp /etc/mailman/apache.conf /etc/apache2/sites-available/mailman.conf"
23757
msgstr ""
23758
23759
#: serverguide/C/mail.xml:988(para)
23760
msgid ""
23761
"This will setup a new Apache <emphasis>VirtualHost</emphasis> for the "
23762
"Mailman administration site. Now enable the new configuration and restart "
23763
"Apache:"
23764
msgstr ""
23765
23766
#: serverguide/C/mail.xml:993(command)
23767
msgid "sudo a2ensite mailman.conf"
23768
msgstr ""
23769
23770
#: serverguide/C/mail.xml:996(para)
23771
msgid ""
23772
"Mailman uses apache2 to render its CGI scripts. The mailman CGI scripts are "
23773
"installed in the <application>/usr/lib/cgi-bin/mailman</application> "
23774
"directory. So, the mailman url will be http://hostname/cgi-bin/mailman/. You "
23775
"can make changes to the <filename>/etc/apache2/sites-"
23776
"available/mailman.conf</filename> file if you wish to change this behavior."
23777
msgstr ""
23778
23779
#: serverguide/C/mail.xml:1007(para)
23780
msgid ""
23781
"For <application>Postfix</application> integration, we will associate the "
23782
"domain lists.example.com with the mailing lists. Please replace "
23783
"<emphasis>lists.example.com</emphasis> with the domain of your choosing."
23784
msgstr ""
23785
23786
#: serverguide/C/mail.xml:1011(para)
23787
msgid ""
23788
"You can use the postconf command to add the necessary configuration to "
23789
"<filename>/etc/postfix/main.cf</filename>:"
23790
msgstr ""
23791
23792
#: serverguide/C/mail.xml:1015(command)
23793
msgid "sudo postconf -e 'relay_domains = lists.example.com'"
23794
msgstr ""
23795
23796
#: serverguide/C/mail.xml:1016(command)
23797
msgid "sudo postconf -e 'transport_maps = hash:/etc/postfix/transport'"
23798
msgstr ""
23799
23800
#: serverguide/C/mail.xml:1017(command)
23801
msgid "sudo postconf -e 'mailman_destination_recipient_limit = 1'"
23802
msgstr ""
23803
23804
#: serverguide/C/mail.xml:1019(para)
23805
msgid ""
23806
"In <filename>/etc/postfix/master.cf</filename> double check that you have "
23807
"the following transport:"
23808
msgstr ""
23809
23810
#: serverguide/C/mail.xml:1022(programlisting)
23811
#, no-wrap
23812
msgid ""
23813
"\n"
23814
"mailman unix - n n - - pipe\n"
23815
" flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py\n"
23816
" ${nexthop} ${user}\n"
23817
msgstr ""
23818
23819
#: serverguide/C/mail.xml:1027(para)
23820
msgid ""
23821
"It calls the <emphasis>postfix-to-mailman.py</emphasis> script when a mail "
23822
"is delivered to a list."
23823
msgstr ""
23824
23825
#: serverguide/C/mail.xml:1030(para)
23826
msgid ""
23827
"Associate the domain lists.example.com to the Mailman transport with the "
23828
"transport map. Edit the file <filename>/etc/postfix/transport</filename>:"
23829
msgstr ""
23830
23831
#: serverguide/C/mail.xml:1033(programlisting)
23832
#, no-wrap
23833
msgid ""
23834
"\n"
23835
"lists.example.com mailman:\n"
23836
msgstr ""
23837
23838
#: serverguide/C/mail.xml:1036(para)
23839
msgid ""
23840
"Now have <application>Postfix</application> build the transport map by "
23841
"entering the following from a terminal prompt:"
23842
msgstr ""
23843
23844
#: serverguide/C/mail.xml:1040(command)
23845
msgid "sudo postmap -v /etc/postfix/transport"
23846
msgstr ""
23847
23848
#: serverguide/C/mail.xml:1042(para)
23849
msgid "Then restart Postfix to enable the new configurations:"
23850
msgstr ""
23851
23852
#: serverguide/C/mail.xml:1051(para)
23853
msgid ""
23854
"Once Exim4 is installed, you can start the Exim server using the following "
23855
"command from a terminal prompt:"
23856
msgstr ""
23857
23858
#: serverguide/C/mail.xml:1067(para) serverguide/C/mail.xml:1082(title)
23859
msgid "Main"
23860
msgstr "Main"
23861
23862
#: serverguide/C/mail.xml:1070(para) serverguide/C/mail.xml:1122(title)
23863
msgid "Transport"
23864
msgstr "Transport"
23865
23866
#: serverguide/C/mail.xml:1073(para) serverguide/C/mail.xml:1145(title)
23867
msgid "Router"
23868
msgstr "Router"
23869
23870
#: serverguide/C/mail.xml:1058(para)
23871
msgid ""
23872
"In order to make mailman work with Exim4, you need to configure Exim4. As "
23873
"mentioned earlier, by default, Exim4 uses multiple configuration files of "
23874
"different types. For details, please refer to the <ulink "
23875
"url=\"http://www.exim.org\">Exim</ulink> web site. To run mailman, we should "
23876
"add new a configuration file to the following configuration types: "
23877
"<placeholder-1/> Exim creates a master configuration file by sorting all "
23878
"these mini configuration files. So, the order of these configuration files "
23879
"is very important."
23880
msgstr ""
23881
23882
#: serverguide/C/mail.xml:1089(programlisting)
23883
#, no-wrap
23884
msgid ""
23885
"\n"
23886
"# start\n"
23887
"# Home dir for your Mailman installation -- aka Mailman's prefix\n"
23888
"# directory.\n"
23889
"# On Ubuntu this should be \"/var/lib/mailman\"\n"
23890
"# This is normally the same as ~mailman\n"
23891
"MM_HOME=/var/lib/mailman\n"
23892
"#\n"
23893
"# User and group for Mailman, should match your --with-mail-gid\n"
23894
"# switch to Mailman's configure script. Value is normally \"mailman\"\n"
23895
"MM_UID=list\n"
23896
"MM_GID=list\n"
23897
"#\n"
23898
"# Domains that your lists are in - colon separated list\n"
23899
"# you may wish to add these into local_domains as well\n"
23900
"domainlist mm_domains=hostname.com\n"
23901
"#\n"
23902
"# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n"
23903
"#\n"
23904
"# These values are derived from the ones above and should not need\n"
23905
"# editing unless you have munged your mailman installation\n"
23906
"#\n"
23907
"# The path of the Mailman mail wrapper script\n"
23908
"MM_WRAP=MM_HOME/mail/mailman\n"
23909
"#\n"
23910
"# The path of the list config file (used as a required file when\n"
23911
"# verifying list addresses)\n"
23912
"MM_LISTCHK=MM_HOME/lists/${lc::$local_part}/config.pck\n"
23913
"# end\n"
23914
msgstr ""
23915
"\n"
23916
"# start\n"
23917
"# Home dir for your Mailman installation -- aka Mailman's prefix\n"
23918
"# directory.\n"
23919
"# On Ubuntu this should be \"/var/lib/mailman\"\n"
23920
"# This is normally the same as ~mailman\n"
23921
"MM_HOME=/var/lib/mailman\n"
23922
"#\n"
23923
"# User and group for Mailman, should match your --with-mail-gid\n"
23924
"# switch to Mailman's configure script. Value is normally \"mailman\"\n"
23925
"MM_UID=list\n"
23926
"MM_GID=list\n"
23927
"#\n"
23928
"# Domains that your lists are in - colon separated list\n"
23929
"# you may wish to add these into local_domains as well\n"
23930
"domainlist mm_domains=hostname.com\n"
23931
"#\n"
23932
"# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n"
23933
"#\n"
23934
"# These values are derived from the ones above and should not need\n"
23935
"# editing unless you have munged your mailman installation\n"
23936
"#\n"
23937
"# The path of the Mailman mail wrapper script\n"
23938
"MM_WRAP=MM_HOME/mail/mailman\n"
23939
"#\n"
23940
"# The path of the list config file (used as a required file when\n"
23941
"# verifying list addresses)\n"
23942
"MM_LISTCHK=MM_HOME/lists/${lc::$local_part}/config.pck\n"
23943
"# end\n"
23944
23945
#: serverguide/C/mail.xml:1083(para)
23946
msgid ""
23947
"All the configuration files belonging to the main type are stored in the "
23948
"<filename>/etc/exim4/conf.d/main/</filename> directory. You can add the "
23949
"following content to a new file, named <filename>04_exim4-"
23950
"config_mailman</filename>: <placeholder-1/>"
23951
msgstr ""
23952
23953
#: serverguide/C/mail.xml:1129(programlisting)
23954
#, no-wrap
23955
msgid ""
23956
"\n"
23957
" mailman_transport:\n"
23958
" driver = pipe\n"
23959
" command = MM_WRAP \\\n"
23960
" '${if def:local_part_suffix \\\n"
23961
" {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} "
23962
"\\\n"
23963
" {post}}' \\\n"
23964
" $local_part\n"
23965
" current_directory = MM_HOME\n"
23966
" home_directory = MM_HOME\n"
23967
" user = MM_UID\n"
23968
" group = MM_GID\n"
23969
msgstr ""
23970
"\n"
23971
" mailman_transport:\n"
23972
" driver = pipe\n"
23973
" command = MM_WRAP \\\n"
23974
" '${if def:local_part_suffix \\\n"
23975
" {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} "
23976
"\\\n"
23977
" {post}}' \\\n"
23978
" $local_part\n"
23979
" current_directory = MM_HOME\n"
23980
" home_directory = MM_HOME\n"
23981
" user = MM_UID\n"
23982
" group = MM_GID\n"
23983
23984
#: serverguide/C/mail.xml:1123(para)
23985
msgid ""
23986
"All the configuration files belonging to transport type are stored in the "
23987
"<filename>/etc/exim4/conf.d/transport/</filename> directory. You can add the "
23988
"following content to a new file named <filename> 40_exim4-"
23989
"config_mailman</filename>: <placeholder-1/>"
23990
msgstr ""
23991
23992
#: serverguide/C/mail.xml:1150(programlisting)
23993
#, no-wrap
23994
msgid ""
23995
"\n"
23996
" mailman_router:\n"
23997
" driver = accept\n"
23998
" require_files = MM_HOME/lists/$local_part/config.pck\n"
23999
" local_part_suffix_optional\n"
24000
" local_part_suffix = -bounces : -bounces+* : \\\n"
24001
" -confirm+* : -join : -leave : \\\n"
24002
" -owner : -request : -admin\n"
24003
" transport = mailman_transport\n"
24004
msgstr ""
24005
"\n"
24006
" mailman_router:\n"
24007
" driver = accept\n"
24008
" require_files = MM_HOME/lists/$local_part/config.pck\n"
24009
" local_part_suffix_optional\n"
24010
" local_part_suffix = -bounces : -bounces+* : \\\n"
24011
" -confirm+* : -join : -leave : \\\n"
24012
" -owner : -request : -admin\n"
24013
" transport = mailman_transport\n"
24014
24015
#: serverguide/C/mail.xml:1146(para)
24016
msgid ""
24017
"All the configuration files belonging to router type are stored in the "
24018
"<filename>/etc/exim4/conf.d/router/</filename> directory. You can add the "
24019
"following content in to a new file named <filename>101_exim4-"
24020
"config_mailman</filename>: <placeholder-1/>"
24021
msgstr ""
24022
24023
#: serverguide/C/mail.xml:1163(para)
24024
msgid ""
24025
"The order of main and transport configuration files can be in any order. "
24026
"But, the order of router configuration files must be the same. This "
24027
"particular file must appear before the <application>200_exim4-"
24028
"config_primary</application> file. These two configuration files contain "
24029
"same type of information. The first file takes the precedence. For more "
24030
"details, please refer to the references section."
24031
msgstr ""
24032
24033
#: serverguide/C/mail.xml:1176(para)
24034
msgid ""
24035
"Once mailman is installed, you can run it using the following command:"
24036
msgstr ""
24037
24038
#: serverguide/C/mail.xml:1180(command)
24039
msgid "sudo systemctl start mailman.service"
24040
msgstr ""
24041
24042
#: serverguide/C/mail.xml:1182(para)
24043
msgid ""
24044
"Once mailman is installed, you should create the default mailing list. Run "
24045
"the following command to create the mailing list:"
24046
msgstr ""
24047
24048
#: serverguide/C/mail.xml:1188(command)
24049
msgid "sudo /usr/sbin/newlist mailman"
24050
msgstr ""
24051
24052
#: serverguide/C/mail.xml:1191(programlisting)
24053
#, no-wrap
24054
msgid ""
24055
"\n"
24056
" Enter the email address of the person running the list: bhuvan at "
24057
"ubuntu.com\n"
24058
" Initial mailman password:\n"
24059
" To finish creating your mailing list, you must edit your "
24060
"<filename>/etc/aliases</filename> (or\n"
24061
" equivalent) file by adding the following lines, and possibly running the\n"
24062
" `newaliases' program:\n"
24063
"\n"
24064
" ## mailman mailing list\n"
24065
" mailman: \"|/var/lib/mailman/mail/mailman post mailman\"\n"
24066
" mailman-admin: \"|/var/lib/mailman/mail/mailman admin mailman\"\n"
24067
" mailman-bounces: \"|/var/lib/mailman/mail/mailman bounces mailman\"\n"
24068
" mailman-confirm: \"|/var/lib/mailman/mail/mailman confirm mailman\"\n"
24069
" mailman-join: \"|/var/lib/mailman/mail/mailman join mailman\"\n"
24070
" mailman-leave: \"|/var/lib/mailman/mail/mailman leave mailman\"\n"
24071
" mailman-owner: \"|/var/lib/mailman/mail/mailman owner mailman\"\n"
24072
" mailman-request: \"|/var/lib/mailman/mail/mailman request mailman\"\n"
24073
" mailman-subscribe: \"|/var/lib/mailman/mail/mailman subscribe "
24074
"mailman\"\n"
24075
" mailman-unsubscribe: \"|/var/lib/mailman/mail/mailman unsubscribe "
24076
"mailman\"\n"
24077
"\n"
24078
" Hit enter to notify mailman owner...\n"
24079
"\n"
24080
" # \n"
24081
msgstr ""
24082
"\n"
24083
" Enter the email address of the person running the list: bhuvan at "
24084
"ubuntu.com\n"
24085
" Initial mailman password:\n"
24086
" To finish creating your mailing list, you must edit your "
24087
"<filename>/etc/aliases</filename> (or\n"
24088
" equivalent) file by adding the following lines, and possibly running the\n"
24089
" `newaliases' program:\n"
24090
"\n"
24091
" ## mailman mailing list\n"
24092
" mailman: \"|/var/lib/mailman/mail/mailman post mailman\"\n"
24093
" mailman-admin: \"|/var/lib/mailman/mail/mailman admin mailman\"\n"
24094
" mailman-bounces: \"|/var/lib/mailman/mail/mailman bounces mailman\"\n"
24095
" mailman-confirm: \"|/var/lib/mailman/mail/mailman confirm mailman\"\n"
24096
" mailman-join: \"|/var/lib/mailman/mail/mailman join mailman\"\n"
24097
" mailman-leave: \"|/var/lib/mailman/mail/mailman leave mailman\"\n"
24098
" mailman-owner: \"|/var/lib/mailman/mail/mailman owner mailman\"\n"
24099
" mailman-request: \"|/var/lib/mailman/mail/mailman request mailman\"\n"
24100
" mailman-subscribe: \"|/var/lib/mailman/mail/mailman subscribe "
24101
"mailman\"\n"
24102
" mailman-unsubscribe: \"|/var/lib/mailman/mail/mailman unsubscribe "
24103
"mailman\"\n"
24104
"\n"
24105
" Hit enter to notify mailman owner...\n"
24106
"\n"
24107
" # \n"
24108
24109
#: serverguide/C/mail.xml:1214(para)
24110
msgid ""
24111
"We have configured either Postfix or Exim4 to recognize all emails from "
24112
"mailman. So, it is not mandatory to make any new entries in "
24113
"<filename>/etc/aliases</filename>. If you have made any changes to the "
24114
"configuration files, please ensure that you restart those services before "
24115
"continuing to next section."
24116
msgstr ""
24117
24118
#: serverguide/C/mail.xml:1222(para)
24119
msgid ""
24120
"The Exim4 does not use the above aliases to forward mails to Mailman, as it "
24121
"uses a <emphasis>discover</emphasis> approach. To suppress the aliases while "
24122
"creating the list, you can add <emphasis>MTA=None</emphasis> line in Mailman "
24123
"configuration file, <filename>/etc/mailman/mm_cfg.py</filename>."
24124
msgstr ""
24125
24126
#: serverguide/C/mail.xml:1233(title)
24127
msgid "Administration"
24128
msgstr "Administrasi"
24129
24130
#: serverguide/C/mail.xml:1234(para)
24131
msgid ""
24132
"We assume you have a default installation. The mailman cgi scripts are still "
24133
"in the <application>/usr/lib/cgi-bin/mailman/</application> directory. "
24134
"Mailman provides a web based administration facility. To access this page, "
24135
"point your browser to the following url:"
24136
msgstr ""
24137
24138
#: serverguide/C/mail.xml:1242(para)
24139
msgid "http://hostname/cgi-bin/mailman/admin"
24140
msgstr "http://hostname/cgi-bin/mailman/admin"
24141
24142
#: serverguide/C/mail.xml:1246(para)
24143
msgid ""
24144
"The default mailing list, <emphasis>mailman</emphasis>, will appear in this "
24145
"screen. If you click the mailing list name, it will ask for your "
24146
"authentication password. If you enter the correct password, you will be able "
24147
"to change administrative settings of this mailing list. You can create a new "
24148
"mailing list using the command line utility "
24149
"(<command>/usr/sbin/newlist</command>). Alternatively, you can create a new "
24150
"mailing list using the web interface."
24151
msgstr ""
24152
24153
#: serverguide/C/mail.xml:1259(title)
24154
msgid "Users"
24155
msgstr "Pengguna"
24156
24157
#: serverguide/C/mail.xml:1260(para)
24158
msgid ""
24159
"Mailman provides a web based interface for users. To access this page, point "
24160
"your browser to the following url:"
24161
msgstr ""
24162
"Mailman menyediakan antarmuka untuk pengguna yang berbasis web. Untuk "
24163
"mengakses halaman ini, arahkan browser Anda ke url berikut:"
24164
24165
#: serverguide/C/mail.xml:1265(para)
24166
msgid "http://hostname/cgi-bin/mailman/listinfo"
24167
msgstr "http://hostname/cgi-bin/mailman/listinfo"
24168
24169
#: serverguide/C/mail.xml:1269(para)
24170
msgid ""
24171
"The default mailing list, <emphasis>mailman</emphasis>, will appear in this "
24172
"screen. If you click the mailing list name, it will display the subscription "
24173
"form. You can enter your email address, name (optional), and password to "
24174
"subscribe. An email invitation will be sent to you. You can follow the "
24175
"instructions in the email to subscribe."
24176
msgstr ""
24177
24178
#: serverguide/C/mail.xml:1281(ulink)
24179
msgid "GNU Mailman - Installation Manual"
24180
msgstr "GNU Mailman - Manual Instalasi"
24181
24182
#: serverguide/C/mail.xml:1285(ulink)
24183
msgid "HOWTO - Using Exim 4 and Mailman 2.1 together"
24184
msgstr "HOWTO - Menggunakan Exim 4 dan Mailman 2.1 secara bersamaan"
24185
24186
#: serverguide/C/mail.xml:1288(para)
24187
msgid ""
24188
"Also, see the <ulink "
24189
"url=\"https://help.ubuntu.com/community/Mailman\">Mailman Ubuntu "
24190
"Wiki</ulink> page."
24191
msgstr ""
24192
24193
#: serverguide/C/mail.xml:1294(title)
24194
msgid "Mail Filtering"
24195
msgstr ""
24196
24197
#: serverguide/C/mail.xml:1295(para)
24198
msgid ""
24199
"One of the largest issues with email today is the problem of Unsolicited "
24200
"Bulk Email (UBE). Also known as SPAM, such messages may also carry viruses "
24201
"and other forms of malware. According to some reports these messages make up "
24202
"the bulk of all email traffic on the Internet."
24203
msgstr ""
24204
24205
#: serverguide/C/mail.xml:1300(para)
24206
msgid ""
24207
"This section will cover integrating <application>Amavisd-new</application>, "
24208
"<application>Spamassassin</application>, and "
24209
"<application>ClamAV</application> with the "
24210
"<application>Postfix</application> Mail Transport Agent (MTA). "
24211
"<application>Postfix</application> can also check email validity by passing "
24212
"it through external content filters. These filters can sometimes determine "
24213
"if a message is spam without needing to process it with more resource "
24214
"intensive applications. Two common filters are "
24215
"<application>opendkim</application> and <application>python-policyd-"
24216
"spf</application>."
24217
msgstr ""
24218
24219
#: serverguide/C/mail.xml:1310(para)
24220
msgid ""
24221
"<application>Amavisd-new</application> is a wrapper program that can call "
24222
"any number of content filtering programs for spam detection, antivirus, etc."
24223
msgstr ""
24224
24225
#: serverguide/C/mail.xml:1316(para)
24226
msgid ""
24227
"<application>Spamassassin</application> uses a variety of mechanisms to "
24228
"filter email based on the message content."
24229
msgstr ""
24230
24231
#: serverguide/C/mail.xml:1321(para)
24232
msgid ""
24233
"<application>ClamAV</application> is an open source antivirus application."
24234
msgstr ""
24235
24236
#: serverguide/C/mail.xml:1326(para)
24237
msgid ""
24238
"<application>opendkim</application> implements a Sendmail Mail Filter "
24239
"(Milter) for the DomainKeys Identified Mail (DKIM) standard."
24240
msgstr ""
24241
24242
#: serverguide/C/mail.xml:1332(para)
24243
msgid ""
24244
"<application>python-policyd-spf</application> enables Sender Policy "
24245
"Framework (SPF) checking with <application>Postfix</application>."
24246
msgstr ""
24247
24248
#: serverguide/C/mail.xml:1337(para)
24249
msgid "This is how the pieces fit together:"
24250
msgstr ""
24251
24252
#: serverguide/C/mail.xml:1342(para)
24253
msgid "An email message is accepted by <application>Postfix</application>."
24254
msgstr ""
24255
24256
#: serverguide/C/mail.xml:1347(para)
24257
msgid ""
24258
"The message is passed through any external filters "
24259
"<application>opendkim</application> and <application>python-policyd-"
24260
"spf</application> in this case."
24261
msgstr ""
24262
24263
#: serverguide/C/mail.xml:1353(para)
24264
msgid "<application>Amavisd-new</application> then processes the message."
24265
msgstr ""
24266
24267
#: serverguide/C/mail.xml:1358(para)
24268
msgid ""
24269
"<application>ClamAV</application> is used to scan the message. If the "
24270
"message contains a virus <application>Postfix</application> will reject the "
24271
"message."
24272
msgstr ""
24273
24274
#: serverguide/C/mail.xml:1364(para)
24275
msgid ""
24276
"Clean messages will then be analyzed by "
24277
"<application>Spamassassin</application> to find out if the message is spam. "
24278
"<application>Spamassassin</application> will then add X-Header lines "
24279
"allowing <application>Amavisd-new</application> to further manipulate the "
24280
"message."
24281
msgstr ""
24282
24283
#: serverguide/C/mail.xml:1371(para)
24284
msgid ""
24285
"For example, if a message has a Spam score of over fifty the message could "
24286
"be automatically dropped from the queue without the recipient ever having to "
24287
"be bothered. Another, way to handle flagged messages is to deliver them to "
24288
"the Mail User Agent (MUA) allowing the user to deal with the message as they "
24289
"see fit."
24290
msgstr ""
24291
24292
#: serverguide/C/mail.xml:1378(para)
24293
msgid ""
24294
"See <xref linkend=\"postfix\"/> for instructions on installing and "
24295
"configuring Postfix."
24296
msgstr ""
24297
24298
#: serverguide/C/mail.xml:1381(para)
24299
msgid ""
24300
"To install the rest of the applications enter the following from a terminal "
24301
"prompt:"
24302
msgstr ""
24303
24304
#: serverguide/C/mail.xml:1385(command)
24305
msgid "sudo apt install amavisd-new spamassassin clamav-daemon"
24306
msgstr ""
24307
24308
#: serverguide/C/mail.xml:1386(command)
24309
msgid "sudo apt install opendkim postfix-policyd-spf-python"
24310
msgstr ""
24311
24312
#: serverguide/C/mail.xml:1388(para)
24313
msgid ""
24314
"There are some optional packages that integrate with "
24315
"<application>Spamassassin</application> for better spam detection:"
24316
msgstr ""
24317
24318
#: serverguide/C/mail.xml:1392(command)
24319
msgid "sudo apt install pyzor razor"
24320
msgstr ""
24321
24322
#: serverguide/C/mail.xml:1394(para)
24323
msgid ""
24324
"Along with the main filtering applications compression utilities are needed "
24325
"to process some email attachments:"
24326
msgstr ""
24327
24328
#: serverguide/C/mail.xml:1398(command)
24329
msgid ""
24330
"sudo apt install arj cabextract cpio lha nomarch pax rar unrar unzip zip"
24331
msgstr ""
24332
24333
#: serverguide/C/mail.xml:1401(para)
24334
msgid ""
24335
"If some packages are not found, check that the "
24336
"<emphasis>multiverse</emphasis> repository is enabled in "
24337
"<filename>/etc/apt/sources.list</filename>"
24338
msgstr ""
24339
24340
#: serverguide/C/mail.xml:1402(para)
24341
msgid ""
24342
"If you make changes to the file, be sure to run <command>sudo apt "
24343
"update</command> before trying to install again."
24344
msgstr ""
24345
24346
#: serverguide/C/mail.xml:1407(para)
24347
msgid "Now configure everything to work together and filter email."
24348
msgstr ""
24349
24350
#: serverguide/C/mail.xml:1411(title)
24351
msgid "ClamAV"
24352
msgstr ""
24353
24354
#: serverguide/C/mail.xml:1412(para)
24355
msgid ""
24356
"The default behaviour of <application>ClamAV</application> will fit our "
24357
"needs. For more ClamAV configuration options, check the configuration files "
24358
"in <filename>/etc/clamav</filename>."
24359
msgstr ""
24360
24361
#: serverguide/C/mail.xml:1417(para)
24362
msgid ""
24363
"Add the <emphasis>clamav</emphasis> user to the <emphasis>amavis</emphasis> "
24364
"group in order for <application>Amavisd-new</application> to have the "
24365
"appropriate access to scan files:"
24366
msgstr ""
24367
24368
#: serverguide/C/mail.xml:1422(command)
24369
msgid "sudo adduser clamav amavis"
24370
msgstr ""
24371
24372
#: serverguide/C/mail.xml:1423(command)
24373
msgid "sudo adduser amavis clamav"
24374
msgstr ""
24375
24376
#: serverguide/C/mail.xml:1427(title)
24377
msgid "Spamassassin"
24378
msgstr ""
24379
24380
#: serverguide/C/mail.xml:1428(para)
24381
msgid ""
24382
"Spamassassin automatically detects optional components and will use them if "
24383
"they are present. This means that there is no need to configure "
24384
"<application>pyzor</application> and <application>razor</application>."
24385
msgstr ""
24386
24387
#: serverguide/C/mail.xml:1432(para)
24388
msgid ""
24389
"Edit <filename>/etc/default/spamassassin</filename> to activate the "
24390
"<application>Spamassassin</application> daemon. Change "
24391
"<emphasis>ENABLED=0</emphasis> to:"
24392
msgstr ""
24393
24394
#: serverguide/C/mail.xml:1436(programlisting)
24395
#, no-wrap
24396
msgid ""
24397
"\n"
24398
"ENABLED=1\n"
24399
msgstr ""
24400
24401
#: serverguide/C/mail.xml:1439(para)
24402
msgid "Now start the daemon:"
24403
msgstr ""
24404
24405
#: serverguide/C/mail.xml:1443(command)
24406
msgid "sudo systemctl start spamassassin.service"
24407
msgstr ""
24408
24409
#: serverguide/C/mail.xml:1447(title)
24410
msgid "Amavisd-new"
24411
msgstr ""
24412
24413
#: serverguide/C/mail.xml:1448(para)
24414
msgid ""
24415
"First activate spam and antivirus detection in <application>Amavisd-"
24416
"new</application> by editing <filename>/etc/amavis/conf.d/15-"
24417
"content_filter_mode</filename>:"
24418
msgstr ""
24419
24420
#: serverguide/C/mail.xml:1452(programlisting)
24421
#, no-wrap
24422
msgid ""
24423
"\n"
24424
"use strict;\n"
24425
"\n"
24426
"# You can modify this file to re-enable SPAM checking through spamassassin\n"
24427
"# and to re-enable antivirus checking.\n"
24428
"\n"
24429
"#\n"
24430
"# Default antivirus checking mode\n"
24431
"# Uncomment the two lines below to enable it\n"
24432
"#\n"
24433
"\n"
24434
"@bypass_virus_checks_maps = (\n"
24435
" \\%bypass_virus_checks, \\@bypass_virus_checks_acl, \\"
24436
"$bypass_virus_checks_re);\n"
24437
"\n"
24438
"\n"
24439
"#\n"
24440
"# Default SPAM checking mode\n"
24441
"# Uncomment the two lines below to enable it\n"
24442
"#\n"
24443
"\n"
24444
"@bypass_spam_checks_maps = (\n"
24445
" \\%bypass_spam_checks, \\@bypass_spam_checks_acl, \\"
24446
"$bypass_spam_checks_re);\n"
24447
"\n"
24448
"1; # insure a defined return\n"
24449
msgstr ""
24450
24451
#: serverguide/C/mail.xml:1477(para)
24452
msgid ""
24453
"Bouncing spam can be a bad idea as the return address is often faked. The "
24454
"default behaviour is to instead discard. This is configured in "
24455
"<filename>/etc/amavis/conf.d/20-debian_defaults</filename> where "
24456
"<emphasis>$final_spam_destiny</emphasis> is set to D_DISCARD rather than "
24457
"D_BOUNCE."
24458
msgstr ""
24459
24460
#: serverguide/C/mail.xml:1483(para)
24461
msgid ""
24462
"Additionally, you may want to adjust the following options to flag more "
24463
"messages as spam:"
24464
msgstr ""
24465
24466
#: serverguide/C/mail.xml:1487(programlisting)
24467
#, no-wrap
24468
msgid ""
24469
"\n"
24470
"$sa_tag_level_deflt = -999; # add spam info headers if at, or above that "
24471
"level\n"
24472
"$sa_tag2_level_deflt = 6.0; # add 'spam detected' headers at that level\n"
24473
"$sa_kill_level_deflt = 21.0; # triggers spam evasive actions\n"
24474
"$sa_dsn_cutoff_level = 4; # spam level beyond which a DSN is not sent\n"
24475
msgstr ""
24476
24477
#: serverguide/C/mail.xml:1494(para)
24478
msgid ""
24479
"If the server's <emphasis>hostname</emphasis> is different from the domain's "
24480
"MX record you may need to manually set the <emphasis>$myhostname</emphasis> "
24481
"option. Also, if the server receives mail for multiple domains the "
24482
"<emphasis>@local_domains_acl</emphasis> option will need to be customized. "
24483
"Edit the <filename>/etc/amavis/conf.d/50-user</filename> file:"
24484
msgstr ""
24485
24486
#: serverguide/C/mail.xml:1501(programlisting)
24487
#, no-wrap
24488
msgid ""
24489
"\n"
24490
"$myhostname = 'mail.example.com';\n"
24491
"@local_domains_acl = ( \"example.com\", \"example.org\" );\n"
24492
msgstr ""
24493
24494
#: serverguide/C/mail.xml:1506(para)
24495
msgid ""
24496
"If you want to cover multiple domains you can use the following in "
24497
"the<filename>/etc/amavis/conf.d/50-user</filename>"
24498
msgstr ""
24499
24500
#: serverguide/C/mail.xml:1509(programlisting)
24501
#, no-wrap
24502
msgid ""
24503
"\n"
24504
"@local_domains_acl = qw(.);\n"
24505
msgstr ""
24506
24507
#: serverguide/C/mail.xml:1513(para)
24508
msgid ""
24509
"After configuration <application>Amavisd-new</application> needs to be "
24510
"restarted:"
24511
msgstr ""
24512
24513
#: serverguide/C/mail.xml:1517(command) serverguide/C/mail.xml:1564(command)
24514
msgid "sudo systemctl restart amavis.service"
24515
msgstr ""
24516
24517
#: serverguide/C/mail.xml:1520(title)
24518
msgid "DKIM Whitelist"
24519
msgstr ""
24520
24521
#: serverguide/C/mail.xml:1522(para)
24522
msgid ""
24523
"<application>Amavisd-new</application> can be configured to automatically "
24524
"<emphasis>Whitelist</emphasis> addresses from domains with valid Domain "
24525
"Keys. There are some pre-configured domains in the "
24526
"<filename>/etc/amavis/conf.d/40-policy_banks</filename>."
24527
msgstr ""
24528
24529
#: serverguide/C/mail.xml:1528(para)
24530
msgid "There are multiple ways to configure the Whitelist for a domain:"
24531
msgstr ""
24532
24533
#: serverguide/C/mail.xml:1534(para)
24534
msgid ""
24535
"<emphasis>'example.com' => 'WHITELIST',</emphasis>: will whitelist any "
24536
"address from the \"example.com\" domain."
24537
msgstr ""
24538
24539
#: serverguide/C/mail.xml:1539(para)
24540
msgid ""
24541
"<emphasis>'.example.com' => 'WHITELIST',</emphasis>: will whitelist any "
24542
"address from any <emphasis>subdomains</emphasis> of \"example.com\" that "
24543
"have a valid signature."
24544
msgstr ""
24545
24546
#: serverguide/C/mail.xml:1545(para)
24547
msgid ""
24548
"<emphasis>'.example.com/@example.com' => 'WHITELIST',</emphasis>: will "
24549
"whitelist subdomains of \"example.com\" that use the signature of <emphasis "
24550
"role=\"italic\">example.com</emphasis> the parent domain."
24551
msgstr ""
24552
24553
#: serverguide/C/mail.xml:1551(para)
24554
msgid ""
24555
"<emphasis>'./@example.com' => 'WHITELIST',</emphasis>: adds addresses "
24556
"that have a valid signature from \"example.com\". This is usually used for "
24557
"discussion groups that sign their messages."
24558
msgstr ""
24559
24560
#: serverguide/C/mail.xml:1558(para)
24561
msgid ""
24562
"A domain can also have multiple Whitelist configurations. After editing the "
24563
"file, restart <application>amavisd-new</application>:"
24564
msgstr ""
24565
24566
#: serverguide/C/mail.xml:1568(para)
24567
msgid ""
24568
"In this context, once a domain has been added to the Whitelist the message "
24569
"will not receive any anti-virus or spam filtering. This may or may not be "
24570
"the intended behavior you wish for a domain."
24571
msgstr ""
24572
24573
#: serverguide/C/mail.xml:1578(para)
24574
msgid ""
24575
"For <application>Postfix</application> integration, enter the following from "
24576
"a terminal prompt:"
24577
msgstr ""
24578
24579
#: serverguide/C/mail.xml:1582(command)
24580
msgid "sudo postconf -e 'content_filter = smtp-amavis:[127.0.0.1]:10024'"
24581
msgstr ""
24582
24583
#: serverguide/C/mail.xml:1584(para)
24584
msgid ""
24585
"Next edit <filename>/etc/postfix/master.cf</filename> and add the following "
24586
"to the end of the file:"
24587
msgstr ""
24588
24589
#: serverguide/C/mail.xml:1587(programlisting)
24590
#, no-wrap
24591
msgid ""
24592
"\n"
24593
"smtp-amavis unix - - - - 2 smtp\n"
24594
" -o smtp_data_done_timeout=1200\n"
24595
" -o smtp_send_xforward_command=yes\n"
24596
" -o disable_dns_lookups=yes\n"
24597
" -o max_use=20\n"
24598
"\n"
24599
"127.0.0.1:10025 inet n - - - - smtpd\n"
24600
" -o content_filter=\n"
24601
" -o local_recipient_maps=\n"
24602
" -o relay_recipient_maps=\n"
24603
" -o smtpd_restriction_classes=\n"
24604
" -o smtpd_delay_reject=no\n"
24605
" -o smtpd_client_restrictions=permit_mynetworks,reject\n"
24606
" -o smtpd_helo_restrictions=\n"
24607
" -o smtpd_sender_restrictions=\n"
24608
" -o smtpd_recipient_restrictions=permit_mynetworks,reject\n"
24609
" -o smtpd_data_restrictions=reject_unauth_pipelining\n"
24610
" -o smtpd_end_of_data_restrictions=\n"
24611
" -o mynetworks=127.0.0.0/8\n"
24612
" -o smtpd_error_sleep_time=0\n"
24613
" -o smtpd_soft_error_limit=1001\n"
24614
" -o smtpd_hard_error_limit=1000\n"
24615
" -o smtpd_client_connection_count_limit=0\n"
24616
" -o smtpd_client_connection_rate_limit=0\n"
24617
" -o "
24618
"receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no"
24619
"_milters\n"
24620
msgstr ""
24621
24622
#: serverguide/C/mail.xml:1614(para)
24623
msgid ""
24624
"Also add the following two lines immediately below the "
24625
"<emphasis>\"pickup\"</emphasis> transport service:"
24626
msgstr ""
24627
24628
#: serverguide/C/mail.xml:1617(programlisting)
24629
#, no-wrap
24630
msgid ""
24631
"\n"
24632
" -o content_filter=\n"
24633
" -o receive_override_options=no_header_body_checks\n"
24634
msgstr ""
24635
24636
#: serverguide/C/mail.xml:1621(para)
24637
msgid ""
24638
"This will prevent messages that are generated to report on spam from being "
24639
"classified as spam."
24640
msgstr ""
24641
24642
#: serverguide/C/mail.xml:1624(para)
24643
msgid "Now restart <application>Postfix</application>:"
24644
msgstr ""
24645
24646
#: serverguide/C/mail.xml:1630(para)
24647
msgid "Content filtering with spam and virus detection is now enabled."
24648
msgstr ""
24649
24650
#: serverguide/C/mail.xml:1636(title)
24651
msgid "Amavisd-new and Spamassassin"
24652
msgstr ""
24653
24654
#: serverguide/C/mail.xml:1638(para)
24655
msgid ""
24656
"When integrating <application>Amavisd-new</application> with "
24657
"<application>Spamassassin</application>, if you choose to disable the bayes "
24658
"filtering by editing <filename>/etc/spamassassin/local.cf</filename> and use "
24659
"<application>cron</application> to update the nightly rules, the result can "
24660
"cause a situation where a large amount of error messages are sent to the "
24661
"<emphasis>amavis</emphasis> user via the amavisd-new "
24662
"<application>cron</application> job."
24663
msgstr ""
24664
24665
#: serverguide/C/mail.xml:1645(para)
24666
msgid "There are several ways to handle this situation:"
24667
msgstr ""
24668
24669
#: serverguide/C/mail.xml:1651(para)
24670
msgid "Configure your MDA to filter messages you do not wish to see."
24671
msgstr ""
24672
24673
#: serverguide/C/mail.xml:1656(para)
24674
msgid ""
24675
"Change <filename>/usr/sbin/amavisd-new-cronjob</filename> to check for "
24676
"<emphasis>use_bayes 0</emphasis>. For example, edit "
24677
"<filename>/usr/sbin/amavisd-new-cronjob</filename> and add the following to "
24678
"the top before the <emphasis>test</emphasis> statements:"
24679
msgstr ""
24680
24681
#: serverguide/C/mail.xml:1660(programlisting)
24682
#, no-wrap
24683
msgid ""
24684
"\n"
24685
"egrep -q \"^[ \\t]*use_bayes[ \\t]*0\" /etc/spamassassin/local.cf && "
24686
"exit 0\n"
24687
msgstr ""
24688
24689
#: serverguide/C/mail.xml:1670(para)
24690
msgid ""
24691
"First, test that the <application>Amavisd-new</application> SMTP is "
24692
"listening:"
24693
msgstr ""
24694
24695
#: serverguide/C/mail.xml:1673(programlisting)
24696
#, no-wrap
24697
msgid ""
24698
"\n"
24699
"telnet localhost 10024\n"
24700
"Trying 127.0.0.1...\n"
24701
"Connected to localhost.\n"
24702
"Escape character is '^]'.\n"
24703
"220 [127.0.0.1] ESMTP amavisd-new service ready\n"
24704
"^]\n"
24705
msgstr ""
24706
24707
#: serverguide/C/mail.xml:1681(para)
24708
msgid ""
24709
"In the Header of messages that go through the content filter you should see:"
24710
msgstr ""
24711
24712
#: serverguide/C/mail.xml:1684(programlisting)
24713
#, no-wrap
24714
msgid ""
24715
"\n"
24716
"X-Spam-Level: \n"
24717
"X-Virus-Scanned: Debian amavisd-new at example.com\n"
24718
"X-Spam-Status: No, hits=-2.3 tagged_above=-1000.0 required=5.0 tests=AWL, "
24719
"BAYES_00\n"
24720
"X-Spam-Level: \n"
24721
msgstr ""
24722
24723
#: serverguide/C/mail.xml:1691(para)
24724
msgid ""
24725
"Your output will vary, but the important thing is that there are <emphasis>X-"
24726
"Virus-Scanned</emphasis> and <emphasis>X-Spam-Status</emphasis> entries."
24727
msgstr ""
24728
24729
#: serverguide/C/mail.xml:1699(para)
24730
msgid ""
24731
"The best way to figure out why something is going wrong is to check the log "
24732
"files."
24733
msgstr ""
24734
24735
#: serverguide/C/mail.xml:1704(para)
24736
msgid ""
24737
"For instructions on <application>Postfix</application> logging see the <xref "
24738
"linkend=\"postfix-troubleshooting\"/> section."
24739
msgstr ""
24740
24741
#: serverguide/C/mail.xml:1710(para)
24742
msgid ""
24743
"<application>Amavisd-new</application> uses "
24744
"<application>Syslog</application> to send messages to "
24745
"<filename>/var/log/mail.log</filename>. The amount of detail can be "
24746
"increased by adding the <emphasis>$log_level</emphasis> option to "
24747
"<filename>/etc/amavis/conf.d/50-user</filename>, and setting the value from "
24748
"1 to 5."
24749
msgstr ""
24750
24751
#: serverguide/C/mail.xml:1715(programlisting)
24752
#, no-wrap
24753
msgid ""
24754
"\n"
24755
"$log_level = 2;\n"
24756
msgstr ""
24757
24758
#: serverguide/C/mail.xml:1719(para)
24759
msgid ""
24760
"When the <application>Amavisd-new</application> log output is increased "
24761
"<application>Spamassassin</application> log output is also increased."
24762
msgstr ""
24763
24764
#: serverguide/C/mail.xml:1726(para)
24765
msgid ""
24766
"The <application>ClamAV</application> log level can be increased by editing "
24767
"<filename>/etc/clamav/clamd.conf</filename> and setting the following option:"
24768
msgstr ""
24769
24770
#: serverguide/C/mail.xml:1730(programlisting)
24771
#, no-wrap
24772
msgid ""
24773
"\n"
24774
"LogVerbose true\n"
24775
msgstr ""
24776
24777
#: serverguide/C/mail.xml:1733(para)
24778
msgid ""
24779
"By default <application>ClamAV</application> will send log messages to "
24780
"<filename>/var/log/clamav/clamav.log</filename>."
24781
msgstr ""
24782
24783
#: serverguide/C/mail.xml:1739(para)
24784
msgid ""
24785
"After changing an applications log settings remember to restart the service "
24786
"for the new settings to take affect. Also, once the issue you are "
24787
"troubleshooting is resolved it is a good idea to change the log settings "
24788
"back to normal."
24789
msgstr ""
24790
24791
#: serverguide/C/mail.xml:1747(para)
24792
msgid "For more information on filtering mail see the following links:"
24793
msgstr ""
24794
24795
#: serverguide/C/mail.xml:1753(ulink)
24796
msgid "Amavisd-new Documentation"
24797
msgstr ""
24798
24799
#: serverguide/C/mail.xml:1757(para)
24800
msgid ""
24801
"<ulink url=\"http://www.clamav.net/doc/latest/html/\">ClamAV "
24802
"Documentation</ulink> and <ulink "
24803
"url=\"http://wiki.clamav.net/Main/WebHome\">ClamAV Wiki</ulink>"
24804
msgstr ""
24805
24806
#: serverguide/C/mail.xml:1764(ulink)
24807
msgid "Spamassassin Wiki"
24808
msgstr ""
24809
24810
#: serverguide/C/mail.xml:1769(ulink)
24811
msgid "Pyzor Homepage"
24812
msgstr ""
24813
24814
#: serverguide/C/mail.xml:1774(ulink)
24815
msgid "Razor Homepage"
24816
msgstr ""
24817
24818
#: serverguide/C/mail.xml:1779(ulink)
24819
msgid "DKIM.org"
24820
msgstr ""
24821
24822
#: serverguide/C/mail.xml:1784(ulink)
24823
msgid "Postfix Amavis New"
24824
msgstr ""
24825
24826
#: serverguide/C/mail.xml:1788(para)
24827
msgid ""
24828
"Also, feel free to ask questions in the <emphasis>#ubuntu-server</emphasis> "
24829
"IRC channel on <ulink url=\"http://freenode.net\">freenode</ulink>."
24830
msgstr ""
24831
24832
#: serverguide/C/lamp-applications.xml:11(title)
24833
msgid "LAMP Applications"
24834
msgstr ""
24835
24836
#: serverguide/C/lamp-applications.xml:17(para)
24837
msgid ""
24838
"LAMP installations (Linux + Apache + MySQL + PHP/Perl/Python) are a popular "
24839
"setup for Ubuntu servers. There is a plethora of Open Source applications "
24840
"written using the LAMP application stack. Some popular LAMP applications are "
24841
"Wiki's, Content Management Systems, and Management Software such as "
24842
"phpMyAdmin."
24843
msgstr ""
24844
24845
#: serverguide/C/lamp-applications.xml:24(para)
24846
msgid ""
24847
"One advantage of LAMP is the substantial flexibility for different database, "
24848
"web server, and scripting languages. Popular substitutes for MySQL include "
24849
"PostgreSQL and SQLite. Python, Perl, and Ruby are also frequently used "
24850
"instead of PHP. While Nginx, Cherokee and Lighttpd can replace Apache."
24851
msgstr ""
24852
24853
#: serverguide/C/lamp-applications.xml:30(para)
24854
msgid ""
24855
"The fastest way to get started is to install LAMP using "
24856
"<application>tasksel</application>. Tasksel is a Debian/Ubuntu tool that "
24857
"installs multiple related packages as a co-ordinated \"task\" onto your "
24858
"system. To install a LAMP server:"
24859
msgstr ""
24860
24861
#: serverguide/C/lamp-applications.xml:41(command)
24862
msgid "sudo tasksel install lamp-server"
24863
msgstr ""
24864
24865
#: serverguide/C/lamp-applications.xml:46(para)
24866
msgid ""
24867
"After installing it you'll be able to install most <emphasis>LAMP</emphasis> "
24868
"applications in this way:"
24869
msgstr ""
24870
24871
#: serverguide/C/lamp-applications.xml:52(para)
24872
msgid "Download an archive containing the application source files."
24873
msgstr ""
24874
24875
#: serverguide/C/lamp-applications.xml:57(para)
24876
msgid ""
24877
"Unpack the archive, usually in a directory accessible to a web server."
24878
msgstr ""
24879
24880
#: serverguide/C/lamp-applications.xml:62(para)
24881
msgid ""
24882
"Depending on where the source was extracted, configure a web server to serve "
24883
"the files."
24884
msgstr ""
24885
24886
#: serverguide/C/lamp-applications.xml:67(para)
24887
msgid "Configure the application to connect to the database."
24888
msgstr ""
24889
24890
#: serverguide/C/lamp-applications.xml:72(para)
24891
msgid ""
24892
"Run a script, or browse to a page of the application, to install the "
24893
"database needed by the application."
24894
msgstr ""
24895
24896
#: serverguide/C/lamp-applications.xml:77(para)
24897
msgid ""
24898
"Once the steps above, or similar steps, are completed you are ready to begin "
24899
"using the application."
24900
msgstr ""
24901
24902
#: serverguide/C/lamp-applications.xml:83(para)
24903
msgid ""
24904
"A disadvantage of using this approach is that the application files are not "
24905
"placed in the file system in a standard way, which can cause confusion as to "
24906
"where the application is installed. Another larger disadvantage is updating "
24907
"the application. When a new version is released, the same process used to "
24908
"install the application is needed to apply updates."
24909
msgstr ""
24910
24911
#: serverguide/C/lamp-applications.xml:90(para)
24912
msgid ""
24913
"Fortunately, a number of <emphasis>LAMP</emphasis> applications are already "
24914
"packaged for Ubuntu, and are available for installation in the same way as "
24915
"non-LAMP applications. Depending on the application some extra configuration "
24916
"and setup steps may be needed, however."
24917
msgstr ""
24918
24919
#: serverguide/C/lamp-applications.xml:96(para)
24920
msgid ""
24921
"This section covers how to install some <emphasis>LAMP</emphasis> "
24922
"applications."
24923
msgstr ""
24924
24925
#: serverguide/C/lamp-applications.xml:102(title)
24926
msgid "Moin Moin"
24927
msgstr "Moin Moin"
24928
24929
#: serverguide/C/lamp-applications.xml:104(para)
24930
msgid ""
24931
"MoinMoin is a wiki engine implemented in Python, based on the PikiPiki Wiki "
24932
"engine, and licensed under the GNU GPL."
24933
msgstr ""
24934
24935
#: serverguide/C/lamp-applications.xml:112(para)
24936
msgid ""
24937
"To install <application>MoinMoin</application>, run the following command in "
24938
"the command prompt:"
24939
msgstr ""
24940
"Untuk menginstall <application>MoinMoin</application>, Jalankan perintah "
24941
"berikut ini pada command prompt"
24942
24943
#: serverguide/C/lamp-applications.xml:118(command)
24944
msgid "sudo apt install python-moinmoin"
24945
msgstr ""
24946
24947
#: serverguide/C/lamp-applications.xml:121(para)
24948
msgid ""
24949
"You should also install <application>apache2</application> web server. For "
24950
"installing the <application>apache2</application> web server, please refer "
24951
"to <xref linkend=\"http-installation\"/> sub-section in <xref "
24952
"linkend=\"httpd\"/> section."
24953
msgstr ""
24954
24955
#: serverguide/C/lamp-applications.xml:132(para)
24956
msgid ""
24957
"To configure your first wiki application, please run the following set of "
24958
"commands. Let us assume that you are creating a wiki named "
24959
"<emphasis>mywiki</emphasis>:"
24960
msgstr ""
24961
24962
#: serverguide/C/lamp-applications.xml:139(command)
24963
msgid "cd /usr/share/moin"
24964
msgstr ""
24965
24966
#: serverguide/C/lamp-applications.xml:140(command)
24967
msgid "sudo mkdir mywiki"
24968
msgstr ""
24969
24970
#: serverguide/C/lamp-applications.xml:141(command)
24971
msgid "sudo cp -R data mywiki"
24972
msgstr ""
24973
24974
#: serverguide/C/lamp-applications.xml:142(command)
24975
msgid "sudo cp -R underlay mywiki"
24976
msgstr ""
24977
24978
#: serverguide/C/lamp-applications.xml:143(command)
24979
msgid "sudo cp server/moin.cgi mywiki"
24980
msgstr ""
24981
24982
#: serverguide/C/lamp-applications.xml:144(command)
24983
msgid "sudo chown -R www-data:www-data mywiki"
24984
msgstr ""
24985
24986
#: serverguide/C/lamp-applications.xml:145(command)
24987
msgid "sudo chmod -R ug+rwX mywiki"
24988
msgstr ""
24989
24990
#: serverguide/C/lamp-applications.xml:146(command)
24991
msgid "sudo chmod -R o-rwx mywiki"
24992
msgstr ""
24993
24994
#: serverguide/C/lamp-applications.xml:149(para)
24995
msgid ""
24996
"Now you should configure <application>MoinMoin</application> to find your "
24997
"new wiki <emphasis>mywiki</emphasis>. To configure "
24998
"<application>MoinMoin</application>, open "
24999
"<filename>/etc/moin/mywiki.py</filename> file and change the following line:"
25000
msgstr ""
25001
25002
#: serverguide/C/lamp-applications.xml:157(programlisting)
25003
#, no-wrap
25004
msgid "data_dir = '/org/mywiki/data'"
25005
msgstr ""
25006
25007
#: serverguide/C/lamp-applications.xml:159(para)
25008
msgid "to"
25009
msgstr "ke"
25010
25011
#: serverguide/C/lamp-applications.xml:163(programlisting)
25012
#, no-wrap
25013
msgid "data_dir = '/usr/share/moin/mywiki/data'"
25014
msgstr "data_dir = '/usr/share/moin/mywiki/data'"
25015
25016
#: serverguide/C/lamp-applications.xml:165(para)
25017
msgid ""
25018
"Also, below the <emphasis>data_dir</emphasis> option add the "
25019
"<emphasis>data_underlay_dir</emphasis>:"
25020
msgstr ""
25021
25022
#: serverguide/C/lamp-applications.xml:169(programlisting)
25023
#, no-wrap
25024
msgid ""
25025
"\n"
25026
"data_underlay_dir='/usr/share/moin/mywiki/underlay'\n"
25027
msgstr ""
25028
25029
#: serverguide/C/lamp-applications.xml:174(para)
25030
msgid ""
25031
"If the <filename>/etc/moin/mywiki.py</filename> file does not exist, you "
25032
"should copy <filename>/usr/share/moin/config/wikifarm/mywiki.py</filename> "
25033
"file to <filename>/etc/moin/mywiki.py</filename> file and do the above "
25034
"mentioned change."
25035
msgstr ""
25036
25037
#: serverguide/C/lamp-applications.xml:182(para)
25038
msgid ""
25039
"If you have named your wiki as <emphasis>my_wiki_name</emphasis> you should "
25040
"insert a line <quote>(\"my_wiki_name\", r\".*\")</quote> in "
25041
"<filename>/etc/moin/farmconfig.py</filename> file after the line "
25042
"<quote>(\"mywiki\", r\".*\")</quote>."
25043
msgstr ""
25044
25045
#: serverguide/C/lamp-applications.xml:190(para)
25046
msgid ""
25047
"Once you have configured <application>MoinMoin</application> to find your "
25048
"first wiki application, <emphasis>mywiki</emphasis>, you should configure "
25049
"<application>apache2</application> and make it ready for your wiki."
25050
msgstr ""
25051
25052
#: serverguide/C/lamp-applications.xml:197(para)
25053
msgid ""
25054
"You should add the following lines in <filename>/etc/apache2/sites-"
25055
"available/000-default.conf</filename> file inside the <quote><VirtualHost "
25056
"*></quote> tag:"
25057
msgstr ""
25058
25059
#: serverguide/C/lamp-applications.xml:203(programlisting)
25060
#, no-wrap
25061
msgid ""
25062
"\n"
25063
"### moin\n"
25064
" ScriptAlias /mywiki \"/usr/share/moin/mywiki/moin.cgi\"\n"
25065
" alias /moin_static<version> \"/usr/share/moin/htdocs\"\n"
25066
" <Directory /usr/share/moin/htdocs>\n"
25067
" Order allow,deny\n"
25068
" allow from all\n"
25069
" </Directory>\n"
25070
"### end moin\n"
25071
msgstr ""
25072
25073
#: serverguide/C/lamp-applications.xml:214(para)
25074
msgid "The version in the above example is determined by running:"
25075
msgstr ""
25076
25077
#: serverguide/C/lamp-applications.xml:218(programlisting)
25078
#, no-wrap
25079
msgid ""
25080
"\n"
25081
"$ moin --version\n"
25082
msgstr ""
25083
25084
#: serverguide/C/lamp-applications.xml:222(para)
25085
msgid "If the output shows version 1.9.7, your second line should be:"
25086
msgstr ""
25087
25088
#: serverguide/C/lamp-applications.xml:226(programlisting)
25089
#, no-wrap
25090
msgid ""
25091
"\n"
25092
"alias /moin_static197 \"/usr/share/moin/htdocs\"\n"
25093
msgstr ""
25094
25095
#: serverguide/C/lamp-applications.xml:230(para)
25096
msgid ""
25097
"Once you configure the <application>apache2</application> web server and "
25098
"make it ready for your wiki application, you should restart it. You can run "
25099
"the following command to restart the <application>apache2</application> web "
25100
"server:"
25101
msgstr ""
25102
25103
#: serverguide/C/lamp-applications.xml:243(title) serverguide/C/installation.xml:1540(title)
25104
msgid "Verification"
25105
msgstr "Memastikan"
25106
25107
#: serverguide/C/lamp-applications.xml:245(para)
25108
msgid ""
25109
"You can verify the Wiki application and see if it works by pointing your web "
25110
"browser to the following URL:"
25111
msgstr ""
25112
"Anda dapat memastikan bahwa Aplikasi Wiki anda telah berjalan dengan cara "
25113
"mengakses URL berikut ini pada web browser anda :"
25114
25115
#: serverguide/C/lamp-applications.xml:249(programlisting)
25116
#, no-wrap
25117
msgid ""
25118
"\n"
25119
"http://localhost/mywiki\n"
25120
msgstr ""
25121
"\n"
25122
"http://localhost/mywiki\n"
25123
25124
#: serverguide/C/lamp-applications.xml:253(para)
25125
msgid ""
25126
"For more details, please refer to the <ulink "
25127
"url=\"http://moinmo.in/\">MoinMoin</ulink> web site."
25128
msgstr ""
25129
25130
#: serverguide/C/lamp-applications.xml:264(para)
25131
msgid ""
25132
"For more information see the <ulink url=\"http://moinmo.in/\">moinmoin "
25133
"Wiki</ulink>."
25134
msgstr ""
25135
25136
#: serverguide/C/lamp-applications.xml:269(para)
25137
msgid ""
25138
"Also, see the <ulink "
25139
"url=\"https://help.ubuntu.com/community/MoinMoin\">Ubuntu Wiki "
25140
"MoinMoin</ulink> page."
25141
msgstr ""
25142
25143
#: serverguide/C/lamp-applications.xml:278(title)
25144
msgid "phpMyAdmin"
25145
msgstr ""
25146
25147
#: serverguide/C/lamp-applications.xml:280(para)
25148
msgid ""
25149
"<application>phpMyAdmin</application> is a LAMP application specifically "
25150
"written for administering <application>MySQL</application> servers. Written "
25151
"in <application>PHP</application>, and accessed through a web browser, "
25152
"phpMyAdmin provides a graphical interface for database administration tasks."
25153
msgstr ""
25154
25155
#: serverguide/C/lamp-applications.xml:289(para)
25156
msgid ""
25157
"Before installing <application>phpMyAdmin</application> you will need access "
25158
"to a <application>MySQL</application> database either on the same host as "
25159
"that phpMyAdmin is installed on, or on a host accessible over the network. "
25160
"For more information see <xref linkend=\"mysql\"/>. From a terminal prompt "
25161
"enter:"
25162
msgstr ""
25163
25164
#: serverguide/C/lamp-applications.xml:296(command)
25165
msgid "sudo apt install phpmyadmin"
25166
msgstr ""
25167
25168
#: serverguide/C/lamp-applications.xml:299(para)
25169
msgid ""
25170
"At the prompt choose which web server to be configured for "
25171
"<application>phpMyAdmin</application>. The rest of this section will use "
25172
"<application>Apache2</application> for the web server."
25173
msgstr ""
25174
25175
#: serverguide/C/lamp-applications.xml:304(para)
25176
msgid ""
25177
"In a browser go to <emphasis>http://servername/phpmyadmin</emphasis>, "
25178
"replacing <emphasis role=\"italic\">servername</emphasis> with the server's "
25179
"actual hostname. At the login, page enter <emphasis>root</emphasis> for the "
25180
"<emphasis>username</emphasis>, or another <application>MySQL</application> "
25181
"user, if you have any setup, and enter the <application>MySQL</application> "
25182
"user's password."
25183
msgstr ""
25184
25185
#: serverguide/C/lamp-applications.xml:311(para)
25186
msgid ""
25187
"Once logged in you can reset the <emphasis>root</emphasis> password if "
25188
"needed, create users, create/destroy databases and tables, etc."
25189
msgstr ""
25190
25191
#: serverguide/C/lamp-applications.xml:319(para)
25192
msgid ""
25193
"The configuration files for <application>phpMyAdmin</application> are "
25194
"located in <filename>/etc/phpmyadmin</filename>. The main configuration file "
25195
"is <filename>/etc/phpmyadmin/config.inc.php</filename>. This file contains "
25196
"configuration options that apply globally to "
25197
"<application>phpMyAdmin</application>."
25198
msgstr ""
25199
25200
#: serverguide/C/lamp-applications.xml:325(para)
25201
msgid ""
25202
"To use <application>phpMyAdmin</application> to administer a MySQL database "
25203
"hosted on another server, adjust the following in "
25204
"<filename>/etc/phpmyadmin/config.inc.php</filename>:"
25205
msgstr ""
25206
25207
#: serverguide/C/lamp-applications.xml:330(programlisting)
25208
#, no-wrap
25209
msgid ""
25210
"\n"
25211
"$cfg['Servers'][$i]['host'] = 'db_server';\n"
25212
msgstr ""
25213
25214
#: serverguide/C/lamp-applications.xml:335(para)
25215
msgid ""
25216
"Replace <emphasis role=\"italic\">db_server</emphasis> with the actual "
25217
"remote database server name or IP address. Also, be sure that the "
25218
"<application>phpMyAdmin</application> host has permissions to access the "
25219
"remote database."
25220
msgstr ""
25221
25222
#: serverguide/C/lamp-applications.xml:341(para)
25223
msgid ""
25224
"Once configured, log out of <application>phpMyAdmin</application> and back "
25225
"in, and you should be accessing the new server."
25226
msgstr ""
25227
25228
#: serverguide/C/lamp-applications.xml:345(para)
25229
msgid ""
25230
"The <filename>config.header.inc.php</filename> and "
25231
"<filename>config.footer.inc.php</filename> files are used to add a HTML "
25232
"header and footer to <application>phpMyAdmin</application>."
25233
msgstr ""
25234
25235
#: serverguide/C/lamp-applications.xml:350(para)
25236
msgid ""
25237
"Another important configuration file is "
25238
"<filename>/etc/phpmyadmin/apache.conf</filename>, this file is symlinked to "
25239
"<filename>/etc/apache2/conf-available/phpmyadmin.conf</filename>, and, once "
25240
"enabled, is used to configure <application>Apache2</application> to serve "
25241
"the <application>phpMyAdmin</application> site. The file contains directives "
25242
"for loading <application>PHP</application>, directory permissions, etc. From "
25243
"a terminal type:"
25244
msgstr ""
25245
25246
#: serverguide/C/lamp-applications.xml:358(command)
25247
msgid ""
25248
"sudo ln -s /etc/phpmyadmin/apache.conf /etc/apache2/conf-"
25249
"available/phpmyadmin.conf"
25250
msgstr ""
25251
25252
#: serverguide/C/lamp-applications.xml:359(command)
25253
msgid "sudo a2enconf phpmyadmin.conf"
25254
msgstr ""
25255
25256
#: serverguide/C/lamp-applications.xml:363(para)
25257
msgid ""
25258
"For more information on configuring <application>Apache2</application> see "
25259
"<xref linkend=\"httpd\"/>."
25260
msgstr ""
25261
25262
#: serverguide/C/lamp-applications.xml:374(para)
25263
msgid ""
25264
"The <application>phpMyAdmin</application> documentation comes installed with "
25265
"the package and can be accessed from the <emphasis>phpMyAdmin "
25266
"Documentation</emphasis> link (a question mark with a box around it) under "
25267
"the phpMyAdmin logo. The official docs can also be access on the <ulink "
25268
"url=\"http://www.phpmyadmin.net/home_page/docs.php\">phpMyAdmin</ulink> site."
25269
msgstr ""
25270
25271
#: serverguide/C/lamp-applications.xml:381(para)
25272
msgid ""
25273
"Also, <ulink url=\"http://www.packtpub.com/phpmyadmin-3rd-"
25274
"edition/book\">Mastering phpMyAdmin</ulink> is a great resource."
25275
msgstr ""
25276
25277
#: serverguide/C/lamp-applications.xml:386(para)
25278
msgid ""
25279
"A third resource is the <ulink "
25280
"url=\"https://help.ubuntu.com/community/phpMyAdmin\">phpMyAdmin Ubuntu "
25281
"Wiki</ulink> page."
25282
msgstr ""
25283
25284
#: serverguide/C/lamp-applications.xml:395(title)
25285
msgid "WordPress"
25286
msgstr ""
25287
25288
#: serverguide/C/lamp-applications.xml:396(para)
25289
msgid ""
25290
"Wordpress is a blog tool, publishing platform and CMS implemented in PHP and "
25291
"licensed under the GNU GPLv2."
25292
msgstr ""
25293
25294
#: serverguide/C/lamp-applications.xml:402(para)
25295
msgid ""
25296
"To install <application>WordPress</application>, run the following comand in "
25297
"the command prompt:"
25298
msgstr ""
25299
25300
#: serverguide/C/lamp-applications.xml:407(command)
25301
msgid "sudo apt install wordpress"
25302
msgstr ""
25303
25304
#: serverguide/C/lamp-applications.xml:410(para)
25305
msgid ""
25306
"You should also install <application>apache2</application> web server and "
25307
"<application>mysql</application> server. For installing "
25308
"<application>apache2</application> web server, please refer to <xref "
25309
"linkend=\"http-installation\"/> sub-section in <xref linkend=\"httpd\"/> "
25310
"section. For installing <application>mysql</application> server, please "
25311
"refer to <xref linkend=\"mysql-installation\"/> sub-section in <xref "
25312
"linkend=\"mysql\"/> section."
25313
msgstr ""
25314
25315
#: serverguide/C/lamp-applications.xml:424(para)
25316
msgid ""
25317
"For configuring your first <application>WordPress</application> application, "
25318
"configure an apache site. Open <filename>/etc/apache2/sites-"
25319
"available/wordpress.conf</filename> and write the following lines:"
25320
msgstr ""
25321
25322
#: serverguide/C/lamp-applications.xml:431(programlisting)
25323
#, no-wrap
25324
msgid ""
25325
"\n"
25326
" Alias /blog /usr/share/wordpress\n"
25327
" <Directory /usr/share/wordpress>\n"
25328
" Options FollowSymLinks\n"
25329
" AllowOverride Limit Options FileInfo\n"
25330
" DirectoryIndex index.php\n"
25331
" Order allow,deny\n"
25332
" Allow from all\n"
25333
" </Directory>\n"
25334
" <Directory /usr/share/wordpress/wp-content>\n"
25335
" Options FollowSymLinks\n"
25336
" Order allow,deny\n"
25337
" Allow from all\n"
25338
" </Directory>\n"
25339
" "
25340
msgstr ""
25341
25342
#: serverguide/C/lamp-applications.xml:447(para)
25343
msgid "Enable this new <application>WordPress</application> site"
25344
msgstr ""
25345
25346
#: serverguide/C/lamp-applications.xml:450(command)
25347
msgid "sudo a2ensite wordpress"
25348
msgstr ""
25349
25350
#: serverguide/C/lamp-applications.xml:453(para)
25351
msgid ""
25352
"Once you configure the <application>apache2</application> web server and "
25353
"make it ready for your <application>WordPress</application> application, you "
25354
"should restart it. You can run the following command to restart the "
25355
"<application>apache2</application> web server:"
25356
msgstr ""
25357
25358
#: serverguide/C/lamp-applications.xml:465(para)
25359
msgid ""
25360
"To facilitate multiple <application>WordPress</application> installations, "
25361
"the name of this configuration file is based on the Host header of the HTTP "
25362
"request. This means that you can have a configuration per VirtualHost by "
25363
"simply matching the hostname portion of this configuration with your Apache "
25364
"Virtual Host. e.g. /etc/wordpress/config-10.211.55.50.php, "
25365
"/etc/wordpress/config-hostalias1.php, etc. These instructions assume you can "
25366
"access Apache via the localhost hostname (perhaps by using an ssh tunnel) if "
25367
"not, replace /etc/wordpress/config-localhost.php with /etc/wordpress/config-"
25368
"NAME_OF_YOUR_VIRTUAL_HOST.php."
25369
msgstr ""
25370
25371
#: serverguide/C/lamp-applications.xml:476(para)
25372
msgid ""
25373
"Once the configuration file is written, it is up to you to choose a "
25374
"convention for username and password to mysql for each "
25375
"<application>WordPress</application> database instance. This documentation "
25376
"shows only one, localhost, example."
25377
msgstr ""
25378
25379
#: serverguide/C/lamp-applications.xml:483(para)
25380
msgid ""
25381
"Now configure <application>WordPress</application> to use a mysql database. "
25382
"Open <filename>/etc/wordpress/config-localhost.php</filename> file and write "
25383
"the following lines:"
25384
msgstr ""
25385
25386
#: serverguide/C/lamp-applications.xml:489(programlisting)
25387
#, no-wrap
25388
msgid ""
25389
"\n"
25390
"<?php\n"
25391
"define('DB_NAME', 'wordpress');\n"
25392
"define('DB_USER', 'wordpress');\n"
25393
"define('DB_PASSWORD', 'yourpasswordhere');\n"
25394
"define('DB_HOST', 'localhost');\n"
25395
"define('WP_CONTENT_DIR', '/usr/share/wordpress/wp-content');\n"
25396
"?>\n"
25397
msgstr ""
25398
25399
#: serverguide/C/lamp-applications.xml:498(para)
25400
msgid ""
25401
"Now create this mysql database. Open a temporary file with mysql commands "
25402
"<filename>wordpress.sql</filename> and write the following lines:"
25403
msgstr ""
25404
25405
#: serverguide/C/lamp-applications.xml:501(programlisting)
25406
#, no-wrap
25407
msgid ""
25408
"\n"
25409
"CREATE DATABASE wordpress;\n"
25410
"GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,DROP,ALTER\n"
25411
"ON wordpress.*\n"
25412
"TO wordpress@localhost\n"
25413
"IDENTIFIED BY 'yourpasswordhere';\n"
25414
"FLUSH PRIVILEGES;\n"
25415
msgstr ""
25416
25417
#: serverguide/C/lamp-applications.xml:509(para)
25418
msgid "Execute these commands."
25419
msgstr ""
25420
25421
#: serverguide/C/lamp-applications.xml:511(command)
25422
msgid ""
25423
"cat wordpress.sql | sudo mysql --defaults-extra-file=/etc/mysql/debian.cnf"
25424
msgstr ""
25425
25426
#: serverguide/C/lamp-applications.xml:513(para)
25427
msgid ""
25428
"Your new <application>WordPress</application> can now be configured by "
25429
"visiting <ulink url=\"http://localhost/blog/wp-"
25430
"admin/install.php\">http://localhost/blog/wp-admin/install.php</ulink>. (Or "
25431
"<ulink url=\"http://NAME_OF_YOUR_VIRTUAL_HOST/blog/wp-"
25432
"admin/install.php\">http://NAME_OF_YOUR_VIRTUAL_HOST/blog/wp-"
25433
"admin/install.php</ulink> if your server has no GUI and you are completing "
25434
"<application>WordPress</application> configuration via a web browser running "
25435
"on another computer.) Fill out the Site Title, username, password, and E-"
25436
"mail and click Install WordPress."
25437
msgstr ""
25438
25439
#: serverguide/C/lamp-applications.xml:520(para)
25440
msgid ""
25441
"Note the generated password (if applicable) and click the login password. "
25442
"Your <application>WordPress</application> is now ready for use."
25443
msgstr ""
25444
25445
#: serverguide/C/lamp-applications.xml:530(ulink)
25446
msgid "WordPress.org Codex"
25447
msgstr ""
25448
25449
#: serverguide/C/lamp-applications.xml:535(ulink)
25450
msgid "Ubuntu Wiki WordPress"
25451
msgstr ""
25452
25453
#: serverguide/C/introduction.xml:12(para)
25454
msgid "Welcome to the <emphasis>Ubuntu Server Guide</emphasis>!"
25455
msgstr "Selamat datang di <emphasis>Petunjuk Ubuntu Server</emphasis>!"
25456
25457
#: serverguide/C/introduction.xml:13(para)
25458
msgid ""
25459
"Here you can find information on how to install and configure various server "
25460
"applications. It is a step-by-step, task-oriented guide for configuring and "
25461
"customizing your system."
25462
msgstr ""
25463
25464
#: serverguide/C/introduction.xml:17(para)
25465
msgid ""
25466
"This guide assumes you have a basic understanding of your Ubuntu system. "
25467
"Some installation details are covered in <xref linkend=\"installation\"/>, "
25468
"but if you need detailed instructions installing Ubuntu please refer to the "
25469
"<ulink url=\"https://help.ubuntu.com/16.04/installation-guide/\">Ubuntu "
25470
"Installation Guide</ulink>."
25471
msgstr ""
25472
25473
#: serverguide/C/introduction.xml:23(para)
25474
msgid ""
25475
"A HTML version of the manual is available online at <ulink "
25476
"url=\"https://help.ubuntu.com\">the Ubuntu Documentation website</ulink>."
25477
msgstr ""
25478
25479
#: serverguide/C/introduction.xml:29(title)
25480
msgid "Support"
25481
msgstr ""
25482
25483
#: serverguide/C/introduction.xml:31(para)
25484
msgid ""
25485
"There are a couple of different ways that Ubuntu Server Edition is "
25486
"supported: commercial support and community support. The main commercial "
25487
"support (and development funding) is available from Canonical, Ltd. They "
25488
"supply reasonably- priced support contracts on a per desktop or per server "
25489
"basis. For more information see the <ulink "
25490
"url=\"http://www.ubuntu.com/management\">Ubuntu Advantage</ulink> page."
25491
msgstr ""
25492
25493
#: serverguide/C/introduction.xml:40(para)
25494
msgid ""
25495
"Community support is also provided by dedicated individuals and companies "
25496
"that wish to make Ubuntu the best distribution possible. Support is provided "
25497
"through multiple mailing lists, IRC channels, forums, blogs, wikis, etc. The "
25498
"large amount of information available can be overwhelming, but a good search "
25499
"engine query can usually provide an answer to your questions. See the <ulink "
25500
"url=\"http://www.ubuntu.com/support\">Ubuntu Support</ulink> page for more "
25501
"information."
25502
msgstr ""
25503
25504
#: serverguide/C/installation.xml:12(para)
25505
msgid ""
25506
"This chapter provides a quick overview of installing Ubuntu 16.04 LTS Server "
25507
"Edition. For more detailed instructions, please refer to the <ulink "
25508
"url=\"https://help.ubuntu.com/16.04/installation-guide/\">Ubuntu "
25509
"Installation Guide</ulink>."
25510
msgstr ""
25511
25512
#: serverguide/C/installation.xml:17(title)
25513
msgid "Preparing to Install"
25514
msgstr "Persiapan Instalasi"
25515
25516
#: serverguide/C/installation.xml:18(para)
25517
msgid ""
25518
"This section explains various aspects to consider before starting the "
25519
"installation."
25520
msgstr ""
25521
"Bagian ini akan menjelaskan berbagai aspek yang harus diperhatikan sebelum "
25522
"melakukan instalasi."
25523
25524
#: serverguide/C/installation.xml:22(title)
25525
msgid "System Requirements"
25526
msgstr "Kebutuhan Sistem"
25527
25528
#: serverguide/C/installation.xml:23(para)
25529
msgid ""
25530
"Ubuntu 16.04 LTS Server Edition supports three (3) major architectures: "
25531
"Intel x86, AMD64 and ARM. The table below lists recommended hardware "
25532
"specifications. Depending on your needs, you might manage with less than "
25533
"this. However, most users risk being frustrated if they ignore these "
25534
"suggestions."
25535
msgstr ""
25536
25537
#: serverguide/C/installation.xml:26(title)
25538
msgid "Recommended Minimum Requirements"
25539
msgstr "Kebutuhan Minimum Yang Direkomendasikan"
25540
25541
#: serverguide/C/installation.xml:35(para)
25542
msgid "Install Type"
25543
msgstr "Jenis Instalasi"
25544
25545
#: serverguide/C/installation.xml:36(para)
25546
msgid "CPU"
25547
msgstr ""
25548
25549
#: serverguide/C/installation.xml:37(para)
25550
msgid "RAM"
25551
msgstr "RAM"
25552
25553
#: serverguide/C/installation.xml:38(para)
25554
msgid "Hard Drive Space"
25555
msgstr "Kapasitas Cakram Keras"
25556
25557
#: serverguide/C/installation.xml:41(para)
25558
msgid "Base System"
25559
msgstr ""
25560
25561
#: serverguide/C/installation.xml:42(para)
25562
msgid "All Tasks Installed"
25563
msgstr ""
25564
25565
#: serverguide/C/installation.xml:47(para)
25566
msgid "Server (Standard)"
25567
msgstr ""
25568
25569
#: serverguide/C/installation.xml:48(para)
25570
msgid "1 gigahertz"
25571
msgstr ""
25572
25573
#: serverguide/C/installation.xml:49(para)
25574
msgid "512 megabytes"
25575
msgstr ""
25576
25577
#: serverguide/C/installation.xml:50(para)
25578
msgid "1.5 gigabyte"
25579
msgstr ""
25580
25581
#: serverguide/C/installation.xml:51(para) serverguide/C/installation.xml:58(para)
25582
msgid "2.5 gigabytes"
25583
msgstr ""
25584
25585
#: serverguide/C/installation.xml:54(para)
25586
msgid "Server (Minimal)"
25587
msgstr ""
25588
25589
#: serverguide/C/installation.xml:55(para)
25590
msgid "300 megahertz"
25591
msgstr ""
25592
25593
#: serverguide/C/installation.xml:56(para)
25594
msgid "384 megabytes"
25595
msgstr ""
25596
25597
#: serverguide/C/installation.xml:57(para)
25598
msgid "1.5 megabytes"
25599
msgstr ""
25600
25601
#: serverguide/C/installation.xml:64(para)
25602
msgid ""
25603
"The Server Edition provides a common base for all sorts of server "
25604
"applications. It is a minimalist design providing a platform for the desired "
25605
"services, such as file/print services, web hosting, email hosting, etc."
25606
msgstr ""
25607
25608
#: serverguide/C/installation.xml:72(title)
25609
msgid "Server and Desktop Differences"
25610
msgstr ""
25611
25612
#: serverguide/C/installation.xml:73(para)
25613
msgid ""
25614
"There are a few differences between the <emphasis>Ubuntu Server "
25615
"Edition</emphasis> and the <emphasis>Ubuntu Desktop Edition</emphasis>. It "
25616
"should be noted that both editions use the same "
25617
"<application>apt</application> repositories, making it just as easy to "
25618
"install a <emphasis role=\"italic\">server</emphasis> application on the "
25619
"Desktop Edition as it is on the Server Edition."
25620
msgstr ""
25621
25622
#: serverguide/C/installation.xml:79(para)
25623
msgid ""
25624
"The differences between the two editions are the lack of an X window "
25625
"environment in the Server Edition and the installation process."
25626
msgstr ""
25627
25628
#: serverguide/C/installation.xml:86(title)
25629
msgid "Kernel Differences:"
25630
msgstr ""
25631
25632
#: serverguide/C/installation.xml:87(para)
25633
msgid ""
25634
"Ubuntu version 10.10 and prior, actually had different kernels for the "
25635
"server and desktop editions. Ubuntu no longer has separate -server and -"
25636
"generic kernel flavors. These have been merged into a single -generic kernel "
25637
"flavor to help reduce the maintenance burden over the life of the release."
25638
msgstr ""
25639
25640
#: serverguide/C/installation.xml:92(para)
25641
msgid ""
25642
"When running a 64-bit version of Ubuntu on 64-bit processors you are not "
25643
"limited by memory addressing space."
25644
msgstr ""
25645
25646
#: serverguide/C/installation.xml:97(para)
25647
msgid ""
25648
"To see all kernel configuration options you can look through "
25649
"<filename>/boot/config-4.4.0-server</filename>. Also, <ulink "
25650
"url=\"http://www.kroah.com/lkn/\">Linux Kernel in a Nutshell</ulink> is a "
25651
"great resource on the options available."
25652
msgstr ""
25653
25654
#: serverguide/C/installation.xml:106(title)
25655
msgid "Backing Up"
25656
msgstr "Membuat Backup"
25657
25658
#: serverguide/C/installation.xml:109(para)
25659
msgid ""
25660
"Before installing <application>Ubuntu Server Edition</application> you "
25661
"should make sure all data on the system is backed up. See <xref "
25662
"linkend=\"backups\"/> for backup options."
25663
msgstr ""
25664
25665
#: serverguide/C/installation.xml:113(para)
25666
msgid ""
25667
"If this is not the first time an operating system has been installed on your "
25668
"computer, it is likely you will need to re-partition your disk to make room "
25669
"for Ubuntu."
25670
msgstr ""
25671
25672
#: serverguide/C/installation.xml:117(para)
25673
msgid ""
25674
"Any time you partition your disk, you should be prepared to lose everything "
25675
"on the disk should you make a mistake or something goes wrong during "
25676
"partitioning. The programs used in installation are quite reliable, most "
25677
"have seen years of use, but they also perform destructive actions."
25678
msgstr ""
25679
25680
#: serverguide/C/installation.xml:130(para)
25681
msgid ""
25682
"The basic steps to install Ubuntu Server Edition are the same as those for "
25683
"installing any operating system. Unlike the <emphasis>Desktop "
25684
"Edition</emphasis>, the <emphasis>Server Edition</emphasis> does not include "
25685
"a graphical installation program. The Server Edition uses a console menu "
25686
"based process instead."
25687
msgstr ""
25688
25689
#: serverguide/C/installation.xml:137(para)
25690
msgid ""
25691
"Download the appropriate ISO file from the <ulink "
25692
"url=\"http://www.ubuntu.com/download/server/download\"> Ubuntu web "
25693
"site</ulink>."
25694
msgstr ""
25695
25696
#: serverguide/C/installation.xml:143(para)
25697
msgid "Boot the system from media (e.g. USB key) containing the ISO file."
25698
msgstr ""
25699
25700
#: serverguide/C/installation.xml:148(para)
25701
msgid "At the boot prompt you will be asked to select a language."
25702
msgstr ""
25703
25704
#: serverguide/C/installation.xml:153(para)
25705
msgid ""
25706
"From the main boot menu there are some additional options to install Ubuntu "
25707
"Server Edition. You can install a basic Ubuntu Server, check the CD-ROM for "
25708
"defects, check the system's RAM, boot from first hard disk, or rescue a "
25709
"broken system. The rest of this section will cover the basic Ubuntu Server "
25710
"install."
25711
msgstr ""
25712
25713
#: serverguide/C/installation.xml:160(para)
25714
msgid ""
25715
"The installer asks which language it should use. Afterwards, you are asked "
25716
"to select your location."
25717
msgstr ""
25718
25719
#: serverguide/C/installation.xml:166(para)
25720
msgid ""
25721
"Next, the installation process begins by asking for your keyboard layout. "
25722
"You can ask the installer to attempt auto-detecting it, or you can select it "
25723
"manually from a list."
25724
msgstr ""
25725
25726
#: serverguide/C/installation.xml:172(para)
25727
msgid ""
25728
"The installer then discovers your hardware configuration, and configures the "
25729
"network settings using DHCP. If you do not wish to use DHCP at the next "
25730
"screen choose \"Go Back\", and you have the option to \"Configure the "
25731
"network manually\"."
25732
msgstr ""
25733
25734
#: serverguide/C/installation.xml:179(para)
25735
msgid "Next, the installer asks for the system's hostname."
25736
msgstr ""
25737
25738
#: serverguide/C/installation.xml:184(para)
25739
msgid ""
25740
"A new user is set up; this user will have <emphasis>root</emphasis> access "
25741
"through the <application>sudo</application> utility."
25742
msgstr ""
25743
25744
#: serverguide/C/installation.xml:190(para)
25745
msgid ""
25746
"After the user settings have been completed, you will be asked if you want "
25747
"to encrypt your <filename role=\"directory\">home</filename> directory."
25748
msgstr ""
25749
25750
#: serverguide/C/installation.xml:196(para)
25751
msgid "Next, the installer asks for the system's Time Zone."
25752
msgstr ""
25753
25754
#: serverguide/C/installation.xml:201(para)
25755
msgid ""
25756
"You can then choose from several options to configure the hard drive layout. "
25757
"Afterwards you are asked which disk to install to. You may get confirmation "
25758
"prompts before rewriting the partition table or setting up LVM depending on "
25759
"disk layout. If you choose LVM, you will be asked for the size of the root "
25760
"logical volume. For advanced disk options see <xref linkend=\"advanced-"
25761
"installation\"/>."
25762
msgstr ""
25763
25764
#: serverguide/C/installation.xml:209(para)
25765
msgid "The Ubuntu base system is then installed."
25766
msgstr ""
25767
25768
#: serverguide/C/installation.xml:214(para)
25769
msgid ""
25770
"The next step in the installation process is to decide how you want to "
25771
"update the system. There are three options:"
25772
msgstr ""
25773
25774
#: serverguide/C/installation.xml:220(para)
25775
msgid ""
25776
"<emphasis>No automatic updates</emphasis>: this requires an administrator to "
25777
"log into the machine and manually install updates."
25778
msgstr ""
25779
25780
#: serverguide/C/installation.xml:226(para)
25781
msgid ""
25782
"<emphasis>Install security updates automatically</emphasis>: this will "
25783
"install the <application>unattended-upgrades</application> package, which "
25784
"will install security updates without the intervention of an administrator. "
25785
"For more details see <xref linkend=\"automatic-updates\"/>."
25786
msgstr ""
25787
25788
#: serverguide/C/installation.xml:233(para)
25789
msgid ""
25790
"<emphasis>Manage the system with Landscape</emphasis>: Landscape is a paid "
25791
"service provided by Canonical to help manage your Ubuntu machines. See the "
25792
"<ulink url=\"http://landscape.canonical.com/\">Landscape</ulink> site for "
25793
"details."
25794
msgstr ""
25795
25796
#: serverguide/C/installation.xml:242(para)
25797
msgid ""
25798
"You now have the option to install, or not install, several package tasks. "
25799
"See <xref linkend=\"install-tasks\"/> for details. Also, there is an option "
25800
"to launch <application>aptitude</application> to choose specific packages to "
25801
"install. For more information see <xref linkend=\"aptitude\"/>."
25802
msgstr ""
25803
25804
#: serverguide/C/installation.xml:250(para)
25805
msgid "Finally, the last step before rebooting is to set the clock to UTC."
25806
msgstr ""
25807
25808
#: serverguide/C/installation.xml:256(para)
25809
msgid ""
25810
"If at any point during installation you are not satisfied by the default "
25811
"setting, use the \"Go Back\" function at any prompt to be brought to a "
25812
"detailed installation menu that will allow you to modify the default "
25813
"settings."
25814
msgstr ""
25815
25816
#: serverguide/C/installation.xml:261(para)
25817
msgid ""
25818
"At some point during the installation process you may want to read the help "
25819
"screen provided by the installation system. To do this, press F1."
25820
msgstr ""
25821
25822
#: serverguide/C/installation.xml:266(para)
25823
msgid ""
25824
"Once again, for detailed instructions see the <ulink "
25825
"url=\"https://help.ubuntu.com/16.04/installation-guide/\"> Ubuntu "
25826
"Installation Guide</ulink>."
25827
msgstr ""
25828
25829
#: serverguide/C/installation.xml:272(title)
25830
msgid "Package Tasks"
25831
msgstr ""
25832
25833
#: serverguide/C/installation.xml:273(para)
25834
msgid ""
25835
"During the Server Edition installation you have the option of installing "
25836
"additional packages. The packages are grouped by the type of service they "
25837
"provide."
25838
msgstr ""
25839
25840
#: serverguide/C/installation.xml:279(para)
25841
msgid "DNS server: Selects the BIND DNS server and its documentation."
25842
msgstr ""
25843
25844
#: serverguide/C/installation.xml:284(para)
25845
msgid "LAMP server: Selects a ready-made Linux/Apache/MySQL/PHP server."
25846
msgstr ""
25847
25848
#: serverguide/C/installation.xml:289(para)
25849
msgid ""
25850
"Mail server: This task selects a variety of packages useful for a general "
25851
"purpose mail server system."
25852
msgstr ""
25853
25854
#: serverguide/C/installation.xml:294(para)
25855
msgid "OpenSSH server: Selects packages needed for an OpenSSH server."
25856
msgstr ""
25857
25858
#: serverguide/C/installation.xml:299(para)
25859
msgid ""
25860
"PostgreSQL database: This task selects client and server packages for the "
25861
"PostgreSQL database."
25862
msgstr ""
25863
25864
#: serverguide/C/installation.xml:304(para)
25865
msgid "Print server: This task sets up your system to be a print server."
25866
msgstr ""
25867
25868
#: serverguide/C/installation.xml:309(para)
25869
msgid ""
25870
"Samba File server: This task sets up your system to be a Samba file server, "
25871
"which is especially suitable in networks with both Windows and Linux systems."
25872
msgstr ""
25873
25874
#: serverguide/C/installation.xml:315(para)
25875
msgid "Tomcat Java server: Installs Apache Tomcat and needed dependencies."
25876
msgstr ""
25877
25878
#: serverguide/C/installation.xml:320(para)
25879
msgid ""
25880
"Virtual Machine host: Includes packages needed to run KVM virtual machines."
25881
msgstr ""
25882
25883
#: serverguide/C/installation.xml:325(para)
25884
msgid ""
25885
"Manually select packages: Executes <application>aptitude</application> "
25886
"allowing you to individually select packages."
25887
msgstr ""
25888
25889
#: serverguide/C/installation.xml:330(para)
25890
msgid ""
25891
"Installing the package groups is accomplished using the "
25892
"<application>tasksel</application> utility. One of the important differences "
25893
"between Ubuntu (or Debian) and other GNU/Linux distribution is that, when "
25894
"installed, a package is also configured to reasonable defaults, eventually "
25895
"prompting you for additional required information. Likewise, when installing "
25896
"a task, the packages are not only installed, but also configured to provided "
25897
"a fully integrated service."
25898
msgstr ""
25899
25900
#: serverguide/C/installation.xml:337(para)
25901
msgid ""
25902
"Once the installation process has finished you can view a list of available "
25903
"tasks by entering the following from a terminal prompt:"
25904
msgstr ""
25905
25906
#: serverguide/C/installation.xml:342(command)
25907
msgid "tasksel --list-tasks"
25908
msgstr ""
25909
25910
#: serverguide/C/installation.xml:345(para)
25911
msgid ""
25912
"The output will list tasks from other Ubuntu based distributions such as "
25913
"Kubuntu and Edubuntu. Note that you can also invoke the "
25914
"<command>tasksel</command> command by itself, which will bring up a menu of "
25915
"the different tasks available."
25916
msgstr ""
25917
25918
#: serverguide/C/installation.xml:351(para)
25919
msgid ""
25920
"You can view a list of which packages are installed with each task using the "
25921
"<emphasis>--task-packages</emphasis> option. For example, to list the "
25922
"packages installed with the <emphasis>DNS Server</emphasis> task enter the "
25923
"following:"
25924
msgstr ""
25925
25926
#: serverguide/C/installation.xml:356(command)
25927
msgid "tasksel --task-packages dns-server"
25928
msgstr ""
25929
25930
#: serverguide/C/installation.xml:358(para)
25931
msgid "The output of the command should list:"
25932
msgstr ""
25933
25934
#: serverguide/C/installation.xml:361(programlisting)
25935
#, no-wrap
25936
msgid ""
25937
"\n"
25938
"bind9-doc \n"
25939
"bind9utils \n"
25940
"bind9\n"
25941
msgstr ""
25942
25943
#: serverguide/C/installation.xml:366(para)
25944
msgid ""
25945
"If you did not install one of the tasks during the installation process, but "
25946
"for example you decide to make your new LAMP server a DNS server as well, "
25947
"simply insert the installation media and from a terminal:"
25948
msgstr ""
25949
25950
#: serverguide/C/installation.xml:371(command)
25951
msgid "sudo tasksel install dns-server"
25952
msgstr ""
25953
25954
#: serverguide/C/installation.xml:376(title)
25955
msgid "Upgrading"
25956
msgstr ""
25957
25958
#: serverguide/C/installation.xml:377(para)
25959
msgid ""
25960
"There are several ways to upgrade from one Ubuntu release to another. This "
25961
"section gives an overview of the recommended upgrade method."
25962
msgstr ""
25963
25964
#: serverguide/C/installation.xml:381(title) serverguide/C/installation.xml:396(command)
25965
msgid "do-release-upgrade"
25966
msgstr ""
25967
25968
#: serverguide/C/installation.xml:382(para)
25969
msgid ""
25970
"The recommended way to upgrade a Server Edition installation is to use the "
25971
"<application>do-release-upgrade</application> utility. Part of the "
25972
"<emphasis>update-manager-core</emphasis> package, it does not have any "
25973
"graphical dependencies and is installed by default."
25974
msgstr ""
25975
25976
#: serverguide/C/installation.xml:387(para)
25977
msgid ""
25978
"Debian based systems can also be upgraded by using <command>apt dist-"
25979
"upgrade</command>. However, using <application>do-release-"
25980
"upgrade</application> is recommended because it has the ability to handle "
25981
"system configuration changes sometimes needed between releases."
25982
msgstr ""
25983
25984
#: serverguide/C/installation.xml:392(para)
25985
msgid "To upgrade to a newer release, from a terminal prompt enter:"
25986
msgstr ""
25987
25988
#: serverguide/C/installation.xml:398(para)
25989
msgid ""
25990
"It is also possible to use <application>do-release-upgrade</application> to "
25991
"upgrade to a development version of Ubuntu. To accomplish this use the "
25992
"<emphasis>-d</emphasis> switch:"
25993
msgstr ""
25994
25995
#: serverguide/C/installation.xml:403(command)
25996
msgid "do-release-upgrade -d"
25997
msgstr ""
25998
25999
#: serverguide/C/installation.xml:406(para)
26000
msgid ""
26001
"Upgrading to a development release is <emphasis>not</emphasis> recommended "
26002
"for production environments."
26003
msgstr ""
26004
26005
#: serverguide/C/installation.xml:410(para)
26006
msgid ""
26007
"For further stability of a LTS release there is a slight change in behaviour "
26008
"if you are currently running a LTS version. LTS systems are only "
26009
"automatically considered for an upgrade to the next LTS via <application>do-"
26010
"release-upgrade</application> with the first point release. So for example "
26011
"14.04 will only upgrade once 16.04.1 is released. If you want to update "
26012
"before, e.g. on a subset of machines to evaluate the LTS upgrade for your "
26013
"setup the same argument as an upgrade to a dev release has to be used via "
26014
"the <emphasis>-d</emphasis> switch."
26015
msgstr ""
26016
26017
#: serverguide/C/installation.xml:419(title)
26018
msgid "Advanced Installation"
26019
msgstr ""
26020
26021
#: serverguide/C/installation.xml:422(title)
26022
msgid "Software RAID"
26023
msgstr ""
26024
26025
#: serverguide/C/installation.xml:424(para)
26026
msgid ""
26027
"Redundant Array of Independent Disks \"RAID\" is a method of using multiple "
26028
"disks to provide different balances of increasing data reliability and/or "
26029
"increasing input/output performance, depending on the RAID level being used. "
26030
"RAID is implemented in either software (where the operating system knows "
26031
"about both drives and actively maintains both of them) or hardware (where a "
26032
"special controller makes the OS think there's only one drive and maintains "
26033
"the drives 'invisibly')."
26034
msgstr ""
26035
26036
#: serverguide/C/installation.xml:432(para)
26037
msgid ""
26038
"The RAID software included with current versions of Linux (and Ubuntu) is "
26039
"based on the <application>'mdadm'</application> driver and works very well, "
26040
"better even than many so-called 'hardware' RAID controllers. This section "
26041
"will guide you through installing Ubuntu Server Edition using two RAID1 "
26042
"partitions on two physical hard drives, one for <emphasis>/</emphasis> and "
26043
"another for <emphasis>swap</emphasis>."
26044
msgstr ""
26045
26046
#: serverguide/C/installation.xml:440(title)
26047
msgid "Partitioning"
26048
msgstr ""
26049
26050
#: serverguide/C/installation.xml:442(para) serverguide/C/installation.xml:964(para)
26051
msgid ""
26052
"Follow the installation steps until you get to the <emphasis>Partition "
26053
"disks</emphasis> step, then:"
26054
msgstr ""
26055
26056
#: serverguide/C/installation.xml:449(para)
26057
msgid "Select <emphasis>Manual</emphasis> as the partition method."
26058
msgstr ""
26059
26060
#: serverguide/C/installation.xml:456(para)
26061
msgid ""
26062
"Select the first hard drive, and agree to <emphasis>\"Create a new empty "
26063
"partition table on this device?\"</emphasis>."
26064
msgstr ""
26065
26066
#: serverguide/C/installation.xml:460(para)
26067
msgid ""
26068
"Repeat this step for each drive you wish to be part of the RAID array."
26069
msgstr ""
26070
26071
#: serverguide/C/installation.xml:467(para)
26072
msgid ""
26073
"Select the <emphasis>\"FREE SPACE\"</emphasis> on the first drive then "
26074
"select <emphasis>\"Create a new partition\"</emphasis>."
26075
msgstr ""
26076
26077
#: serverguide/C/installation.xml:474(para)
26078
msgid ""
26079
"Next, select the <emphasis>Size</emphasis> of the partition. This partition "
26080
"will be the <emphasis>swap</emphasis> partition, and a general rule for swap "
26081
"size is twice that of RAM. Enter the partition size, then choose "
26082
"<emphasis>Primary</emphasis>, then <emphasis>Beginning</emphasis>."
26083
msgstr ""
26084
26085
#: serverguide/C/installation.xml:481(para)
26086
msgid ""
26087
"A swap partition size of twice the available RAM capacity may not always be "
26088
"desirable, especially on systems with large amounts of RAM. Calculating the "
26089
"swap partition size for servers is highly dependent on how the system is "
26090
"going to be used."
26091
msgstr ""
26092
26093
#: serverguide/C/installation.xml:490(para)
26094
msgid ""
26095
"Select the <emphasis>\"Use as:\"</emphasis> line at the top. By default this "
26096
"is <emphasis role=\"italic\">\"Ext4 journaling file system\"</emphasis>, "
26097
"change that to <emphasis>\"physical volume for RAID\"</emphasis> then "
26098
"<emphasis>\"Done setting up partition\"</emphasis>."
26099
msgstr ""
26100
26101
#: serverguide/C/installation.xml:499(para)
26102
msgid ""
26103
"For the <emphasis>/</emphasis> partition once again select <emphasis>\"Free "
26104
"Space\"</emphasis> on the first drive then <emphasis>\"Create a new "
26105
"partition\"</emphasis>."
26106
msgstr ""
26107
26108
#: serverguide/C/installation.xml:507(para)
26109
msgid ""
26110
"Use the rest of the free space on the drive and choose "
26111
"<emphasis>Continue</emphasis>, then <emphasis>Primary</emphasis>."
26112
msgstr ""
26113
26114
#: serverguide/C/installation.xml:514(para)
26115
msgid ""
26116
"As with the swap partition, select the <emphasis>\"Use as:\"</emphasis> line "
26117
"at the top, changing it to <emphasis>\"physical volume for "
26118
"RAID\"</emphasis>. Also select the <emphasis>\"Bootable flag:\"</emphasis> "
26119
"line to change the value to <emphasis>\"on\"</emphasis>. Then choose "
26120
"<emphasis>\"Done setting up partition\"</emphasis>."
26121
msgstr ""
26122
26123
#: serverguide/C/installation.xml:524(para)
26124
msgid "Repeat steps three through eight for the other disk and partitions."
26125
msgstr ""
26126
26127
#: serverguide/C/installation.xml:533(title)
26128
msgid "RAID Configuration"
26129
msgstr ""
26130
26131
#: serverguide/C/installation.xml:535(para)
26132
msgid "With the partitions setup the arrays are ready to be configured:"
26133
msgstr ""
26134
26135
#: serverguide/C/installation.xml:542(para)
26136
msgid ""
26137
"Back in the main \"Partition Disks\" page, select <emphasis>\"Configure "
26138
"Software RAID\"</emphasis> at the top."
26139
msgstr ""
26140
26141
#: serverguide/C/installation.xml:549(para)
26142
msgid "Select <emphasis>\"yes\"</emphasis> to write the changes to disk."
26143
msgstr ""
26144
26145
#: serverguide/C/installation.xml:556(para)
26146
msgid "Choose <emphasis>\"Create MD device\"</emphasis>."
26147
msgstr ""
26148
26149
#: serverguide/C/installation.xml:563(para)
26150
msgid ""
26151
"For this example, select <emphasis>\"RAID1\"</emphasis>, but if you are "
26152
"using a different setup choose the appropriate type (RAID0 RAID1 RAID5)."
26153
msgstr ""
26154
26155
#: serverguide/C/installation.xml:569(para)
26156
msgid ""
26157
"In order to use <emphasis>RAID5</emphasis> you need at least "
26158
"<emphasis>three</emphasis> drives. Using RAID0 or RAID1 only "
26159
"<emphasis>two</emphasis> drives are required."
26160
msgstr ""
26161
26162
#: serverguide/C/installation.xml:578(para)
26163
msgid ""
26164
"Enter the number of active devices <emphasis>\"2\"</emphasis>, or the amount "
26165
"of hard drives you have, for the array. Then select "
26166
"<emphasis>\"Continue\"</emphasis>."
26167
msgstr ""
26168
26169
#: serverguide/C/installation.xml:586(para)
26170
msgid ""
26171
"Next, enter the number of spare devices <emphasis>\"0\"</emphasis> by "
26172
"default, then choose <emphasis>\"Continue\"</emphasis>."
26173
msgstr ""
26174
26175
#: serverguide/C/installation.xml:593(para)
26176
msgid ""
26177
"Choose which partitions to use. Generally they will be sda1, sdb1, sdc1, "
26178
"etc. The numbers will usually match and the different letters correspond to "
26179
"different hard drives."
26180
msgstr ""
26181
26182
#: serverguide/C/installation.xml:598(para)
26183
msgid ""
26184
"For the <emphasis>swap</emphasis> partition choose <emphasis>sda1</emphasis> "
26185
"and <emphasis>sdb1</emphasis>. Select <emphasis>\"Continue\"</emphasis> to "
26186
"go to the next step."
26187
msgstr ""
26188
26189
#: serverguide/C/installation.xml:606(para)
26190
msgid ""
26191
"Repeat steps <emphasis>three</emphasis> through <emphasis>seven</emphasis> "
26192
"for the <emphasis>/</emphasis> partition choosing <emphasis>sda2</emphasis> "
26193
"and <emphasis>sdb2</emphasis>."
26194
msgstr ""
26195
26196
#: serverguide/C/installation.xml:614(para)
26197
msgid "Once done select <emphasis>\"Finish\"</emphasis>."
26198
msgstr ""
26199
26200
#: serverguide/C/installation.xml:624(title)
26201
msgid "Formatting"
26202
msgstr ""
26203
26204
#: serverguide/C/installation.xml:626(para)
26205
msgid ""
26206
"There should now be a list of hard drives and RAID devices. The next step is "
26207
"to format and set the mount point for the RAID devices. Treat the RAID "
26208
"device as a local hard drive, format and mount accordingly."
26209
msgstr ""
26210
26211
#: serverguide/C/installation.xml:634(para)
26212
msgid ""
26213
"Select <emphasis>\"#1\"</emphasis> under the <emphasis>\"RAID1 device "
26214
"#0\"</emphasis> partition."
26215
msgstr ""
26216
26217
#: serverguide/C/installation.xml:641(para)
26218
msgid ""
26219
"Choose <emphasis>\"Use as:\"</emphasis>. Then select <emphasis>\"swap "
26220
"area\"</emphasis>, then <emphasis>\"Done setting up partition\"</emphasis>."
26221
msgstr ""
26222
26223
#: serverguide/C/installation.xml:649(para)
26224
msgid ""
26225
"Next, select <emphasis>\"#1\"</emphasis> under the <emphasis>\"RAID1 device "
26226
"#1\"</emphasis> partition."
26227
msgstr ""
26228
26229
#: serverguide/C/installation.xml:656(para)
26230
msgid ""
26231
"Choose <emphasis>\"Use as:\"</emphasis>. Then select <emphasis>\"Ext4 "
26232
"journaling file system\"</emphasis>."
26233
msgstr ""
26234
26235
#: serverguide/C/installation.xml:663(para)
26236
msgid ""
26237
"Then select the <emphasis>\"Mount point\"</emphasis> and choose "
26238
"<emphasis>\"/ - the root file system\"</emphasis>. Change any of the other "
26239
"options as appropriate, then select <emphasis>\"Done setting up "
26240
"partition\"</emphasis>."
26241
msgstr ""
26242
26243
#: serverguide/C/installation.xml:671(para)
26244
msgid ""
26245
"Finally, select <emphasis>\"Finish partitioning and write changes to "
26246
"disk\"</emphasis>."
26247
msgstr ""
26248
26249
#: serverguide/C/installation.xml:678(para)
26250
msgid ""
26251
"If you choose to place the root partition on a RAID array, the installer "
26252
"will then ask if you would like to boot in a <emphasis>degraded</emphasis> "
26253
"state. See <xref linkend=\"raid-degraded\"/> for further details."
26254
msgstr ""
26255
26256
#: serverguide/C/installation.xml:683(para)
26257
msgid "The installation process will then continue normally."
26258
msgstr ""
26259
26260
#: serverguide/C/installation.xml:689(title)
26261
msgid "Degraded RAID"
26262
msgstr ""
26263
26264
#: serverguide/C/installation.xml:691(para)
26265
msgid ""
26266
"At some point in the life of the computer a disk failure event may occur. "
26267
"When this happens, using Software RAID, the operating system will place the "
26268
"array into what is known as a <emphasis>degraded</emphasis> state."
26269
msgstr ""
26270
26271
#: serverguide/C/installation.xml:696(para)
26272
msgid ""
26273
"If the array has become degraded, due to the chance of data corruption, by "
26274
"default Ubuntu Server Edition will boot to <emphasis>initramfs</emphasis> "
26275
"after thirty seconds. Once the initramfs has booted there is a fifteen "
26276
"second prompt giving you the option to go ahead and boot the system, or "
26277
"attempt manual recover. Booting to the initramfs prompt may or may not be "
26278
"the desired behavior, especially if the machine is in a remote location. "
26279
"Booting to a degraded array can be configured several ways:"
26280
msgstr ""
26281
26282
#: serverguide/C/installation.xml:707(para)
26283
msgid ""
26284
"The <application>dpkg-reconfigure</application> utility can be used to "
26285
"configure the default behavior, and during the process you will be queried "
26286
"about additional settings related to the array. Such as monitoring, email "
26287
"alerts, etc. To reconfigure <application>mdadm</application> enter the "
26288
"following:"
26289
msgstr ""
26290
26291
#: serverguide/C/installation.xml:714(command)
26292
msgid "sudo dpkg-reconfigure mdadm"
26293
msgstr ""
26294
26295
#: serverguide/C/installation.xml:720(para)
26296
msgid ""
26297
"The <command>dpkg-reconfigure mdadm</command> process will change the "
26298
"<filename>/etc/initramfs-tools/conf.d/mdadm</filename> configuration file. "
26299
"The file has the advantage of being able to pre-configure the system's "
26300
"behavior, and can also be manually edited:"
26301
msgstr ""
26302
26303
#: serverguide/C/installation.xml:726(programlisting)
26304
#, no-wrap
26305
msgid ""
26306
"\n"
26307
"BOOT_DEGRADED=true\n"
26308
msgstr ""
26309
26310
#: serverguide/C/installation.xml:731(para)
26311
msgid "The configuration file can be overridden by using a Kernel argument."
26312
msgstr ""
26313
26314
#: serverguide/C/installation.xml:739(para)
26315
msgid ""
26316
"Using a Kernel argument will allow the system to boot to a degraded array as "
26317
"well:"
26318
msgstr ""
26319
26320
#: serverguide/C/installation.xml:745(para)
26321
msgid ""
26322
"When the server is booting press <keycap>Shift</keycap> to open the "
26323
"<application>Grub</application> menu."
26324
msgstr ""
26325
26326
#: serverguide/C/installation.xml:750(para)
26327
msgid "Press <keycap>e</keycap> to edit your kernel command options."
26328
msgstr ""
26329
26330
#: serverguide/C/installation.xml:755(para)
26331
msgid "Press the <keycap>down</keycap> arrow to highlight the kernel line."
26332
msgstr ""
26333
26334
#: serverguide/C/installation.xml:760(para)
26335
msgid ""
26336
"Add <emphasis>\"bootdegraded=true\"</emphasis> (without the quotes) to the "
26337
"end of the line."
26338
msgstr ""
26339
26340
#: serverguide/C/installation.xml:765(para)
26341
msgid ""
26342
"Press <keycombo><keycap>Ctrl</keycap><keycap>x</keycap></keycombo> to boot "
26343
"the system."
26344
msgstr ""
26345
26346
#: serverguide/C/installation.xml:774(para)
26347
msgid ""
26348
"Once the system has booted you can either repair the array see <xref "
26349
"linkend=\"raid-maintenance\"/> for details, or copy important data to "
26350
"another machine due to major hardware failure."
26351
msgstr ""
26352
26353
#: serverguide/C/installation.xml:781(title)
26354
msgid "RAID Maintenance"
26355
msgstr ""
26356
26357
#: serverguide/C/installation.xml:783(para)
26358
msgid ""
26359
"The <application>mdadm</application> utility can be used to view the status "
26360
"of an array, add disks to an array, remove disks, etc:"
26361
msgstr ""
26362
26363
#: serverguide/C/installation.xml:790(para)
26364
msgid "To view the status of an array, from a terminal prompt enter:"
26365
msgstr ""
26366
26367
#: serverguide/C/installation.xml:794(command)
26368
msgid "sudo mdadm -D /dev/md0"
26369
msgstr ""
26370
26371
#: serverguide/C/installation.xml:797(para)
26372
msgid ""
26373
"The <emphasis>-D</emphasis> tells <application>mdadm</application> to "
26374
"display <emphasis>detailed</emphasis> information about the "
26375
"<filename>/dev/md0</filename> device. Replace <filename>/dev/md0</filename> "
26376
"with the appropriate RAID device."
26377
msgstr ""
26378
26379
#: serverguide/C/installation.xml:803(para)
26380
msgid "To view the status of a disk in an array:"
26381
msgstr ""
26382
26383
#: serverguide/C/installation.xml:807(command)
26384
msgid "sudo mdadm -E /dev/sda1"
26385
msgstr ""
26386
26387
#: serverguide/C/installation.xml:809(para)
26388
msgid ""
26389
"The output if very similar to the <command>mdadm -D</command> command, "
26390
"adjust <filename>/dev/sda1</filename> for each disk."
26391
msgstr ""
26392
26393
#: serverguide/C/installation.xml:814(para)
26394
msgid "If a disk fails and needs to be removed from an array enter:"
26395
msgstr ""
26396
26397
#: serverguide/C/installation.xml:818(command)
26398
msgid "sudo mdadm --remove /dev/md0 /dev/sda1"
26399
msgstr ""
26400
26401
#: serverguide/C/installation.xml:820(para)
26402
msgid ""
26403
"Change <filename>/dev/md0</filename> and <filename>/dev/sda1</filename> to "
26404
"the appropriate RAID device and disk."
26405
msgstr ""
26406
26407
#: serverguide/C/installation.xml:825(para)
26408
msgid "Similarly, to add a new disk:"
26409
msgstr ""
26410
26411
#: serverguide/C/installation.xml:829(command)
26412
msgid "sudo mdadm --add /dev/md0 /dev/sda1"
26413
msgstr ""
26414
26415
#: serverguide/C/installation.xml:834(para)
26416
msgid ""
26417
"Sometimes a disk can change to a <emphasis>faulty</emphasis> state even "
26418
"though there is nothing physically wrong with the drive. It is usually "
26419
"worthwhile to remove the drive from the array then re-add it. This will "
26420
"cause the drive to re-sync with the array. If the drive will not sync with "
26421
"the array, it is a good indication of hardware failure."
26422
msgstr ""
26423
26424
#: serverguide/C/installation.xml:840(para)
26425
msgid ""
26426
"The <filename>/proc/mdstat</filename> file also contains useful information "
26427
"about the system's RAID devices:"
26428
msgstr ""
26429
26430
#: serverguide/C/installation.xml:845(command)
26431
msgid "cat /proc/mdstat"
26432
msgstr ""
26433
26434
#: serverguide/C/installation.xml:846(computeroutput)
26435
#, no-wrap
26436
msgid ""
26437
"Personalities : [linear] [multipath] [raid0] [raid1] [raid6] [raid5] [raid4] "
26438
"[raid10] \n"
26439
"md0 : active raid1 sda1[0] sdb1[1]\n"
26440
" 10016384 blocks [2/2] [UU]\n"
26441
" \n"
26442
"unused devices: <none>"
26443
msgstr ""
26444
26445
#: serverguide/C/installation.xml:853(para)
26446
msgid ""
26447
"The following command is great for watching the status of a syncing drive:"
26448
msgstr ""
26449
26450
#: serverguide/C/installation.xml:858(command)
26451
msgid "watch -n1 cat /proc/mdstat"
26452
msgstr ""
26453
26454
#: serverguide/C/installation.xml:861(para)
26455
msgid ""
26456
"Press <emphasis>Ctrl+c</emphasis> to stop the "
26457
"<application>watch</application> command."
26458
msgstr ""
26459
26460
#: serverguide/C/installation.xml:865(para)
26461
msgid ""
26462
"If you do need to replace a faulty drive, after the drive has been replaced "
26463
"and synced, <application>grub</application> will need to be installed. To "
26464
"install <application>grub</application> on the new drive, enter the "
26465
"following:"
26466
msgstr ""
26467
26468
#: serverguide/C/installation.xml:871(command)
26469
msgid "sudo grub-install /dev/md0"
26470
msgstr ""
26471
26472
#: serverguide/C/installation.xml:874(para)
26473
msgid ""
26474
"Replace <filename>/dev/md0</filename> with the appropriate array device name."
26475
msgstr ""
26476
26477
#: serverguide/C/installation.xml:882(para)
26478
msgid ""
26479
"The topic of RAID arrays is a complex one due to the plethora of ways RAID "
26480
"can be configured. Please see the following links for more information:"
26481
msgstr ""
26482
26483
#: serverguide/C/installation.xml:889(para)
26484
msgid ""
26485
"<ulink url=\"https://help.ubuntu.com/community/Installation#raid\">Ubuntu "
26486
"Wiki Articles on RAID</ulink>."
26487
msgstr ""
26488
26489
#: serverguide/C/installation.xml:895(ulink)
26490
msgid "Software RAID HOWTO"
26491
msgstr ""
26492
26493
#: serverguide/C/installation.xml:900(ulink)
26494
msgid "Managing RAID on Linux"
26495
msgstr ""
26496
26497
#: serverguide/C/installation.xml:907(title)
26498
msgid "Logical Volume Manager (LVM)"
26499
msgstr ""
26500
26501
#: serverguide/C/installation.xml:909(para)
26502
msgid ""
26503
"Logical Volume Manger, or <emphasis>LVM</emphasis>, allows administrators to "
26504
"create <emphasis>logical</emphasis> volumes out of one or multiple physical "
26505
"hard disks. LVM volumes can be created on both software RAID partitions and "
26506
"standard partitions residing on a single disk. Volumes can also be extended, "
26507
"giving greater flexibility to systems as requirements change."
26508
msgstr ""
26509
26510
#: serverguide/C/installation.xml:918(para)
26511
msgid ""
26512
"A side effect of LVM's power and flexibility is a greater degree of "
26513
"complication. Before diving into the LVM installation process, it is best to "
26514
"get familiar with some terms."
26515
msgstr ""
26516
26517
#: serverguide/C/installation.xml:925(para)
26518
msgid ""
26519
"<emphasis>Physical Volume (PV):</emphasis> physical hard disk, disk "
26520
"partition or software RAID partition formatted as LVM PV."
26521
msgstr ""
26522
26523
#: serverguide/C/installation.xml:931(para)
26524
msgid ""
26525
"<emphasis>Volume Group (VG):</emphasis> is made from one or more physical "
26526
"volumes. A VG can can be extended by adding more PVs. A VG is like a virtual "
26527
"disk drive, from which one or more logical volumes are carved."
26528
msgstr ""
26529
26530
#: serverguide/C/installation.xml:937(para)
26531
msgid ""
26532
"<emphasis>Logical Volume (LV):</emphasis> is similar to a partition in a non-"
26533
"LVM system. A LV is formatted with the desired file system (EXT3, XFS, JFS, "
26534
"etc), it is then available for mounting and data storage."
26535
msgstr ""
26536
26537
#: serverguide/C/installation.xml:948(para)
26538
msgid ""
26539
"As an example this section covers installing Ubuntu Server Edition with "
26540
"<filename role=\"directory\">/srv</filename> mounted on a LVM volume. During "
26541
"the initial install only one Physical Volume (PV) will be part of the Volume "
26542
"Group (VG). Another PV will be added after install to demonstrate how a VG "
26543
"can be extended."
26544
msgstr ""
26545
26546
#: serverguide/C/installation.xml:954(para)
26547
msgid ""
26548
"There are several installation options for LVM, <emphasis>\"Guided - use the "
26549
"entire disk and setup LVM\"</emphasis> which will also allow you to assign a "
26550
"portion of the available space to LVM, <emphasis>\"Guided - use entire and "
26551
"setup encrypted LVM\"</emphasis>, or <emphasis>Manually</emphasis> setup the "
26552
"partitions and configure LVM. At this time the only way to configure a "
26553
"system with both LVM and standard partitions, during installation, is to use "
26554
"the Manual approach."
26555
msgstr ""
26556
26557
#: serverguide/C/installation.xml:971(para)
26558
msgid ""
26559
"At the <emphasis>\"Partition Disks</emphasis> screen choose "
26560
"<emphasis>\"Manual\"</emphasis>."
26561
msgstr ""
26562
26563
#: serverguide/C/installation.xml:978(para)
26564
msgid ""
26565
"Select the hard disk and on the next screen choose \"yes\" to "
26566
"<emphasis>\"Create a new empty partition table on this device\"</emphasis>."
26567
msgstr ""
26568
26569
#: serverguide/C/installation.xml:985(para)
26570
msgid ""
26571
"Next, create standard <emphasis>/boot</emphasis>, <emphasis>swap</emphasis>, "
26572
"and <emphasis>/</emphasis> partitions with whichever filesystem you prefer."
26573
msgstr ""
26574
26575
#: serverguide/C/installation.xml:993(para)
26576
msgid ""
26577
"For the LVM <emphasis>/srv</emphasis>, create a new "
26578
"<emphasis>Logical</emphasis> partition. Then change <emphasis>\"Use "
26579
"as\"</emphasis> to <emphasis>\"physical volume for LVM\"</emphasis> then "
26580
"<emphasis>\"Done setting up the partition\"</emphasis>."
26581
msgstr ""
26582
26583
#: serverguide/C/installation.xml:1001(para)
26584
msgid ""
26585
"Now select <emphasis>\"Configure the Logical Volume Manager\"</emphasis> at "
26586
"the top, and choose <emphasis>\"Yes\"</emphasis> to write the changes to "
26587
"disk."
26588
msgstr ""
26589
26590
#: serverguide/C/installation.xml:1009(para)
26591
msgid ""
26592
"For the <emphasis>\"LVM configuration action\"</emphasis> on the next "
26593
"screen, choose <emphasis>\"Create volume group\"</emphasis>. Enter a name "
26594
"for the VG such as <emphasis>vg01</emphasis>, or something more descriptive. "
26595
"After entering a name, select the partition configured for LVM, and choose "
26596
"<emphasis>\"Continue\"</emphasis>."
26597
msgstr ""
26598
26599
#: serverguide/C/installation.xml:1018(para)
26600
msgid ""
26601
"Back at the <emphasis>\"LVM configuration action\"</emphasis> screen, select "
26602
"<emphasis>\"Create logical volume\"</emphasis>. Select the newly created "
26603
"volume group, and enter a name for the new LV, for example "
26604
"<emphasis>srv</emphasis> since that is the intended mount point. Then choose "
26605
"a size, which may be the full partition because it can always be extended "
26606
"later. Choose <emphasis>\"Finish\"</emphasis> and you should be back at the "
26607
"main <emphasis>\"Partition Disks\"</emphasis> screen."
26608
msgstr ""
26609
26610
#: serverguide/C/installation.xml:1028(para)
26611
msgid ""
26612
"Now add a filesystem to the new LVM. Select the partition under "
26613
"<emphasis>\"LVM VG vg01, LV srv\"</emphasis>, or whatever name you have "
26614
"chosen, the choose <emphasis>Use as</emphasis>. Setup a file system as "
26615
"normal selecting <emphasis>/srv</emphasis> as the mount point. Once done, "
26616
"select <emphasis>\"Done setting up the partition\"</emphasis>."
26617
msgstr ""
26618
26619
#: serverguide/C/installation.xml:1037(para)
26620
msgid ""
26621
"Finally, select <emphasis>\"Finish partitioning and write changes to "
26622
"disk\"</emphasis>. Then confirm the changes and continue with the rest of "
26623
"the installation."
26624
msgstr ""
26625
26626
#: serverguide/C/installation.xml:1045(para)
26627
msgid "There are some useful utilities to view information about LVM:"
26628
msgstr ""
26629
26630
#: serverguide/C/installation.xml:1050(para)
26631
msgid ""
26632
"<emphasis>pvdisplay:</emphasis> shows information about Physical Volumes."
26633
msgstr ""
26634
26635
#: serverguide/C/installation.xml:1051(para)
26636
msgid ""
26637
"<emphasis>vgdisplay:</emphasis> shows information about Volume Groups."
26638
msgstr ""
26639
26640
#: serverguide/C/installation.xml:1052(para)
26641
msgid ""
26642
"<emphasis>lvdisplay:</emphasis> shows information about Logical Volumes."
26643
msgstr ""
26644
26645
#: serverguide/C/installation.xml:1057(title)
26646
msgid "Extending Volume Groups"
26647
msgstr ""
26648
26649
#: serverguide/C/installation.xml:1059(para)
26650
msgid ""
26651
"Continuing with <emphasis>srv</emphasis> as an LVM volume example, this "
26652
"section covers adding a second hard disk, creating a Physical Volume (PV), "
26653
"adding it to the volume group (VG), extending the logical volume <filename "
26654
"role=\"directory\">srv</filename> and finally extending the filesystem. This "
26655
"example assumes a second hard disk has been added to the system. In this "
26656
"example, this hard disk will be named <filename>/dev/sdb</filename> and we "
26657
"will use the entire disk as a physical volume (you could choose to create "
26658
"partitions and use them as different physical volumes)"
26659
msgstr ""
26660
26661
#: serverguide/C/installation.xml:1067(para)
26662
msgid ""
26663
"Make sure you don't already have an existing <filename>/dev/sdb</filename> "
26664
"before issuing the commands below. You could lose some data if you issue "
26665
"those commands on a non-empty disk."
26666
msgstr ""
26667
26668
#: serverguide/C/installation.xml:1075(para)
26669
msgid "First, create the physical volume, in a terminal execute:"
26670
msgstr ""
26671
26672
#: serverguide/C/installation.xml:1080(command)
26673
msgid "sudo pvcreate /dev/sdb"
26674
msgstr ""
26675
26676
#: serverguide/C/installation.xml:1086(para)
26677
msgid "Now extend the Volume Group (VG):"
26678
msgstr ""
26679
26680
#: serverguide/C/installation.xml:1091(command)
26681
msgid "sudo vgextend vg01 /dev/sdb"
26682
msgstr ""
26683
26684
#: serverguide/C/installation.xml:1097(para)
26685
msgid ""
26686
"Use <application>vgdisplay</application> to find out the free physical "
26687
"extents - Free PE / size (the size you can allocate). We will assume a free "
26688
"size of 511 PE (equivalent to 2GB with a PE size of 4MB) and we will use the "
26689
"whole free space available. Use your own PE and/or free space."
26690
msgstr ""
26691
26692
#: serverguide/C/installation.xml:1103(para)
26693
msgid ""
26694
"The Logical Volume (LV) can now be extended by different methods, we will "
26695
"only see how to use the PE to extend the LV:"
26696
msgstr ""
26697
26698
#: serverguide/C/installation.xml:1108(command)
26699
msgid "sudo lvextend /dev/vg01/srv -l +511"
26700
msgstr ""
26701
26702
#: serverguide/C/installation.xml:1111(para)
26703
msgid ""
26704
"The <emphasis>-l</emphasis> option allows the LV to be extended using PE. "
26705
"The <emphasis>-L</emphasis> option allows the LV to be extended using Meg, "
26706
"Gig, Tera, etc bytes."
26707
msgstr ""
26708
26709
#: serverguide/C/installation.xml:1119(para)
26710
msgid ""
26711
"Even though you are supposed to be able to <emphasis>expand</emphasis> an "
26712
"ext3 or ext4 filesystem without unmounting it first, it may be a good "
26713
"practice to unmount it anyway and check the filesystem, so that you don't "
26714
"mess up the day you want to reduce a logical volume (in that case unmounting "
26715
"first is compulsory)."
26716
msgstr ""
26717
26718
#: serverguide/C/installation.xml:1125(para)
26719
msgid ""
26720
"The following commands are for an <emphasis>EXT3</emphasis> or "
26721
"<emphasis>EXT4</emphasis> filesystem. If you are using another filesystem "
26722
"there may be other utilities available."
26723
msgstr ""
26724
26725
#: serverguide/C/installation.xml:1132(command)
26726
msgid "sudo e2fsck -f /dev/vg01/srv"
26727
msgstr ""
26728
26729
#: serverguide/C/installation.xml:1135(para)
26730
msgid ""
26731
"The <emphasis>-f</emphasis> option of <application>e2fsck</application> "
26732
"forces checking even if the system seems clean."
26733
msgstr ""
26734
26735
#: serverguide/C/installation.xml:1142(para)
26736
msgid "Finally, resize the filesystem:"
26737
msgstr ""
26738
26739
#: serverguide/C/installation.xml:1147(command)
26740
msgid "sudo resize2fs /dev/vg01/srv"
26741
msgstr ""
26742
26743
#: serverguide/C/installation.xml:1153(para)
26744
msgid "Now mount the partition and check its size."
26745
msgstr ""
26746
26747
#: serverguide/C/installation.xml:1158(command)
26748
msgid "mount /dev/vg01/srv /srv && df -h /srv"
26749
msgstr ""
26750
26751
#: serverguide/C/installation.xml:1170(para)
26752
msgid ""
26753
"See the <ulink "
26754
"url=\"https://help.ubuntu.com/community/Installation#lvm\">Ubuntu Wiki LVM "
26755
"Articles</ulink>."
26756
msgstr ""
26757
26758
#: serverguide/C/installation.xml:1175(para)
26759
msgid ""
26760
"See the <ulink url=\"http://tldp.org/HOWTO/LVM-HOWTO/index.html\">LVM "
26761
"HOWTO</ulink> for more information."
26762
msgstr ""
26763
26764
#: serverguide/C/installation.xml:1180(para)
26765
msgid ""
26766
"Another good article is <ulink "
26767
"url=\"http://www.linuxdevcenter.com/pub/a/linux/2006/04/27/managing-disk-"
26768
"space-with-lvm.html\">Managing Disk Space with LVM</ulink> on O'Reilly's "
26769
"linuxdevcenter.com site."
26770
msgstr ""
26771
26772
#: serverguide/C/installation.xml:1187(para)
26773
msgid ""
26774
"For more information on <application>fdisk</application> see the <ulink "
26775
"url=\"http://manpages.ubuntu.com/manpages/xenial/en/man8/fdisk.8.html\">fdisk"
26776
" man page</ulink>."
26777
msgstr ""
26778
26779
#: serverguide/C/installation.xml:1196(title)
26780
msgid "iSCSI"
26781
msgstr ""
26782
26783
#: serverguide/C/installation.xml:1198(para)
26784
msgid ""
26785
"The iSCSI protocol can be used to install Ubuntu on systems with or without "
26786
"hard disks attached."
26787
msgstr ""
26788
26789
#: serverguide/C/installation.xml:1202(title)
26790
msgid "Installation on a diskless system"
26791
msgstr ""
26792
26793
#: serverguide/C/installation.xml:1204(para)
26794
msgid ""
26795
"The first steps of a diskless iSCSI installation are identical to the <xref "
26796
"linkend=\"installing-from-cd\"/> section up to \"Hard drive layout\"."
26797
msgstr ""
26798
26799
#: serverguide/C/installation.xml:1210(para)
26800
msgid "The installer will display a warning with the following message:"
26801
msgstr ""
26802
26803
#: serverguide/C/installation.xml:1213(screen)
26804
#, no-wrap
26805
msgid ""
26806
"No disk drive was detected. If you know the name of the driver needed by "
26807
"your disk drive, you can select it from the list."
26808
msgstr ""
26809
26810
#: serverguide/C/installation.xml:1217(para)
26811
msgid ""
26812
"Select the item in the list titled <emphasis>login to iSCSI "
26813
"targets.</emphasis>"
26814
msgstr ""
26815
26816
#: serverguide/C/installation.xml:1222(para)
26817
msgid ""
26818
"You will be prompted to Enter an IP address to scan for iSCSI targets with a "
26819
"description of the format for the address. Enter the IP address for the "
26820
"location of your iSCSI target and navigate to "
26821
"<emphasis><continue></emphasis> then hit <keycap>ENTER</keycap>"
26822
msgstr ""
26823
26824
#: serverguide/C/installation.xml:1230(para)
26825
msgid ""
26826
"If authentication is required in order to access the iSCSI device, provide "
26827
"the <emphasis>username</emphasis> in the next field. Otherwise leave it "
26828
"blank."
26829
msgstr ""
26830
26831
#: serverguide/C/installation.xml:1236(para) serverguide/C/installation.xml:1307(para)
26832
msgid ""
26833
"If your system is able to connect to the iSCSI provider, you should see a "
26834
"list of available iSCSI targets where the operating system can be installed. "
26835
"The list should be similar to the following :"
26836
msgstr ""
26837
26838
#: serverguide/C/installation.xml:1241(screen)
26839
#, no-wrap
26840
msgid ""
26841
"Select the iSCSI targets you wish to use.\n"
26842
"\n"
26843
"iSCSI targets on 192.168.1.29:3260:\n"
26844
"\n"
26845
"[ ] iqn.2016-03.TrustyS-iscsitarget:storage.sys0\n"
26846
"\n"
26847
"<Go Back> <Continue>\n"
26848
"\n"
26849
msgstr ""
26850
26851
#: serverguide/C/installation.xml:1253(para)
26852
msgid ""
26853
"Select the iSCSI target that you want to use with the space bar. Use the "
26854
"arrow keys to navigate to the target that you want to select."
26855
msgstr ""
26856
26857
#: serverguide/C/installation.xml:1259(para)
26858
msgid ""
26859
"Navigate to <emphasis><Continue></emphasis> and hit "
26860
"<keycap>ENTER</keycap>."
26861
msgstr ""
26862
26863
#: serverguide/C/installation.xml:1264(para)
26864
msgid ""
26865
"If the connection to the iSCSI target is successful, you will be prompted "
26866
"with the <emphasis>[!!] Partition disks</emphasis> installation menu. The "
26867
"rest of the procedure is identical to any normal installation on attached "
26868
"disks. Once the installation is completed, you will be asked to reboot."
26869
msgstr ""
26870
26871
#: serverguide/C/installation.xml:1272(title)
26872
msgid "Installation on a system with disk attached"
26873
msgstr ""
26874
26875
#: serverguide/C/installation.xml:1274(para)
26876
msgid ""
26877
"Again, the iSCSI installation on a normal server with one or many disks "
26878
"attached is identical to the <xref linkend=\"installing-from-cd\"/> section "
26879
"until we reach the disk partitioning menu. Instead of using any of the "
26880
"Guided selection, we need to perform the following steps :"
26881
msgstr ""
26882
26883
#: serverguide/C/installation.xml:1282(para)
26884
msgid "Navigate to the Manual menu entry"
26885
msgstr ""
26886
26887
#: serverguide/C/installation.xml:1286(para)
26888
msgid "Select the Configure iSCSI Volumes menu entry"
26889
msgstr ""
26890
26891
#: serverguide/C/installation.xml:1290(para)
26892
msgid "Choose the Log into iSCSI targets"
26893
msgstr ""
26894
26895
#: serverguide/C/installation.xml:1294(para)
26896
msgid ""
26897
"You will be prompted to Enter an IP address to scan for iSCSI targets. with "
26898
"a description of the format for the address. Enter the IP address and "
26899
"navigate to <emphasis><continue></emphasis> then hit "
26900
"<keycap>ENTER</keycap>"
26901
msgstr ""
26902
26903
#: serverguide/C/installation.xml:1301(para)
26904
msgid ""
26905
"If authentication is required in order to access the iSCSI device, provide "
26906
"the <emphasis>username</emphasis> in the next field or leave it blank."
26907
msgstr ""
26908
26909
#: serverguide/C/installation.xml:1312(screen)
26910
#, no-wrap
26911
msgid ""
26912
"Select the iSCSI targets you wish to use.\n"
26913
"\n"
26914
"iSCSI targets on 192.168.1.29:3260:\n"
26915
"\n"
26916
"[ ] iqn.2016-03.TrustyS-iscsitarget:storage.sys0\n"
26917
"\n"
26918
"<Go Back> <Continue>\n"
26919
msgstr ""
26920
26921
#: serverguide/C/installation.xml:1323(para)
26922
msgid ""
26923
"Select the iSCSI target that you want to use with the space bar. Use the "
26924
"arrow keys to navigate to the target that you want to select"
26925
msgstr ""
26926
26927
#: serverguide/C/installation.xml:1329(para)
26928
msgid "Navigate to <Continue> and hit <keycap>ENTER</keycap>."
26929
msgstr ""
26930
26931
#: serverguide/C/installation.xml:1333(para)
26932
msgid ""
26933
"If successful, you will come back to the menu asking you to Log into iSCSI "
26934
"targets. Navigate to Finish and hit <keycap>ENTER</keycap>"
26935
msgstr ""
26936
26937
#: serverguide/C/installation.xml:1338(para)
26938
msgid ""
26939
"The newly connected iSCSI disk will appear in the overview section as a "
26940
"device prefixed with SCSI. This is the disk that you should select as your "
26941
"installation disk. Once identified, you can choose any of the partitioning "
26942
"methods."
26943
msgstr ""
26944
26945
#: serverguide/C/installation.xml:1344(para)
26946
msgid ""
26947
"Depending on your system configuration, there may be other SCSI disks "
26948
"attached to the system. Be very careful to identify the proper device before "
26949
"proceeding with the installation. Otherwise, irreversible data loss may "
26950
"result from performing an installation on the wrong disk."
26951
msgstr ""
26952
26953
#: serverguide/C/installation.xml:1353(title)
26954
msgid "Rebooting to an iSCSI target"
26955
msgstr ""
26956
26957
#: serverguide/C/installation.xml:1355(para)
26958
msgid ""
26959
"The procedure is specific to your hardware platform. As an example, here is "
26960
"how to reboot to your iSCSI target using iPXE"
26961
msgstr ""
26962
26963
#: serverguide/C/installation.xml:1358(screen)
26964
#, no-wrap
26965
msgid ""
26966
"iPXE> dhcp\n"
26967
"\n"
26968
"Configuring (net0 52:54:00:a4:f2:a9)....... ok\n"
26969
"\n"
26970
"iPXE> sanboot iscsi:192.168.1.29::::iqn.2016-03.TrustyS-"
26971
"iscsitarget:storage.sys0\n"
26972
msgstr ""
26973
26974
#: serverguide/C/installation.xml:1365(para)
26975
msgid ""
26976
"If the procedure is successful, you should see the Grub menu appear on the "
26977
"screen."
26978
msgstr ""
26979
26980
#: serverguide/C/installation.xml:1372(title)
26981
msgid "Kernel Crash Dump"
26982
msgstr ""
26983
26984
#: serverguide/C/installation.xml:1379(para)
26985
msgid "Kernel Panic"
26986
msgstr ""
26987
26988
#: serverguide/C/installation.xml:1380(para)
26989
msgid "Non Maskable Interrupts (NMI)"
26990
msgstr ""
26991
26992
#: serverguide/C/installation.xml:1381(para)
26993
msgid "Machine Check Exceptions (MCE)"
26994
msgstr ""
26995
26996
#: serverguide/C/installation.xml:1382(para)
26997
msgid "Hardware failure"
26998
msgstr ""
26999
27000
#: serverguide/C/installation.xml:1383(para)
27001
msgid "Manual intervention"
27002
msgstr ""
27003
27004
#: serverguide/C/installation.xml:1375(para)
27005
msgid ""
27006
"A Kernel Crash Dump refers to a portion of the contents of volatile memory "
27007
"(RAM) that is copied to disk whenever the execution of the kernel is "
27008
"disrupted. The following events can cause a kernel disruption : <placeholder-"
27009
"1/> For some of those events (panic, NMI) the kernel will react "
27010
"automatically and trigger the crash dump mechanism through "
27011
"<emphasis>kexec</emphasis>. In other situations a manual intervention is "
27012
"required in order to capture the memory. Whenever one of the above events "
27013
"occurs, it is important to find out the root cause in order to prevent it "
27014
"from happening again. The cause can be determined by inspecting the copied "
27015
"memory contents."
27016
msgstr ""
27017
27018
#: serverguide/C/installation.xml:1392(title)
27019
msgid "Kernel Crash Dump Mechanism"
27020
msgstr ""
27021
27022
#: serverguide/C/installation.xml:1394(para)
27023
msgid ""
27024
"When a kernel panic occurs, the kernel relies on the "
27025
"<emphasis>kexec</emphasis> mechanism to quickly reboot a new instance of the "
27026
"kernel in a pre-reserved section of memory that had been allocated when the "
27027
"system booted (see below). This permits the existing memory area to remain "
27028
"untouched in order to safely copy its contents to storage."
27029
msgstr ""
27030
27031
#: serverguide/C/installation.xml:1403(para)
27032
msgid ""
27033
"The kernel crash dump utility is installed with the following command:"
27034
msgstr ""
27035
27036
#: serverguide/C/installation.xml:1408(command)
27037
msgid "sudo apt install linux-crashdump"
27038
msgstr ""
27039
27040
#: serverguide/C/installation.xml:1413(para)
27041
msgid ""
27042
"Starting with 16.04, the kernel crash dump mechanism is enabled by default. "
27043
"During the installation, you will be prompted with the following dialog. "
27044
"Unless chosen otherwise, the kdump mechanism will be enabled."
27045
msgstr ""
27046
27047
#: serverguide/C/installation.xml:1427(emphasis)
27048
msgid "<Yes>"
27049
msgstr ""
27050
27051
#: serverguide/C/installation.xml:1417(screen)
27052
#, no-wrap
27053
msgid ""
27054
"\n"
27055
" |------------------------| Configuring kdump-tools |------------------------"
27056
"|\n"
27057
" | "
27058
"|\n"
27059
" | "
27060
"|\n"
27061
" | If you choose this option, the kdump-tools mechanism will be enabled. A "
27062
"|\n"
27063
" | reboot is still required in order to enable the crashkernel kernel "
27064
"|\n"
27065
" | parameter. "
27066
"|\n"
27067
" | "
27068
"|\n"
27069
" | Should kdump-tools be enabled by default? "
27070
"|\n"
27071
" | "
27072
"|\n"
27073
" | <placeholder-1/> <No> "
27074
" |\n"
27075
" | "
27076
"|\n"
27077
" |---------------------------------------------------------------------------"
27078
"|\n"
27079
" "
27080
msgstr ""
27081
27082
#: serverguide/C/installation.xml:1433(programlisting)
27083
#, no-wrap
27084
msgid ""
27085
"\n"
27086
"USE_KDUMP=1\n"
27087
msgstr ""
27088
27089
#: serverguide/C/installation.xml:1431(para)
27090
msgid ""
27091
"If you ever need to manually enable the functionality, you can use the "
27092
"<command>dpkg-reconfigure kdump-tools</command> command and answer Yes to "
27093
"the question. You can also edit <filename>/etc/default/kdump-"
27094
"tools</filename> by including the following line: <placeholder-1/>"
27095
msgstr ""
27096
27097
#: serverguide/C/installation.xml:1438(para)
27098
msgid ""
27099
"If a reboot has not been done since installation of the linux-crashdump "
27100
"package, a reboot will be required in order to activate the crashkernel= "
27101
"boot parameter. Upon reboot, kdump-tools will be enabled and active."
27102
msgstr ""
27103
27104
#: serverguide/C/installation.xml:1441(para)
27105
msgid ""
27106
"If you enable kdump-tools after a reboot, you will only need to issue the "
27107
"<command>kdump-config load</command> command to activate the kdump mechanism."
27108
msgstr ""
27109
27110
#: serverguide/C/installation.xml:1448(para)
27111
msgid ""
27112
"In addition to local dump, it is now possible to use the remote dump "
27113
"functionality to send the kernel crash dump to a remote server, using either "
27114
"the <emphasis>SSH</emphasis> or <emphasis>NFS</emphasis> protocols."
27115
msgstr ""
27116
27117
#: serverguide/C/installation.xml:1452(title)
27118
msgid "Local Kernel Crash Dumps"
27119
msgstr ""
27120
27121
#: serverguide/C/installation.xml:1453(para)
27122
msgid ""
27123
"Local dumps are configured automatically and will remain in use unless a "
27124
"remote protocol is chosen. Many configuration options exist and are "
27125
"thoroughly documented in the <filename>/etc/default/kdump-tools</filename> "
27126
"file."
27127
msgstr ""
27128
27129
#: serverguide/C/installation.xml:1459(title)
27130
msgid "Remote Kernel Crash Dumps using the SSH protocol"
27131
msgstr ""
27132
27133
#: serverguide/C/installation.xml:1460(para)
27134
msgid ""
27135
"To enable remote dumps using the <emphasis>SSH</emphasis> protocol, the "
27136
"<filename>/etc/default/kdump-tools</filename> must be modified in the "
27137
"following manner :"
27138
msgstr ""
27139
27140
#: serverguide/C/installation.xml:1462(programlisting)
27141
#, no-wrap
27142
msgid ""
27143
"\n"
27144
"# ---------------------------------------------------------------------------"
27145
"\n"
27146
"# Remote dump facilities:\n"
27147
"# SSH - username and hostname of the remote server that will receive the "
27148
"dump\n"
27149
"# and dmesg files.\n"
27150
"# SSH_KEY - Full path of the ssh private key to be used to login to the "
27151
"remote\n"
27152
"# server. use kdump-config propagate to send the public key to "
27153
"the\n"
27154
"# remote server\n"
27155
"# HOSTTAG - Select if hostname of IP address will be used as a prefix to "
27156
"the\n"
27157
"# timestamped directory when sending files to the remote server.\n"
27158
"# 'ip' is the default.\n"
27159
"<emphasis role=\"bold\">SSH=\"ubuntu@kdump-netcrash\"</emphasis>\n"
27160
" "
27161
msgstr ""
27162
27163
#: serverguide/C/installation.xml:1475(para)
27164
msgid ""
27165
"The only mandatory variable to define is SSH. It must contain the username "
27166
"and hostname of the remote server using the format {username}@{remote "
27167
"server}."
27168
msgstr ""
27169
27170
#: serverguide/C/installation.xml:1477(para)
27171
msgid ""
27172
"SSH_KEY may be used to provide an existing private key to be used. "
27173
"Otherwise, the <command>kdump-config propagate</command> command will create "
27174
"a new keypair. The HOSTTAG variable may be used to use the hostname of the "
27175
"system as a prefix to the remote directory to be created instead of the IP "
27176
"address."
27177
msgstr ""
27178
27179
#: serverguide/C/installation.xml:1479(para)
27180
msgid ""
27181
"The following example shows how <command>kdump-config propagate</command> is "
27182
"used to create and propagate a new keypair to the remote server : <screen>\n"
27183
"<command>sudo kdump-config propagate</command>\n"
27184
"Need to generate a new ssh key...\n"
27185
"The authenticity of host 'kdump-netcrash (192.168.1.74)' can't be "
27186
"established.\n"
27187
"ECDSA key fingerprint is "
27188
"SHA256:iMp+5Y28qhbd+tevFCWrEXykDd4dI3yN4OVlu3CBBQ4.\n"
27189
"Are you sure you want to continue connecting (yes/no)? yes\n"
27190
"ubuntu@kdump-netcrash's password: \n"
27191
"propagated ssh key /root/.ssh/kdump_id_rsa to server ubuntu@kdump-netcrash\n"
27192
" </screen> The password of the account used on the remote server will "
27193
"be required in order to successfully send the public key to the server"
27194
msgstr ""
27195
27196
#: serverguide/C/installation.xml:1490(para)
27197
msgid ""
27198
"The <command>kdump-config show</command> command can be used to confirm that "
27199
"kdump is correctly configured to use the SSH protocol : <screen>\n"
27200
"<command>kdump-config show</command>\n"
27201
"DUMP_MODE: kdump\n"
27202
"USE_KDUMP: 1\n"
27203
"KDUMP_SYSCTL: kernel.panic_on_oops=1\n"
27204
"KDUMP_COREDIR: /var/crash\n"
27205
"crashkernel addr: 0x2c000000\n"
27206
" /var/lib/kdump/vmlinuz: symbolic link to /boot/vmlinuz-4.4.0-10-generic\n"
27207
"kdump initrd: \n"
27208
" /var/lib/kdump/initrd.img: symbolic link to /var/lib/kdump/initrd.img-"
27209
"4.4.0-10-generic\n"
27210
"<emphasis role=\"bold\">SSH: ubuntu@kdump-netcrash\n"
27211
"SSH_KEY: /root/.ssh/kdump_id_rsa\n"
27212
"HOSTTAG: ip\n"
27213
"current state: ready to kdump</emphasis>\n"
27214
" </screen>"
27215
msgstr ""
27216
27217
#: serverguide/C/installation.xml:1510(title)
27218
msgid "Remote Kernel Crash Dumps using the NFS protocol"
27219
msgstr ""
27220
27221
#: serverguide/C/installation.xml:1511(para)
27222
msgid ""
27223
"To enable remote dumps using the <emphasis>NFS</emphasis> protocol, the "
27224
"<filename>/etc/default/kdump-tools</filename> must be modified in the "
27225
"following manner :"
27226
msgstr ""
27227
27228
#: serverguide/C/installation.xml:1513(programlisting)
27229
#, no-wrap
27230
msgid ""
27231
"\n"
27232
"# NFS - Hostname and mount point of the NFS server configured to "
27233
"receive\n"
27234
"# the crash dump. The syntax must be {HOSTNAME}:{MOUNTPOINT} \n"
27235
"# (e.g. remote:/var/crash)\n"
27236
"#\n"
27237
"<emphasis role=\"bold\">NFS=\"kdump-netcrash:/var/crash\"</emphasis>\n"
27238
" "
27239
msgstr ""
27240
27241
#: serverguide/C/installation.xml:1520(para)
27242
msgid ""
27243
"As with the SSH protocol, the HOSTTAG variable can be used to replace the IP "
27244
"address by the hostname as the prefix of the remote directory."
27245
msgstr ""
27246
27247
#: serverguide/C/installation.xml:1521(para)
27248
msgid ""
27249
"The <command>kdump-config show</command> command can be used to confirm that "
27250
"kdump is correctly configured to use the NFS protocol : <screen>\n"
27251
"<command>kdump-config show</command>\n"
27252
"DUMP_MODE: kdump\n"
27253
"USE_KDUMP: 1\n"
27254
"KDUMP_SYSCTL: kernel.panic_on_oops=1\n"
27255
"KDUMP_COREDIR: /var/crash\n"
27256
"crashkernel addr: 0x2c000000\n"
27257
" /var/lib/kdump/vmlinuz: symbolic link to /boot/vmlinuz-4.4.0-10-generic\n"
27258
"kdump initrd: \n"
27259
" /var/lib/kdump/initrd.img: symbolic link to /var/lib/kdump/initrd.img-"
27260
"4.4.0-10-generic\n"
27261
"<emphasis role=\"bold\">NFS: kdump-netcrash:/var/crash\n"
27262
"HOSTTAG: hostname\n"
27263
"current state: ready to kdump</emphasis>\n"
27264
" </screen>"
27265
msgstr ""
27266
27267
#: serverguide/C/installation.xml:1542(para)
27268
msgid ""
27269
"To confirm that the kernel dump mechanism is enabled, there are a few things "
27270
"to verify. First, confirm that the <emphasis>crashkernel</emphasis> boot "
27271
"parameter is present (note: The following line has been split into two to "
27272
"fit the format of this document:"
27273
msgstr ""
27274
27275
#: serverguide/C/installation.xml:1549(command)
27276
msgid "cat /proc/cmdline"
27277
msgstr ""
27278
27279
#: serverguide/C/installation.xml:1550(computeroutput)
27280
#, no-wrap
27281
msgid ""
27282
"\n"
27283
"BOOT_IMAGE=/vmlinuz-3.2.0-17-server root=/dev/mapper/PreciseS-root ro\n"
27284
" crashkernel=384M-2G:64M,2G-:128M\n"
27285
msgstr ""
27286
27287
#: serverguide/C/installation.xml:1558(programlisting)
27288
#, no-wrap
27289
msgid ""
27290
"\n"
27291
"crashkernel=<range1>:<size1>[,<range2>:<size2>,...][@"
27292
"offset]\n"
27293
" range=start-[end] 'start' is inclusive and 'end' is exclusive.\n"
27294
" "
27295
msgstr ""
27296
27297
#: serverguide/C/installation.xml:1556(para)
27298
msgid ""
27299
"The <emphasis>crashkernel</emphasis> parameter has the following syntax: "
27300
"<placeholder-1/>"
27301
msgstr ""
27302
27303
#: serverguide/C/installation.xml:1566(programlisting)
27304
#, no-wrap
27305
msgid ""
27306
"\n"
27307
"crashkernel=384M-2G:64M,2G-:128M\n"
27308
msgstr ""
27309
27310
#: serverguide/C/installation.xml:1564(para)
27311
msgid ""
27312
"So for the crashkernel parameter found in <filename>/proc/cmdline</filename> "
27313
"we would have : <placeholder-1/>"
27314
msgstr ""
27315
27316
#: serverguide/C/installation.xml:1571(para)
27317
msgid "The above value means:"
27318
msgstr ""
27319
27320
#: serverguide/C/installation.xml:1573(para)
27321
msgid ""
27322
"if the RAM is smaller than 384M, then don't reserve anything (this is the "
27323
"\"rescue\" case)"
27324
msgstr ""
27325
27326
#: serverguide/C/installation.xml:1575(para)
27327
msgid "if the RAM size is between 386M and 2G (exclusive), then reserve 64M"
27328
msgstr ""
27329
27330
#: serverguide/C/installation.xml:1576(para)
27331
msgid "if the RAM size is larger than 2G, then reserve 128M"
27332
msgstr ""
27333
27334
#: serverguide/C/installation.xml:1579(para)
27335
msgid ""
27336
"Second, verify that the kernel has reserved the requested memory area for "
27337
"the kdump kernel by doing:"
27338
msgstr ""
27339
27340
#: serverguide/C/installation.xml:1584(command)
27341
msgid "dmesg | grep -i crash"
27342
msgstr ""
27343
27344
#: serverguide/C/installation.xml:1585(computeroutput)
27345
#, no-wrap
27346
msgid ""
27347
"\n"
27348
"...\n"
27349
"[ 0.000000] Reserving 64MB of memory at 800MB for crashkernel (System "
27350
"RAM: 1023MB)\n"
27351
msgstr ""
27352
27353
#: serverguide/C/installation.xml:1591(para)
27354
msgid ""
27355
"Finally, as seen previously, the <command>kdump-config show</command> "
27356
"command displays the current status of the kdump-tools configuration : "
27357
"<screen>\n"
27358
" <command>kdump-config show\n"
27359
"</command>DUMP_MODE: kdump\n"
27360
"USE_KDUMP: 1\n"
27361
"KDUMP_SYSCTL: kernel.panic_on_oops=1\n"
27362
"KDUMP_COREDIR: /var/crash\n"
27363
"crashkernel addr: 0x2c000000\n"
27364
" /var/lib/kdump/vmlinuz: symbolic link to /boot/vmlinuz-4.4.0-10-generic\n"
27365
"kdump initrd: \n"
27366
" /var/lib/kdump/initrd.img: symbolic link to /var/lib/kdump/initrd.img-"
27367
"4.4.0-10-generic\n"
27368
"current state: ready to kdump\n"
27369
"\n"
27370
"kexec command:\n"
27371
" /sbin/kexec -p --command-line=\"BOOT_IMAGE=/vmlinuz-4.4.0-10-generic "
27372
"root=/dev/mapper/VividS--vg-root ro debug break=init console=ttyS0,115200 "
27373
"irqpoll maxcpus=1 nousb systemd.unit=kdump-tools.service\" --"
27374
"initrd=/var/lib/kdump/initrd.img /var/lib/kdump/vmlinuz\n"
27375
" </screen>"
27376
msgstr ""
27377
27378
#: serverguide/C/installation.xml:1612(title)
27379
msgid "Testing the Crash Dump Mechanism"
27380
msgstr ""
27381
27382
#: serverguide/C/installation.xml:1615(para)
27383
msgid ""
27384
"Testing the Crash Dump Mechanism will cause <emphasis>a system "
27385
"reboot.</emphasis> In certain situations, this can cause data loss if the "
27386
"system is under heavy load. If you want to test the mechanism, make sure "
27387
"that the system is idle or under very light load."
27388
msgstr ""
27389
27390
#: serverguide/C/installation.xml:1622(para)
27391
msgid ""
27392
"Verify that the <emphasis>SysRQ</emphasis> mechanism is enabled by looking "
27393
"at the value of the <filename>/proc/sys/kernel/sysrq</filename> kernel "
27394
"parameter :"
27395
msgstr ""
27396
27397
#: serverguide/C/installation.xml:1628(command)
27398
msgid "cat /proc/sys/kernel/sysrq"
27399
msgstr ""
27400
27401
#: serverguide/C/installation.xml:1631(para)
27402
msgid ""
27403
"If a value of <emphasis>0</emphasis> is returned the feature is disabled. "
27404
"Enable it with the following command :"
27405
msgstr ""
27406
27407
#: serverguide/C/installation.xml:1636(command)
27408
msgid "sudo sysctl -w kernel.sysrq=1"
27409
msgstr ""
27410
27411
#: serverguide/C/installation.xml:1639(para)
27412
msgid ""
27413
"Once this is done, you must become root, as just using "
27414
"<command>sudo</command> will not be sufficient. As the "
27415
"<emphasis>root</emphasis> user, you will have to issue the command "
27416
"<command>echo c > /proc/sysrq-trigger</command>. If you are using a "
27417
"network connection, you will lose contact with the system. This is why it is "
27418
"better to do the test while being connected to the system console. This has "
27419
"the advantage of making the kernel dump process visible."
27420
msgstr ""
27421
27422
#: serverguide/C/installation.xml:1646(para)
27423
msgid "A typical test output should look like the following :"
27424
msgstr ""
27425
27426
#: serverguide/C/installation.xml:1651(command)
27427
msgid "sudo -s"
27428
msgstr ""
27429
27430
#: serverguide/C/installation.xml:1653(command)
27431
msgid "echo c > /proc/sysrq-trigger"
27432
msgstr ""
27433
27434
#: serverguide/C/installation.xml:1650(screen)
27435
#, no-wrap
27436
msgid ""
27437
"\n"
27438
"<placeholder-1/>\n"
27439
"[sudo] password for ubuntu: \n"
27440
"# <placeholder-2/>\n"
27441
"[ 31.659002] SysRq : Trigger a crash\n"
27442
"[ 31.659749] BUG: unable to handle kernel NULL pointer dereference at "
27443
" (null)\n"
27444
"[ 31.662668] IP: [<ffffffff8139f166>] sysrq_handle_crash+0x16/0x20\n"
27445
"[ 31.662668] PGD 3bfb9067 PUD 368a7067 PMD 0 \n"
27446
"[ 31.662668] Oops: 0002 [#1] SMP \n"
27447
"[ 31.662668] CPU 1 \n"
27448
"....\n"
27449
msgstr ""
27450
27451
#: serverguide/C/installation.xml:1663(para)
27452
msgid ""
27453
"The rest of the output is truncated, but you should see the system rebooting "
27454
"and somewhere in the log, you will see the following line : <screen>Begin: "
27455
"Saving vmcore from kernel crash ...</screen> Once completed, the system will "
27456
"reboot to its normal operational mode. You will then find Kernel Crash Dump "
27457
"file in the <filename>/var/crash</filename> directory :"
27458
msgstr ""
27459
27460
#: serverguide/C/installation.xml:1670(command)
27461
msgid "ls /var/crash"
27462
msgstr ""
27463
27464
#: serverguide/C/installation.xml:1669(screen)
27465
#, no-wrap
27466
msgid ""
27467
"\n"
27468
"<placeholder-1/>\n"
27469
"linux-image-3.0.0-12-server.0.crash\n"
27470
msgstr ""
27471
27472
#: serverguide/C/installation.xml:1679(para)
27473
msgid ""
27474
"Kernel Crash Dump is a vast topic that requires good knowledge of the linux "
27475
"kernel. You can find more information on the topic here :"
27476
msgstr ""
27477
27478
#: serverguide/C/installation.xml:1685(para)
27479
msgid ""
27480
"<ulink url=\"http://www.kernel.org/doc/Documentation/kdump/kdump.txt\">Kdump "
27481
"kernel documentation</ulink>."
27482
msgstr ""
27483
27484
#: serverguide/C/installation.xml:1691(ulink)
27485
msgid "The crash tool"
27486
msgstr ""
27487
27488
#: serverguide/C/installation.xml:1695(para)
27489
msgid ""
27490
"<ulink url=\"http://www.dedoimedo.com/computers/crash-"
27491
"analyze.html\">Analyzing Linux Kernel Crash</ulink> (Based on Fedora, it "
27492
"still gives a good walkthrough of kernel dump analysis)"
27493
msgstr ""
27494
27495
#: serverguide/C/file-server.xml:11(title)
27496
msgid "File Servers"
27497
msgstr "Server Berkas"
27498
27499
#: serverguide/C/file-server.xml:13(para)
27500
msgid ""
27501
"If you have more than one computer on a single network. At some point you "
27502
"will probably need to share files between them. In this section we cover "
27503
"installing and configuring FTP, NFS, and CUPS."
27504
msgstr ""
27505
27506
#: serverguide/C/file-server.xml:20(title)
27507
msgid "FTP Server"
27508
msgstr "Server FTP"
27509
27510
#: serverguide/C/file-server.xml:22(para)
27511
msgid ""
27512
"File Transfer Protocol (FTP) is a TCP protocol for downloading files between "
27513
"computers. In the past, it has also been used for uploading but, as that "
27514
"method does not use encryption, user credentials as well as data transferred "
27515
"in the clear and are easily intercepted. So if you are here looking for a "
27516
"way to upload and download files securely, see the section on "
27517
"<application>OpenSSH</application> in <xref linkend=\"remote-"
27518
"administration\"/> instead."
27519
msgstr ""
27520
27521
#: serverguide/C/file-server.xml:31(para)
27522
msgid ""
27523
"FTP works on a client/server model. The server component is called an "
27524
"<emphasis>FTP daemon</emphasis>. It continuously listens for FTP requests "
27525
"from remote clients. When a request is received, it manages the login and "
27526
"sets up the connection. For the duration of the session it executes any of "
27527
"commands sent by the FTP client."
27528
msgstr ""
27529
27530
#: serverguide/C/file-server.xml:40(para)
27531
msgid "Access to an FTP server can be managed in two ways:"
27532
msgstr "Akses ke server FTP dapat dilakukan dalam dua cara:"
27533
27534
#: serverguide/C/file-server.xml:44(para)
27535
msgid "Anonymous"
27536
msgstr "Anonymous"
27537
27538
#: serverguide/C/file-server.xml:47(para)
27539
msgid "Authenticated"
27540
msgstr "Authenticated"
27541
27542
#: serverguide/C/file-server.xml:50(para)
27543
msgid ""
27544
"In the Anonymous mode, remote clients can access the FTP server by using the "
27545
"default user account called \"anonymous\" or \"ftp\" and sending an email "
27546
"address as the password. In the Authenticated mode a user must have an "
27547
"account and a password. This latter choice is very insecure and should not "
27548
"be used except in special circumstances. If you are looking to transfer "
27549
"files securely see SFTP in the section on OpenSSH-Server. User access to the "
27550
"FTP server directories and files is dependent on the permissions defined for "
27551
"the account used at login. As a general rule, the FTP daemon will hide the "
27552
"root directory of the FTP server and change it to the FTP Home directory. "
27553
"This hides the rest of the file system from remote sessions."
27554
msgstr ""
27555
27556
#: serverguide/C/file-server.xml:68(title)
27557
msgid "vsftpd - FTP Server Installation"
27558
msgstr "vsftpd - Instalasi Server FTP"
27559
27560
#: serverguide/C/file-server.xml:70(para)
27561
msgid ""
27562
"<application>vsftpd</application> is an FTP daemon available in Ubuntu. It "
27563
"is easy to install, set up, and maintain. To install "
27564
"<application>vsftpd</application> you can run the following command:"
27565
msgstr ""
27566
27567
#: serverguide/C/file-server.xml:78(command)
27568
msgid "sudo apt install vsftpd"
27569
msgstr ""
27570
27571
#: serverguide/C/file-server.xml:84(title)
27572
msgid "Anonymous FTP Configuration"
27573
msgstr ""
27574
27575
#: serverguide/C/file-server.xml:86(para)
27576
msgid ""
27577
"By default <application>vsftpd</application> is <emphasis>not</emphasis> "
27578
"configured to allow anonymous download. If you wish to enable anonymous "
27579
"download edit <filename>/etc/vsftpd.conf</filename> by changing:"
27580
msgstr ""
27581
27582
#: serverguide/C/file-server.xml:91(programlisting)
27583
#, no-wrap
27584
msgid ""
27585
"\n"
27586
"anonymous_enable=Yes\n"
27587
msgstr ""
27588
27589
#: serverguide/C/file-server.xml:95(para)
27590
msgid ""
27591
"During installation a <emphasis>ftp</emphasis> user is created with a home "
27592
"directory of <filename>/srv/ftp</filename>. This is the default FTP "
27593
"directory."
27594
msgstr ""
27595
27596
#: serverguide/C/file-server.xml:100(para)
27597
msgid ""
27598
"If you wish to change this location, to <filename>/srv/files/ftp</filename> "
27599
"for example, simply create a directory in another location and change the "
27600
"<emphasis>ftp</emphasis> user's home directory:"
27601
msgstr ""
27602
27603
#: serverguide/C/file-server.xml:107(command)
27604
msgid "sudo mkdir /srv/files/ftp"
27605
msgstr ""
27606
27607
#: serverguide/C/file-server.xml:108(command)
27608
msgid "sudo usermod -d /srv/files/ftp ftp"
27609
msgstr ""
27610
27611
#: serverguide/C/file-server.xml:111(para)
27612
msgid "After making the change restart <application>vsftpd</application>:"
27613
msgstr ""
27614
27615
#: serverguide/C/file-server.xml:116(command) serverguide/C/file-server.xml:144(command) serverguide/C/file-server.xml:209(command) serverguide/C/file-server.xml:258(command)
27616
msgid "sudo restart vsftpd"
27617
msgstr ""
27618
27619
#: serverguide/C/file-server.xml:119(para)
27620
msgid ""
27621
"Finally, copy any files and directories you would like to make available "
27622
"through anonymous FTP to <filename>/srv/files/ftp</filename>, or "
27623
"<filename>/srv/ftp</filename> if you wish to use the default."
27624
msgstr ""
27625
27626
#: serverguide/C/file-server.xml:127(title)
27627
msgid "User Authenticated FTP Configuration"
27628
msgstr ""
27629
27630
#: serverguide/C/file-server.xml:129(para)
27631
msgid ""
27632
"By default <application>vsftpd</application> is configured to authenticate "
27633
"system users and allow them to download files. If you want users to be able "
27634
"to upload files, edit <filename>/etc/vsftpd.conf</filename>:"
27635
msgstr ""
27636
27637
#: serverguide/C/file-server.xml:135(programlisting)
27638
#, no-wrap
27639
msgid ""
27640
"\n"
27641
"write_enable=YES\n"
27642
msgstr ""
27643
27644
#: serverguide/C/file-server.xml:139(para)
27645
msgid "Now restart <application>vsftpd</application>:"
27646
msgstr ""
27647
27648
#: serverguide/C/file-server.xml:147(para)
27649
msgid ""
27650
"Now when system users login to FTP they will start in their "
27651
"<emphasis>home</emphasis> directories where they can download, upload, "
27652
"create directories, etc."
27653
msgstr ""
27654
27655
#: serverguide/C/file-server.xml:153(para)
27656
msgid ""
27657
"Similarly, by default, anonymous users are not allowed to upload files to "
27658
"FTP server. To change this setting, you should uncomment the following line, "
27659
"and restart <application>vsftpd</application>:"
27660
msgstr ""
27661
27662
#: serverguide/C/file-server.xml:160(programlisting)
27663
#, no-wrap
27664
msgid ""
27665
"\n"
27666
"anon_upload_enable=YES\n"
27667
msgstr ""
27668
27669
#: serverguide/C/file-server.xml:165(para)
27670
msgid ""
27671
"Enabling anonymous FTP upload can be an extreme security risk. It is best to "
27672
"not enable anonymous upload on servers accessed directly from the Internet."
27673
msgstr ""
27674
27675
#: serverguide/C/file-server.xml:171(para)
27676
msgid ""
27677
"The configuration file consists of many configuration parameters. The "
27678
"information about each parameter is available in the configuration file. "
27679
"Alternatively, you can refer to the man page, <command>man 5 "
27680
"vsftpd.conf</command> for details of each parameter."
27681
msgstr ""
27682
27683
#: serverguide/C/file-server.xml:182(title)
27684
msgid "Securing FTP"
27685
msgstr ""
27686
27687
#: serverguide/C/file-server.xml:184(para)
27688
msgid ""
27689
"There are options in <filename>/etc/vsftpd.conf</filename> to help make "
27690
"<application>vsftpd</application> more secure. For example users can be "
27691
"limited to their home directories by uncommenting:"
27692
msgstr ""
27693
27694
#: serverguide/C/file-server.xml:190(programlisting)
27695
#, no-wrap
27696
msgid ""
27697
"\n"
27698
"chroot_local_user=YES\n"
27699
msgstr ""
27700
27701
#: serverguide/C/file-server.xml:194(para)
27702
msgid ""
27703
"You can also limit a specific list of users to just their home directories:"
27704
msgstr ""
27705
27706
#: serverguide/C/file-server.xml:198(programlisting)
27707
#, no-wrap
27708
msgid ""
27709
"\n"
27710
"chroot_list_enable=YES\n"
27711
"chroot_list_file=/etc/vsftpd.chroot_list\n"
27712
msgstr ""
27713
27714
#: serverguide/C/file-server.xml:203(para)
27715
msgid ""
27716
"After uncommenting the above options, create a "
27717
"<filename>/etc/vsftpd.chroot_list</filename> containing a list of users one "
27718
"per line. Then restart <application>vsftpd</application>:"
27719
msgstr ""
27720
27721
#: serverguide/C/file-server.xml:212(para)
27722
msgid ""
27723
"Also, the <filename>/etc/ftpusers</filename> file is a list of users that "
27724
"are <emphasis>disallowed</emphasis> FTP access. The default list includes "
27725
"root, daemon, nobody, etc. To disable FTP access for additional users simply "
27726
"add them to the list."
27727
msgstr ""
27728
27729
#: serverguide/C/file-server.xml:219(para)
27730
msgid ""
27731
"FTP can also be encrypted using <emphasis>FTPS</emphasis>. Different from "
27732
"<emphasis>SFTP</emphasis>, <emphasis>FTPS</emphasis> is FTP over Secure "
27733
"Socket Layer (SSL). <emphasis>SFTP</emphasis> is a FTP like session over an "
27734
"encrypted <emphasis>SSH</emphasis> connection. A major difference is that "
27735
"users of SFTP need to have a <emphasis>shell</emphasis> account on the "
27736
"system, instead of a <emphasis>nologin</emphasis> shell. Providing all users "
27737
"with a shell may not be ideal for some environments, such as a shared web "
27738
"host. However, it is possible to restrict such accounts to only SFTP and "
27739
"disable shell interaction. See the section on OpenSSH-Server for more."
27740
msgstr ""
27741
27742
#: serverguide/C/file-server.xml:229(para)
27743
msgid ""
27744
"To configure <emphasis>FTPS</emphasis>, edit "
27745
"<filename>/etc/vsftpd.conf</filename> and at the bottom add:"
27746
msgstr ""
27747
27748
#: serverguide/C/file-server.xml:233(programlisting)
27749
#, no-wrap
27750
msgid ""
27751
"\n"
27752
"ssl_enable=Yes\n"
27753
msgstr ""
27754
27755
#: serverguide/C/file-server.xml:237(para)
27756
msgid "Also, notice the certificate and key related options:"
27757
msgstr ""
27758
27759
#: serverguide/C/file-server.xml:241(programlisting)
27760
#, no-wrap
27761
msgid ""
27762
"\n"
27763
"rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem\n"
27764
"rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key\n"
27765
msgstr ""
27766
27767
#: serverguide/C/file-server.xml:246(para)
27768
msgid ""
27769
"By default these options are set to the certificate and key provided by the "
27770
"<application>ssl-cert</application> package. In a production environment "
27771
"these should be replaced with a certificate and key generated for the "
27772
"specific host. For more information on certificates see <xref "
27773
"linkend=\"certificates-and-security\"/>."
27774
msgstr ""
27775
27776
#: serverguide/C/file-server.xml:252(para)
27777
msgid ""
27778
"Now restart <application>vsftpd</application>, and non-anonymous users will "
27779
"be forced to use <emphasis>FTPS</emphasis>:"
27780
msgstr ""
27781
27782
#: serverguide/C/file-server.xml:261(para)
27783
msgid ""
27784
"To allow users with a shell of <filename>/usr/sbin/nologin</filename> access "
27785
"to FTP, but have no shell access, edit <filename>/etc/shells</filename> "
27786
"adding the <emphasis>nologin</emphasis> shell:"
27787
msgstr ""
27788
27789
#: serverguide/C/file-server.xml:266(programlisting)
27790
#, no-wrap
27791
msgid ""
27792
"\n"
27793
"# /etc/shells: valid login shells\n"
27794
"/bin/csh\n"
27795
"/bin/sh\n"
27796
"/usr/bin/es\n"
27797
"/usr/bin/ksh\n"
27798
"/bin/ksh\n"
27799
"/usr/bin/rc\n"
27800
"/usr/bin/tcsh\n"
27801
"/bin/tcsh\n"
27802
"/usr/bin/esh\n"
27803
"/bin/dash\n"
27804
"/bin/bash\n"
27805
"/bin/rbash\n"
27806
"/usr/bin/screen\n"
27807
"/usr/sbin/nologin\n"
27808
msgstr ""
27809
27810
#: serverguide/C/file-server.xml:284(para)
27811
msgid ""
27812
"This is necessary because, by default <application>vsftpd</application> uses "
27813
"PAM for authentication, and the <filename>/etc/pam.d/vsftpd</filename> "
27814
"configuration file contains:"
27815
msgstr ""
27816
27817
#: serverguide/C/file-server.xml:289(programlisting)
27818
#, no-wrap
27819
msgid ""
27820
"\n"
27821
"auth required pam_shells.so\n"
27822
msgstr ""
27823
27824
#: serverguide/C/file-server.xml:293(para)
27825
msgid ""
27826
"The <emphasis>shells</emphasis> PAM module restricts access to shells listed "
27827
"in the <filename>/etc/shells</filename> file."
27828
msgstr ""
27829
27830
#: serverguide/C/file-server.xml:298(para)
27831
msgid ""
27832
"Most popular FTP clients can be configured to connect using FTPS. The "
27833
"<application>lftp</application> command line FTP client has the ability to "
27834
"use FTPS as well."
27835
msgstr ""
27836
27837
#: serverguide/C/file-server.xml:309(para)
27838
msgid ""
27839
"See the <ulink url=\"http://vsftpd.beasts.org/vsftpd_conf.html\">vsftpd "
27840
"website</ulink> for more information."
27841
msgstr ""
27842
27843
#: serverguide/C/file-server.xml:314(para)
27844
msgid ""
27845
"For detailed <filename>/etc/vsftpd.conf</filename> options see the <ulink "
27846
"url=\"http://manpages.ubuntu.com/manpages/xenial/en/man5/vsftpd.conf.5.html\""
27847
">vsftpd.conf man page</ulink>."
27848
msgstr ""
27849
27850
#: serverguide/C/file-server.xml:325(title)
27851
msgid "Network File System (NFS)"
27852
msgstr "Network File System (NFS)"
27853
27854
#: serverguide/C/file-server.xml:326(para)
27855
msgid ""
27856
"NFS allows a system to share directories and files with others over a "
27857
"network. By using NFS, users and programs can access files on remote systems "
27858
"almost as if they were local files."
27859
msgstr ""
27860
27861
#: serverguide/C/file-server.xml:332(para)
27862
msgid "Some of the most notable benefits that NFS can provide are:"
27863
msgstr "Beberapa keuntungan penting yang disediakan oleh NFS adalah:"
27864
27865
#: serverguide/C/file-server.xml:338(para)
27866
msgid ""
27867
"Local workstations use less disk space because commonly used data can be "
27868
"stored on a single machine and still remain accessible to others over the "
27869
"network."
27870
msgstr ""
27871
27872
#: serverguide/C/file-server.xml:343(para)
27873
msgid ""
27874
"There is no need for users to have separate home directories on every "
27875
"network machine. Home directories could be set up on the NFS server and made "
27876
"available throughout the network."
27877
msgstr ""
27878
27879
#: serverguide/C/file-server.xml:349(para)
27880
msgid ""
27881
"Storage devices such as floppy disks, CDROM drives, and USB Thumb drives can "
27882
"be used by other machines on the network. This may reduce the number of "
27883
"removable media drives throughout the network."
27884
msgstr ""
27885
27886
#: serverguide/C/file-server.xml:359(para)
27887
msgid ""
27888
"At a terminal prompt enter the following command to install the NFS Server:"
27889
msgstr ""
27890
27891
#: serverguide/C/file-server.xml:365(command)
27892
msgid "sudo apt install nfs-kernel-server"
27893
msgstr ""
27894
27895
#: serverguide/C/file-server.xml:371(para)
27896
msgid ""
27897
"You can configure the directories to be exported by adding them to the "
27898
"<filename>/etc/exports</filename> file. For example:"
27899
msgstr ""
27900
"Anda dapat mengkonfigurasikan direktori yang akan di export dengan "
27901
"menambahkannya ke file <filename>/etc/exports</filename>. Contohnya:"
27902
27903
#: serverguide/C/file-server.xml:376(screen)
27904
#, no-wrap
27905
msgid ""
27906
"\n"
27907
"/ubuntu *(ro,sync,no_root_squash)\n"
27908
"/home *(rw,sync,no_root_squash)\n"
27909
msgstr ""
27910
"\n"
27911
"/ubuntu *(ro,sync,no_root_squash)\n"
27912
"/home *(rw,sync,no_root_squash)\n"
27913
27914
#: serverguide/C/file-server.xml:382(para)
27915
msgid ""
27916
"You can replace * with one of the hostname formats. Make the hostname "
27917
"declaration as specific as possible so unwanted systems cannot access the "
27918
"NFS mount."
27919
msgstr ""
27920
27921
#: serverguide/C/file-server.xml:388(para)
27922
msgid ""
27923
"To start the NFS server, you can run the following command at a terminal "
27924
"prompt:"
27925
msgstr ""
27926
27927
#: serverguide/C/file-server.xml:393(command)
27928
msgid "sudo systemctl start nfs-kernel-server.service"
27929
msgstr ""
27930
27931
#: serverguide/C/file-server.xml:398(title)
27932
msgid "NFS Client Configuration"
27933
msgstr "Konfigurasi Klien NFS"
27934
27935
#: serverguide/C/file-server.xml:399(para)
27936
msgid ""
27937
"Use the <application>mount</application> command to mount a shared NFS "
27938
"directory from another machine, by typing a command line similar to the "
27939
"following at a terminal prompt:"
27940
msgstr ""
27941
27942
#: serverguide/C/file-server.xml:405(command)
27943
msgid "sudo mount example.hostname.com:/ubuntu /local/ubuntu"
27944
msgstr "sudo mount example.hostname.com:/ubuntu /local/ubuntu"
27945
27946
#: serverguide/C/file-server.xml:409(para)
27947
msgid ""
27948
"The mount point directory <filename>/local/ubuntu</filename> must exist. "
27949
"There should be no files or subdirectories in the "
27950
"<filename>/local/ubuntu</filename> directory."
27951
msgstr ""
27952
27953
#: serverguide/C/file-server.xml:416(para)
27954
msgid ""
27955
"An alternate way to mount an NFS share from another machine is to add a line "
27956
"to the <filename>/etc/fstab</filename> file. The line must state the "
27957
"hostname of the NFS server, the directory on the server being exported, and "
27958
"the directory on the local machine where the NFS share is to be mounted."
27959
msgstr ""
27960
27961
#: serverguide/C/file-server.xml:424(para)
27962
msgid ""
27963
"The general syntax for the line in <filename>/etc/fstab</filename> file is "
27964
"as follows:"
27965
msgstr ""
27966
27967
#: serverguide/C/file-server.xml:429(programlisting)
27968
#, no-wrap
27969
msgid ""
27970
"\n"
27971
"example.hostname.com:/ubuntu /local/ubuntu nfs "
27972
"rsize=8192,wsize=8192,timeo=14,intr\n"
27973
msgstr ""
27974
"\n"
27975
"example.hostname.com:/ubuntu /local/ubuntu nfs "
27976
"rsize=8192,wsize=8192,timeo=14,intr\n"
27977
27978
#: serverguide/C/file-server.xml:433(para)
27979
msgid ""
27980
"If you have trouble mounting an NFS share, make sure the <application>nfs-"
27981
"common</application> package is installed on your client. To install "
27982
"<application>nfs-common</application> enter the following command at the "
27983
"terminal prompt: <screen>\n"
27984
"<command>sudo apt install nfs-common</command>\n"
27985
"</screen>"
27986
msgstr ""
27987
27988
#: serverguide/C/file-server.xml:446(ulink)
27989
msgid "Linux NFS faq"
27990
msgstr "Faq NFS Linux"
27991
27992
#: serverguide/C/file-server.xml:448(ulink)
27993
msgid "Ubuntu Wiki NFS Howto"
27994
msgstr ""
27995
27996
#: serverguide/C/file-server.xml:454(title)
27997
msgid "iSCSI Initiator"
27998
msgstr ""
27999
28000
#: serverguide/C/file-server.xml:456(para)
28001
msgid ""
28002
"<emphasis>iSCSI</emphasis> (Internet Small Computer System Interface) is a "
28003
"protocol that allows SCSI commands to be transmitted over a network. "
28004
"Typically iSCSI is implemented in a SAN (Storage Area Network) to allow "
28005
"servers to access a large store of hard drive space. The iSCSI protocol "
28006
"refers to clients as <emphasis>initiators</emphasis> and iSCSI servers as "
28007
"<emphasis>targets</emphasis>."
28008
msgstr ""
28009
28010
#: serverguide/C/file-server.xml:462(para)
28011
msgid ""
28012
"Ubuntu Server can be configured as both an iSCSI initiator and a target. "
28013
"This guide provides commands and configuration options to setup an iSCSI "
28014
"initiator. It is assumed that you already have an iSCSI target on your local "
28015
"network and have the appropriate rights to connect to it. The instructions "
28016
"for setting up a target vary greatly between hardware providers, so consult "
28017
"your vendor documentation to configure your specific iSCSI target."
28018
msgstr ""
28019
28020
#: serverguide/C/file-server.xml:470(title)
28021
msgid "iSCSI Initiator Install"
28022
msgstr ""
28023
28024
#: serverguide/C/file-server.xml:472(para)
28025
msgid ""
28026
"To configure Ubuntu Server as an iSCSI initiator install the "
28027
"<application>open-iscsi</application> package. In a terminal enter:"
28028
msgstr ""
28029
28030
#: serverguide/C/file-server.xml:477(command)
28031
msgid "sudo apt install open-iscsi"
28032
msgstr ""
28033
28034
#: serverguide/C/file-server.xml:482(title)
28035
msgid "iSCSI Initiator Configuration"
28036
msgstr ""
28037
28038
#: serverguide/C/file-server.xml:484(para)
28039
msgid ""
28040
"Once the <application>open-iscsi</application> package is installed, edit "
28041
"<filename>/etc/iscsi/iscsid.conf</filename> changing the following:"
28042
msgstr ""
28043
28044
#: serverguide/C/file-server.xml:488(programlisting)
28045
#, no-wrap
28046
msgid ""
28047
"\n"
28048
"node.startup = automatic\n"
28049
msgstr ""
28050
28051
#: serverguide/C/file-server.xml:492(para)
28052
msgid ""
28053
"You can check which targets are available by using the "
28054
"<application>iscsiadm</application> utility. Enter the following in a "
28055
"terminal:"
28056
msgstr ""
28057
28058
#: serverguide/C/file-server.xml:497(command)
28059
msgid "sudo iscsiadm -m discovery -t st -p 192.168.0.10"
28060
msgstr ""
28061
28062
#: serverguide/C/file-server.xml:501(para)
28063
msgid ""
28064
"<emphasis>-m:</emphasis> determines the mode that iscsiadm executes in."
28065
msgstr ""
28066
28067
#: serverguide/C/file-server.xml:502(para)
28068
msgid "<emphasis>-t:</emphasis> specifies the type of discovery."
28069
msgstr ""
28070
28071
#: serverguide/C/file-server.xml:503(para)
28072
msgid "<emphasis>-p:</emphasis> option indicates the target IP address."
28073
msgstr ""
28074
28075
#: serverguide/C/file-server.xml:507(para)
28076
msgid ""
28077
"Change example <emphasis>192.168.0.10</emphasis> to the target IP address on "
28078
"your network."
28079
msgstr ""
28080
28081
#: serverguide/C/file-server.xml:512(para)
28082
msgid ""
28083
"If the target is available you should see output similar to the following:"
28084
msgstr ""
28085
28086
#: serverguide/C/file-server.xml:517(computeroutput)
28087
#, no-wrap
28088
msgid ""
28089
"\n"
28090
"192.168.0.10:3260,1 iqn.1992-05.com.emc:sl7b92030000520000-2\n"
28091
msgstr ""
28092
28093
#: serverguide/C/file-server.xml:523(para)
28094
msgid ""
28095
"The <emphasis>iqn</emphasis> number and IP address above will vary depending "
28096
"on your hardware."
28097
msgstr ""
28098
28099
#: serverguide/C/file-server.xml:528(para)
28100
msgid ""
28101
"You should now be able to connect to the iSCSI target, and depending on your "
28102
"target setup you may have to enter user credentials. Login to the iSCSI node:"
28103
msgstr ""
28104
28105
#: serverguide/C/file-server.xml:534(command)
28106
msgid "sudo iscsiadm -m node --login"
28107
msgstr ""
28108
28109
#: serverguide/C/file-server.xml:537(para)
28110
msgid ""
28111
"Check to make sure that the new disk has been detected using "
28112
"<application>dmesg</application>:"
28113
msgstr ""
28114
28115
#: serverguide/C/file-server.xml:542(command)
28116
msgid "dmesg | grep sd"
28117
msgstr ""
28118
28119
#: serverguide/C/file-server.xml:543(computeroutput)
28120
#, no-wrap
28121
msgid ""
28122
"\n"
28123
"[ 4.322384] sd 2:0:0:0: Attached scsi generic sg1 type 0\n"
28124
"[ 4.322797] sd 2:0:0:0: [sda] 41943040 512-byte logical blocks: (21.4 "
28125
"GB/20.0 GiB)\n"
28126
"[ 4.322843] sd 2:0:0:0: [sda] Write Protect is off\n"
28127
"[ 4.322846] sd 2:0:0:0: [sda] Mode Sense: 03 00 00 00\n"
28128
"[ 4.322896] sd 2:0:0:0: [sda] Cache data unavailable\n"
28129
"[ 4.322899] sd 2:0:0:0: [sda] Assuming drive cache: write through\n"
28130
"[ 4.323230] sd 2:0:0:0: [sda] Cache data unavailable\n"
28131
"[ 4.323233] sd 2:0:0:0: [sda] Assuming drive cache: write through\n"
28132
"[ 4.325312] sda: sda1 sda2 < sda5 >\n"
28133
"[ 4.325729] sd 2:0:0:0: [sda] Cache data unavailable\n"
28134
"[ 4.325732] sd 2:0:0:0: [sda] Assuming drive cache: write through\n"
28135
"[ 4.325735] sd 2:0:0:0: [sda] Attached SCSI disk\n"
28136
"[ 2486.941805] sd 4:0:0:3: Attached scsi generic sg3 type 0\n"
28137
"[ 2486.952093] sd 4:0:0:3: [sdb] 1126400000 512-byte logical blocks: (576 "
28138
"GB/537 GiB)\n"
28139
"[ 2486.954195] sd 4:0:0:3: [sdb] Write Protect is off\n"
28140
"[ 2486.954200] sd 4:0:0:3: [sdb] Mode Sense: 8f 00 00 08\n"
28141
"[ 2486.954692] sd 4:0:0:3: [sdb] Write cache: disabled, read cache: enabled, "
28142
"doesn't\n"
28143
" support DPO or FUA\n"
28144
"[ 2486.960577] sdb: sdb1\n"
28145
"[ 2486.964862] sd 4:0:0:3: [sdb] Attached SCSI disk\n"
28146
msgstr ""
28147
28148
#: serverguide/C/file-server.xml:567(para)
28149
msgid ""
28150
"In the output above <emphasis>sdb</emphasis> is the new iSCSI disk. Remember "
28151
"this is just an example; the output you see on your screen will vary."
28152
msgstr ""
28153
28154
#: serverguide/C/file-server.xml:572(para)
28155
msgid ""
28156
"Next, create a partition, format the file system, and mount the new iSCSI "
28157
"disk. In a terminal enter:"
28158
msgstr ""
28159
28160
#: serverguide/C/file-server.xml:577(command)
28161
msgid "sudo fdisk /dev/sdb"
28162
msgstr ""
28163
28164
#: serverguide/C/file-server.xml:578(command)
28165
msgid "n"
28166
msgstr ""
28167
28168
#: serverguide/C/file-server.xml:579(command)
28169
msgid "p"
28170
msgstr ""
28171
28172
#: serverguide/C/file-server.xml:580(command)
28173
msgid "enter"
28174
msgstr ""
28175
28176
#: serverguide/C/file-server.xml:581(command)
28177
msgid "w"
28178
msgstr ""
28179
28180
#: serverguide/C/file-server.xml:585(para)
28181
msgid ""
28182
"The above commands are from inside the <application>fdisk</application> "
28183
"utility; see <command>man fdisk</command> for more detailed instructions. "
28184
"Also, the <application>cfdisk</application> utility is sometimes more user "
28185
"friendly."
28186
msgstr ""
28187
28188
#: serverguide/C/file-server.xml:591(para)
28189
msgid ""
28190
"Now format the file system and mount it to <filename>/srv</filename> as an "
28191
"example:"
28192
msgstr ""
28193
28194
#: serverguide/C/file-server.xml:596(command)
28195
msgid "sudo mkfs.ext4 /dev/sdb1"
28196
msgstr ""
28197
28198
#: serverguide/C/file-server.xml:597(command)
28199
msgid "sudo mount /dev/sdb1 /srv"
28200
msgstr ""
28201
28202
#: serverguide/C/file-server.xml:601(para)
28203
msgid ""
28204
"Finally, add an entry to <filename>/etc/fstab</filename> to mount the iSCSI "
28205
"drive during boot:"
28206
msgstr ""
28207
28208
#: serverguide/C/file-server.xml:605(programlisting)
28209
#, no-wrap
28210
msgid ""
28211
"\n"
28212
"/dev/sdb1 /srv ext4 defaults,auto,_netdev 0 0\n"
28213
msgstr ""
28214
28215
#: serverguide/C/file-server.xml:609(para)
28216
msgid ""
28217
"It is a good idea to make sure everything is working as expected by "
28218
"rebooting the server."
28219
msgstr ""
28220
28221
#: serverguide/C/file-server.xml:618(ulink)
28222
msgid "Open-iSCSI Website"
28223
msgstr ""
28224
28225
#: serverguide/C/file-server.xml:621(ulink) serverguide/C/file-server.xml:807(ulink)
28226
msgid "Debian Open-iSCSI page"
28227
msgstr ""
28228
28229
#: serverguide/C/file-server.xml:628(title)
28230
msgid "CUPS - Print Server"
28231
msgstr "CUPS - Server Print"
28232
28233
#: serverguide/C/file-server.xml:629(para)
28234
msgid ""
28235
"The primary mechanism for Ubuntu printing and print services is the "
28236
"<emphasis role=\"bold\">Common UNIX Printing System</emphasis> (CUPS). This "
28237
"printing system is a freely available, portable printing layer which has "
28238
"become the new standard for printing in most Linux distributions."
28239
msgstr ""
28240
28241
#: serverguide/C/file-server.xml:636(para)
28242
msgid ""
28243
"CUPS manages print jobs and queues and provides network printing using the "
28244
"standard Internet Printing Protocol (IPP), while offering support for a very "
28245
"large range of printers, from dot-matrix to laser and many in between. CUPS "
28246
"also supports PostScript Printer Description (PPD) and auto-detection of "
28247
"network printers, and features a simple web-based configuration and "
28248
"administration tool."
28249
msgstr ""
28250
28251
#: serverguide/C/file-server.xml:646(para)
28252
msgid ""
28253
"To install CUPS on your Ubuntu computer, simply use "
28254
"<application>sudo</application> with the <application>apt</application> "
28255
"command and give the packages to install as the first parameter. A complete "
28256
"CUPS install has many package dependencies, but they may all be specified on "
28257
"the same command line. Enter the following at a terminal prompt to install "
28258
"CUPS:"
28259
msgstr ""
28260
28261
#: serverguide/C/file-server.xml:651(command)
28262
msgid "sudo apt install cups"
28263
msgstr ""
28264
28265
#: serverguide/C/file-server.xml:654(para)
28266
msgid ""
28267
"Upon authenticating with your user password, the packages should be "
28268
"downloaded and installed without error. Upon the conclusion of installation, "
28269
"the CUPS server will be started automatically."
28270
msgstr ""
28271
28272
#: serverguide/C/file-server.xml:659(para)
28273
msgid ""
28274
"For troubleshooting purposes, you can access CUPS server errors via the "
28275
"error log file at: <filename>/var/log/cups/error_log</filename>. If the "
28276
"error log does not show enough information to troubleshoot any problems you "
28277
"encounter, the verbosity of the CUPS log can be increased by changing the "
28278
"<emphasis role=\"bold\">LogLevel</emphasis> directive in the configuration "
28279
"file (discussed below) to \"debug\" or even \"debug2\", which logs "
28280
"everything, from the default of \"info\". If you make this change, remember "
28281
"to change it back once you've solved your problem, to prevent the log file "
28282
"from becoming overly large."
28283
msgstr ""
28284
28285
#: serverguide/C/file-server.xml:672(para)
28286
msgid ""
28287
"The Common UNIX Printing System server's behavior is configured through the "
28288
"directives contained in the file <filename>/etc/cups/cupsd.conf</filename>. "
28289
"The CUPS configuration file follows the same syntax as the primary "
28290
"configuration file for the Apache HTTP server, so users familiar with "
28291
"editing Apache's configuration file should feel at ease when editing the "
28292
"CUPS configuration file. Some examples of settings you may wish to change "
28293
"initially will be presented here."
28294
msgstr ""
28295
28296
#: serverguide/C/file-server.xml:682(para)
28297
msgid ""
28298
"Prior to editing the configuration file, you should make a copy of the "
28299
"original file and protect it from writing, so you will have the original "
28300
"settings as a reference, and to reuse as necessary."
28301
msgstr ""
28302
28303
#: serverguide/C/file-server.xml:686(para)
28304
msgid ""
28305
"Copy the <filename>/etc/cups/cupsd.conf</filename> file and protect it from "
28306
"writing with the following commands, issued at a terminal prompt:"
28307
msgstr ""
28308
"Salin berkas <filename>/etc/cups/cupsd.conf</filename> dan lindungi dari "
28309
"penulisan dengan menjalankan perintah berikut pada terminal prompt:"
28310
28311
#: serverguide/C/file-server.xml:692(command)
28312
msgid "sudo cp /etc/cups/cupsd.conf /etc/cups/cupsd.conf.original"
28313
msgstr "sudo cp /etc/cups/cupsd.conf /etc/cups/cupsd.conf.original"
28314
28315
#: serverguide/C/file-server.xml:693(command)
28316
msgid "sudo chmod a-w /etc/cups/cupsd.conf.original"
28317
msgstr "sudo chmod a-w /etc/cups/cupsd.conf.original"
28318
28319
#: serverguide/C/file-server.xml:698(para)
28320
msgid ""
28321
"<emphasis role=\"bold\">ServerAdmin</emphasis>: To configure the email "
28322
"address of the designated administrator of the CUPS server, simply edit the "
28323
"<filename>/etc/cups/cupsd.conf</filename> configuration file with your "
28324
"preferred text editor, and add or modify the <emphasis "
28325
"role=\"italics\">ServerAdmin</emphasis> line accordingly. For example, if "
28326
"you are the Administrator for the CUPS server, and your e-mail address is "
28327
"'bjoy@somebigco.com', then you would modify the ServerAdmin line to appear "
28328
"as such:"
28329
msgstr ""
28330
28331
#: serverguide/C/file-server.xml:709(screen)
28332
#, no-wrap
28333
msgid ""
28334
"\n"
28335
"ServerAdmin bjoy@somebigco.com\n"
28336
msgstr ""
28337
"\n"
28338
"ServerAdmin bjoy@somebigco.com\n"
28339
28340
#: serverguide/C/file-server.xml:715(para)
28341
msgid ""
28342
"<emphasis role=\"bold\">Listen</emphasis>: By default on Ubuntu, the CUPS "
28343
"server installation listens only on the loopback interface at IP address "
28344
"<emphasis>127.0.0.1</emphasis>. In order to instruct the CUPS server to "
28345
"listen on an actual network adapter's IP address, you must specify either a "
28346
"hostname, the IP address, or optionally, an IP address/port pairing via the "
28347
"addition of a Listen directive. For example, if your CUPS server resides on "
28348
"a local network at the IP address <emphasis "
28349
"role=\"italics\">192.168.10.250</emphasis> and you'd like to make it "
28350
"accessible to the other systems on this subnetwork, you would edit the "
28351
"<filename>/etc/cups/cupsd.conf</filename> and add a Listen directive, as "
28352
"such:"
28353
msgstr ""
28354
28355
#: serverguide/C/file-server.xml:729(screen)
28356
#, no-wrap
28357
msgid ""
28358
"\n"
28359
"Listen 127.0.0.1:631 # existing loopback Listen\n"
28360
"Listen /var/run/cups/cups.sock # existing socket Listen\n"
28361
"Listen 192.168.10.250:631 # Listen on the LAN interface, Port 631 "
28362
"(IPP)\n"
28363
msgstr ""
28364
"\n"
28365
"Listen 127.0.0.1:631 # existing loopback Listen\n"
28366
"Listen /var/run/cups/cups.sock # existing socket Listen\n"
28367
"Listen 192.168.10.250:631 # Listen on the LAN interface, Port 631 "
28368
"(IPP)\n"
28369
28370
#: serverguide/C/file-server.xml:735(para)
28371
msgid ""
28372
"In the example above, you may comment out or remove the reference to the "
28373
"Loopback address (127.0.0.1) if you do not wish <application>cupsd "
28374
"</application> to listen on that interface, but would rather have it only "
28375
"listen on the Ethernet interfaces of the Local Area Network (LAN). To enable "
28376
"listening for all network interfaces for which a certain hostname is bound, "
28377
"including the Loopback, you could create a Listen entry for the hostname "
28378
"<emphasis>socrates</emphasis> as such:"
28379
msgstr ""
28380
28381
#: serverguide/C/file-server.xml:745(screen)
28382
#, no-wrap
28383
msgid ""
28384
"\n"
28385
"Listen socrates:631 # Listen on all interfaces for the hostname 'socrates'\n"
28386
msgstr ""
28387
"\n"
28388
"Listen socrates:631 # Listen on all interfaces for the hostname 'socrates'\n"
28389
28390
#: serverguide/C/file-server.xml:749(para)
28391
msgid ""
28392
"or by omitting the Listen directive and using <emphasis>Port</emphasis> "
28393
"instead, as in:"
28394
msgstr ""
28395
28396
#: serverguide/C/file-server.xml:751(screen)
28397
#, no-wrap
28398
msgid ""
28399
"\n"
28400
"Port 631 # Listen on port 631 on all interfaces\n"
28401
msgstr ""
28402
"\n"
28403
"Port 631 # Listen on port 631 on all interfaces\n"
28404
28405
#: serverguide/C/file-server.xml:758(para)
28406
msgid ""
28407
"For more examples of configuration directives in the CUPS server "
28408
"configuration file, view the associated system manual page by entering the "
28409
"following command at a terminal prompt:"
28410
msgstr ""
28411
28412
#: serverguide/C/file-server.xml:765(command)
28413
msgid "man cupsd.conf"
28414
msgstr "man cupsd.conf"
28415
28416
#: serverguide/C/file-server.xml:769(para)
28417
msgid ""
28418
"Whenever you make changes to the <filename>/etc/cups/cupsd.conf</filename> "
28419
"configuration file, you'll need to restart the CUPS server by typing the "
28420
"following command at a terminal prompt:"
28421
msgstr ""
28422
28423
#: serverguide/C/file-server.xml:775(command)
28424
msgid "sudo systemctl restart cups.service"
28425
msgstr ""
28426
28427
#: serverguide/C/file-server.xml:781(title)
28428
msgid "Web Interface"
28429
msgstr ""
28430
28431
#: serverguide/C/file-server.xml:783(para)
28432
msgid ""
28433
"CUPS can be configured and monitored using a web interface, which by default "
28434
"is available at <ulink "
28435
"url=\"http://localhost:631/admin\">http://localhost:631/admin</ulink>. The "
28436
"web interface can be used to perform all printer management tasks."
28437
msgstr ""
28438
28439
#: serverguide/C/file-server.xml:787(para)
28440
msgid ""
28441
"In order to perform administrative tasks via the web interface, you must "
28442
"either have the root account enabled on your server, or authenticate as a "
28443
"user in the <emphasis role=\"italic\">lpadmin</emphasis> group. For security "
28444
"reasons, CUPS won't authenticate a user that doesn't have a password."
28445
msgstr ""
28446
28447
#: serverguide/C/file-server.xml:790(para)
28448
msgid ""
28449
"To add a user to the <emphasis role=\"italic\">lpadmin</emphasis> group, run "
28450
"at the terminal prompt: <screen>\n"
28451
"<command>sudo usermod -aG lpadmin username</command>\n"
28452
"</screen>"
28453
msgstr ""
28454
28455
#: serverguide/C/file-server.xml:796(para)
28456
msgid ""
28457
"Further documentation is available in the <emphasis "
28458
"role=\"italic\">Documentation/Help</emphasis> tab of the web interface."
28459
msgstr ""
28460
28461
#: serverguide/C/file-server.xml:804(ulink)
28462
msgid "CUPS Website"
28463
msgstr "Situs Web CUPS"
28464
28465
#: serverguide/C/dns.xml:11(title)
28466
msgid "Domain Name Service (DNS)"
28467
msgstr "Domain Name Service (DNS)"
28468
28469
#: serverguide/C/dns.xml:12(para)
28470
msgid ""
28471
"Domain Name Service (DNS) is an Internet service that maps IP addresses and "
28472
"fully qualified domain names (FQDN) to one another. In this way, DNS "
28473
"alleviates the need to remember IP addresses. Computers that run DNS are "
28474
"called <emphasis>name servers</emphasis>. Ubuntu ships with "
28475
"<application>BIND</application> (Berkley Internet Naming Daemon), the most "
28476
"common program used for maintaining a name server on Linux."
28477
msgstr ""
28478
28479
#: serverguide/C/dns.xml:22(para)
28480
msgid ""
28481
"At a terminal prompt, enter the following command to install "
28482
"<application>dns</application>:"
28483
msgstr ""
28484
"Pada terminal prompt, masukkan perintah berikut untuk menginstal "
28485
"<application>dns</application>:"
28486
28487
#: serverguide/C/dns.xml:26(command)
28488
msgid "sudo apt install bind9"
28489
msgstr ""
28490
28491
#: serverguide/C/dns.xml:28(para)
28492
msgid ""
28493
"A very useful package for testing and troubleshooting DNS issues is the "
28494
"dnsutils package. Very often these tools will be installed already, but to "
28495
"check and/or install <application>dnsutils</application> enter the following:"
28496
msgstr ""
28497
28498
#: serverguide/C/dns.xml:33(command)
28499
msgid "sudo apt install dnsutils"
28500
msgstr ""
28501
28502
#: serverguide/C/dns.xml:38(para)
28503
msgid ""
28504
"There are many ways to configure <application>BIND9</application>. Some of "
28505
"the most common configurations are a caching nameserver, primary master, and "
28506
"as a secondary master."
28507
msgstr ""
28508
28509
#: serverguide/C/dns.xml:44(para)
28510
msgid ""
28511
"When configured as a caching nameserver BIND9 will find the answer to name "
28512
"queries and remember the answer when the domain is queried again."
28513
msgstr ""
28514
28515
#: serverguide/C/dns.xml:50(para)
28516
msgid ""
28517
"As a primary master server BIND9 reads the data for a zone from a file on "
28518
"it's host and is authoritative for that zone."
28519
msgstr ""
28520
28521
#: serverguide/C/dns.xml:55(para)
28522
msgid ""
28523
"In a secondary master configuration BIND9 gets the zone data from another "
28524
"nameserver authoritative for the zone."
28525
msgstr ""
28526
28527
#: serverguide/C/dns.xml:63(para)
28528
msgid ""
28529
"The DNS configuration files are stored in the <filename>/etc/bind</filename> "
28530
"directory. The primary configuration file is "
28531
"<filename>/etc/bind/named.conf</filename>."
28532
msgstr ""
28533
28534
#: serverguide/C/dns.xml:70(para)
28535
msgid ""
28536
"The <emphasis>include</emphasis> line specifies the filename which contains "
28537
"the DNS options. The <emphasis>directory</emphasis> line in the "
28538
"<filename>/etc/bind/named.conf.options</filename> file tells DNS where to "
28539
"look for files. All files BIND uses will be relative to this directory."
28540
msgstr ""
28541
28542
#: serverguide/C/dns.xml:78(para)
28543
msgid ""
28544
"The file named <filename>/etc/bind/db.root</filename> describes the root "
28545
"nameservers in the world. The servers change over time, so the "
28546
"<filename>/etc/bind/db.root</filename> file must be maintained now and then. "
28547
"This is usually done as updates to the <application>bind9</application> "
28548
"package. The <emphasis>zone</emphasis> section defines a master server, and "
28549
"it is stored in a file mentioned in the <emphasis>file</emphasis> option."
28550
msgstr ""
28551
28552
#: serverguide/C/dns.xml:88(para)
28553
msgid ""
28554
"It is possible to configure the same server to be a caching name server, "
28555
"primary master, and secondary master. A server can be the Start of Authority "
28556
"(SOA) for one zone, while providing secondary service for another zone. All "
28557
"the while providing caching services for hosts on the local LAN."
28558
msgstr ""
28559
28560
#: serverguide/C/dns.xml:96(title)
28561
msgid "Caching Nameserver"
28562
msgstr ""
28563
28564
#: serverguide/C/dns.xml:97(para)
28565
msgid ""
28566
"The default configuration is setup to act as a caching server. All that is "
28567
"required is simply adding the IP Addresses of your ISP's DNS servers. Simply "
28568
"uncomment and edit the following in "
28569
"<filename>/etc/bind/named.conf.options</filename>:"
28570
msgstr ""
28571
28572
#: serverguide/C/dns.xml:101(programlisting)
28573
#, no-wrap
28574
msgid ""
28575
"\n"
28576
"forwarders {\n"
28577
" 1.2.3.4;\n"
28578
" 5.6.7.8;\n"
28579
" };\n"
28580
msgstr ""
28581
28582
#: serverguide/C/dns.xml:108(para)
28583
msgid ""
28584
"Replace <emphasis>1.2.3.4</emphasis> and <emphasis>5.6.7.8</emphasis> with "
28585
"the IP Adresses of actual nameservers."
28586
msgstr ""
28587
28588
#: serverguide/C/dns.xml:112(para)
28589
msgid ""
28590
"Now restart the DNS server, to enable the new configuration. From a terminal "
28591
"prompt:"
28592
msgstr ""
28593
28594
#: serverguide/C/dns.xml:116(command) serverguide/C/dns.xml:199(command) serverguide/C/dns.xml:257(command) serverguide/C/dns.xml:293(command) serverguide/C/dns.xml:321(command) serverguide/C/dns.xml:603(command)
28595
msgid "sudo systemctl restart bind9.service"
28596
msgstr ""
28597
28598
#: serverguide/C/dns.xml:118(para)
28599
msgid ""
28600
"See <xref linkend=\"dns-testing-dig\"/> for information on testing a caching "
28601
"DNS server."
28602
msgstr ""
28603
28604
#: serverguide/C/dns.xml:123(title)
28605
msgid "Primary Master"
28606
msgstr ""
28607
28608
#: serverguide/C/dns.xml:124(para)
28609
msgid ""
28610
"In this section <application>BIND9</application> will be configured as the "
28611
"Primary Master for the domain <emphasis>example.com</emphasis>. Simply "
28612
"replace <emphasis role=\"italic\">example.com</emphasis> with your FQDN "
28613
"(Fully Qualified Domain Name)."
28614
msgstr ""
28615
28616
#: serverguide/C/dns.xml:130(title)
28617
msgid "Forward Zone File"
28618
msgstr ""
28619
28620
#: serverguide/C/dns.xml:131(para)
28621
msgid ""
28622
"To add a DNS zone to BIND9, turning BIND9 into a Primary Master server, the "
28623
"first step is to edit <filename>/etc/bind/named.conf.local</filename>:"
28624
msgstr ""
28625
28626
#: serverguide/C/dns.xml:135(programlisting)
28627
#, no-wrap
28628
msgid ""
28629
"\n"
28630
"zone \"example.com\" {\n"
28631
"\ttype master;\n"
28632
" file \"/etc/bind/db.example.com\";\n"
28633
"};\n"
28634
msgstr ""
28635
28636
#: serverguide/C/dns.xml:141(para)
28637
msgid ""
28638
"(Note, if bind will be receiving automatic updates to the file as with DDNS, "
28639
"then use <filename>/var/lib/bind/db.example.com</filename> rather than "
28640
"<filename>/etc/bind/db.example.com</filename> both here and in the copy "
28641
"command below.)"
28642
msgstr ""
28643
28644
#: serverguide/C/dns.xml:145(para)
28645
msgid ""
28646
"Now use an existing zone file as a template to create the "
28647
"<filename>/etc/bind/db.example.com</filename> file:"
28648
msgstr ""
28649
28650
#: serverguide/C/dns.xml:149(command)
28651
msgid "sudo cp /etc/bind/db.local /etc/bind/db.example.com"
28652
msgstr ""
28653
28654
#: serverguide/C/dns.xml:151(para)
28655
msgid ""
28656
"Edit the new zone file <filename>/etc/bind/db.example.com</filename> change "
28657
"<emphasis>localhost.</emphasis> to the FQDN of your server, leaving the "
28658
"additional \".\" at the end. Change <emphasis>127.0.0.1</emphasis> to the "
28659
"nameserver's IP Address and <emphasis>root.localhost</emphasis> to a valid "
28660
"email address, but with a \".\" instead of the usual \"@\" symbol, again "
28661
"leaving the \".\" at the end. Change the comment to indicate the domain that "
28662
"this file is for."
28663
msgstr ""
28664
28665
#: serverguide/C/dns.xml:158(para)
28666
msgid ""
28667
"Create an <emphasis>A record</emphasis> for the base domain, <emphasis "
28668
"role=\"italic\">example.com</emphasis>. Also, create an <emphasis>A "
28669
"record</emphasis> for <emphasis role=\"italic\">ns.example.com</emphasis>, "
28670
"the name server in this example:"
28671
msgstr ""
28672
28673
#: serverguide/C/dns.xml:163(programlisting)
28674
#, no-wrap
28675
msgid ""
28676
"\n"
28677
";\n"
28678
"; BIND data file for example.com\n"
28679
";\n"
28680
"$TTL 604800\n"
28681
"@ IN SOA example.com. root.example.com. (\n"
28682
" 2 ; Serial\n"
28683
" 604800 ; Refresh\n"
28684
" 86400 ; Retry\n"
28685
" 2419200 ; Expire\n"
28686
" 604800 ) ; Negative Cache TTL\n"
28687
" IN A 192.168.1.10\n"
28688
";\n"
28689
"@ IN NS ns.example.com.\n"
28690
"@ IN A 192.168.1.10\n"
28691
"@ IN AAAA ::1\n"
28692
"ns IN A 192.168.1.10\n"
28693
msgstr ""
28694
28695
#: serverguide/C/dns.xml:181(para)
28696
msgid ""
28697
"You must increment the <emphasis>Serial Number</emphasis> every time you "
28698
"make changes to the zone file. If you make multiple changes before "
28699
"restarting BIND9, simply increment the Serial once."
28700
msgstr ""
28701
28702
#: serverguide/C/dns.xml:185(para)
28703
msgid ""
28704
"Now, you can add DNS records to the bottom of the zone file. See <xref "
28705
"linkend=\"dns-record-types\"/> for details."
28706
msgstr ""
28707
28708
#: serverguide/C/dns.xml:189(para)
28709
msgid ""
28710
"Many admins like to use the last date edited as the serial of a zone, such "
28711
"as <emphasis>2012010100</emphasis> which is yyyymmddss (where "
28712
"<emphasis>ss</emphasis> is the Serial Number)"
28713
msgstr ""
28714
28715
#: serverguide/C/dns.xml:194(para)
28716
msgid ""
28717
"Once you have made changes to the zone file <application>BIND9</application> "
28718
"needs to be restarted for the changes to take effect:"
28719
msgstr ""
28720
28721
#: serverguide/C/dns.xml:203(title)
28722
msgid "Reverse Zone File"
28723
msgstr ""
28724
28725
#: serverguide/C/dns.xml:204(para)
28726
msgid ""
28727
"Now that the zone is setup and resolving names to IP Adresses a "
28728
"<emphasis>Reverse zone</emphasis> is also required. A Reverse zone allows "
28729
"DNS to resolve an address to a name."
28730
msgstr ""
28731
28732
#: serverguide/C/dns.xml:208(para)
28733
msgid "Edit /etc/bind/named.conf.local and add the following:"
28734
msgstr ""
28735
28736
#: serverguide/C/dns.xml:211(programlisting)
28737
#, no-wrap
28738
msgid ""
28739
"\n"
28740
"zone \"1.168.192.in-addr.arpa\" {\n"
28741
" type master;\n"
28742
" file \"/etc/bind/db.192\";\n"
28743
"};\n"
28744
msgstr ""
28745
28746
#: serverguide/C/dns.xml:218(para)
28747
msgid ""
28748
"Replace <emphasis>1.168.192</emphasis> with the first three octets of "
28749
"whatever network you are using. Also, name the zone file "
28750
"<filename>/etc/bind/db.192</filename> appropriately. It should match the "
28751
"first octet of your network."
28752
msgstr ""
28753
28754
#: serverguide/C/dns.xml:223(para)
28755
msgid "Now create the <filename>/etc/bind/db.192</filename> file:"
28756
msgstr ""
28757
28758
#: serverguide/C/dns.xml:227(command)
28759
msgid "sudo cp /etc/bind/db.127 /etc/bind/db.192"
28760
msgstr ""
28761
28762
#: serverguide/C/dns.xml:229(para)
28763
msgid ""
28764
"Next edit <filename>/etc/bind/db.192</filename> changing the basically the "
28765
"same options as <filename>/etc/bind/db.example.com</filename>:"
28766
msgstr ""
28767
28768
#: serverguide/C/dns.xml:233(programlisting)
28769
#, no-wrap
28770
msgid ""
28771
"\n"
28772
";\n"
28773
"; BIND reverse data file for local 192.168.1.XXX net\n"
28774
";\n"
28775
"$TTL 604800\n"
28776
"@ IN SOA ns.example.com. root.example.com. (\n"
28777
" 2 ; Serial\n"
28778
" 604800 ; Refresh\n"
28779
" 86400 ; Retry\n"
28780
" 2419200 ; Expire\n"
28781
" 604800 ) ; Negative Cache TTL\n"
28782
";\n"
28783
"@ IN NS ns.\n"
28784
"10 IN PTR ns.example.com.\n"
28785
msgstr ""
28786
28787
#: serverguide/C/dns.xml:248(para)
28788
msgid ""
28789
"The <emphasis>Serial Number</emphasis> in the Reverse zone needs to be "
28790
"incremented on each change as well. For each <emphasis>A record</emphasis> "
28791
"you configure in <filename>/etc/bind/db.example.com</filename>, that is for "
28792
"a different address, you need to create a <emphasis>PTR record</emphasis> in "
28793
"<filename>/etc/bind/db.192</filename>."
28794
msgstr ""
28795
28796
#: serverguide/C/dns.xml:253(para)
28797
msgid ""
28798
"After creating the reverse zone file restart "
28799
"<application>BIND9</application>:"
28800
msgstr ""
28801
28802
#: serverguide/C/dns.xml:262(title)
28803
msgid "Secondary Master"
28804
msgstr ""
28805
28806
#: serverguide/C/dns.xml:263(para)
28807
msgid ""
28808
"Once a <emphasis>Primary Master</emphasis> has been configured a "
28809
"<emphasis>Secondary Master</emphasis> is needed in order to maintain the "
28810
"availability of the domain should the Primary become unavailable."
28811
msgstr ""
28812
28813
#: serverguide/C/dns.xml:267(para)
28814
msgid ""
28815
"First, on the Primary Master server, the zone transfer needs to be allowed. "
28816
"Add the <emphasis>allow-transfer</emphasis> option to the example Forward "
28817
"and Reverse zone definitions in "
28818
"<filename>/etc/bind/named.conf.local</filename>:"
28819
msgstr ""
28820
28821
#: serverguide/C/dns.xml:271(programlisting)
28822
#, no-wrap
28823
msgid ""
28824
"\n"
28825
"zone \"example.com\" {\n"
28826
" type master;\n"
28827
"\tfile \"/etc/bind/db.example.com\";\n"
28828
" allow-transfer { 192.168.1.11; };\n"
28829
"};\n"
28830
"\n"
28831
"zone \"1.168.192.in-addr.arpa\" {\n"
28832
" type master;\n"
28833
" file \"/etc/bind/db.192\";\n"
28834
"\tallow-transfer { 192.168.1.11; };\n"
28835
"};\n"
28836
msgstr ""
28837
28838
#: serverguide/C/dns.xml:285(para)
28839
msgid ""
28840
"Replace <emphasis>192.168.1.11</emphasis> with the IP Address of your "
28841
"Secondary nameserver."
28842
msgstr ""
28843
28844
#: serverguide/C/dns.xml:289(para)
28845
msgid "Restart <application>BIND9</application> on the Primary Master:"
28846
msgstr ""
28847
28848
#: serverguide/C/dns.xml:295(para)
28849
msgid ""
28850
"Next, on the Secondary Master, install the <application>bind9</application> "
28851
"package the same way as on the Primary. Then edit the "
28852
"<filename>/etc/bind/named.conf.local</filename> and add the following "
28853
"declarations for the Forward and Reverse zones:"
28854
msgstr ""
28855
28856
#: serverguide/C/dns.xml:299(programlisting)
28857
#, no-wrap
28858
msgid ""
28859
"\n"
28860
"zone \"example.com\" {\n"
28861
"\ttype slave;\n"
28862
" file \"db.example.com\";\n"
28863
" masters { 192.168.1.10; };\n"
28864
"}; \n"
28865
" \n"
28866
"zone \"1.168.192.in-addr.arpa\" {\n"
28867
"\ttype slave;\n"
28868
" file \"db.192\";\n"
28869
" masters { 192.168.1.10; };\n"
28870
"};\n"
28871
msgstr ""
28872
28873
#: serverguide/C/dns.xml:313(para)
28874
msgid ""
28875
"Replace <emphasis>192.168.1.10</emphasis> with the IP Address of your "
28876
"Primary nameserver."
28877
msgstr ""
28878
28879
#: serverguide/C/dns.xml:317(para)
28880
msgid "Restart <application>BIND9</application> on the Secondary Master:"
28881
msgstr ""
28882
28883
#: serverguide/C/dns.xml:323(para)
28884
msgid ""
28885
"In <filename>/var/log/syslog</filename> you should see something similar to "
28886
"(some lines have been split to fit the format of this document):"
28887
msgstr ""
28888
28889
#: serverguide/C/dns.xml:326(programlisting)
28890
#, no-wrap
28891
msgid ""
28892
"\n"
28893
"client 192.168.1.10#39448: received notify for zone '1.168.192.in-"
28894
"addr.arpa'\n"
28895
"zone 1.168.192.in-addr.arpa/IN: Transfer started.\n"
28896
"transfer of '100.18.172.in-addr.arpa/IN' from 192.168.1.10#53:\n"
28897
" connected using 192.168.1.11#37531\n"
28898
"zone 1.168.192.in-addr.arpa/IN: transferred serial 5\n"
28899
"transfer of '100.18.172.in-addr.arpa/IN' from 192.168.1.10#53:\n"
28900
" Transfer completed: 1 messages, \n"
28901
"6 records, 212 bytes, 0.002 secs (106000 bytes/sec)\n"
28902
"zone 1.168.192.in-addr.arpa/IN: sending notifies (serial 5)\n"
28903
"\n"
28904
"client 192.168.1.10#20329: received notify for zone 'example.com'\n"
28905
"zone example.com/IN: Transfer started.\n"
28906
"transfer of 'example.com/IN' from 192.168.1.10#53: connected using "
28907
"192.168.1.11#38577\n"
28908
"zone example.com/IN: transferred serial 5\n"
28909
"transfer of 'example.com/IN' from 192.168.1.10#53: Transfer completed: 1 "
28910
"messages, \n"
28911
"8 records, 225 bytes, 0.002 secs (112500 bytes/sec)\n"
28912
msgstr ""
28913
28914
#: serverguide/C/dns.xml:345(para)
28915
msgid ""
28916
"Note: A zone is only transferred if the <emphasis>Serial Number</emphasis> "
28917
"on the Primary is larger than the one on the Secondary. If you want to have "
28918
"your Primary Master DNS notifying Secondary DNS Servers of zone changes, you "
28919
"can add <emphasis>also-notify { ipaddress; };</emphasis> in to "
28920
"<filename>/etc/bind/named.conf.local</filename> as shown in the example "
28921
"below:"
28922
msgstr ""
28923
28924
#: serverguide/C/dns.xml:349(programlisting)
28925
#, no-wrap
28926
msgid ""
28927
"\n"
28928
"zone \"example.com\" {\n"
28929
"\ttype master;\n"
28930
"\tfile \"/etc/bind/db.example.com\";\n"
28931
"\tallow-transfer { 192.168.1.11; };\n"
28932
"\talso-notify { 192.168.1.11; }; \n"
28933
"\t};\n"
28934
"\n"
28935
"zone \"1.168.192.in-addr.arpa\" {\n"
28936
"\ttype master;\n"
28937
"\tfile \"/etc/bind/db.192\";\n"
28938
"\tallow-transfer { 192.168.1.11; };\n"
28939
"\talso-notify { 192.168.1.11; }; \n"
28940
"\t};\n"
28941
"\t"
28942
msgstr ""
28943
28944
#: serverguide/C/dns.xml:365(para)
28945
msgid ""
28946
"The default directory for non-authoritative zone files is "
28947
"<filename>/var/cache/bind/</filename>. This directory is also configured in "
28948
"<application>AppArmor</application> to allow the "
28949
"<application>named</application> daemon to write to it. For more information "
28950
"on AppArmor see <xref linkend=\"apparmor\"/>."
28951
msgstr ""
28952
28953
#: serverguide/C/dns.xml:376(para)
28954
msgid ""
28955
"This section covers ways to help determine the cause when problems happen "
28956
"with DNS and <application>BIND9</application>."
28957
msgstr ""
28958
28959
#: serverguide/C/dns.xml:382(title)
28960
msgid "resolv.conf"
28961
msgstr ""
28962
28963
#: serverguide/C/dns.xml:383(para)
28964
msgid ""
28965
"The first step in testing <application>BIND9</application> is to add the "
28966
"nameserver's IP Address to a hosts resolver. The Primary nameserver should "
28967
"be configured as well as another host to double check things. Refer to <xref "
28968
"linkend=\"dns-client-configuration\"/> for details on adding nameserver "
28969
"addresses to your network clients, and afterwards check that the file "
28970
"<filename>/etc/resolv.conf</filename> contains (for this example):"
28971
msgstr ""
28972
28973
#: serverguide/C/dns.xml:389(programlisting)
28974
#, no-wrap
28975
msgid ""
28976
"\n"
28977
"nameserver\t192.168.1.10\n"
28978
"nameserver\t192.168.1.11\n"
28979
msgstr ""
28980
28981
#: serverguide/C/dns.xml:393(para)
28982
msgid ""
28983
"Nameservers that listen at 127.* are responsible for adding their own IP "
28984
"addresses to resolv.conf (using resolvconf). This is done via the file "
28985
"<filename>/etc/default/bind9</filename> by changing the line RESOLVCONF=no "
28986
"to RESOLVCONF=yes."
28987
msgstr ""
28988
28989
#: serverguide/C/dns.xml:398(para)
28990
msgid ""
28991
"You should also add the IP Address of the Secondary nameserver in case the "
28992
"Primary becomes unavailable."
28993
msgstr ""
28994
28995
#: serverguide/C/dns.xml:404(title)
28996
msgid "dig"
28997
msgstr ""
28998
28999
#: serverguide/C/dns.xml:405(para)
29000
msgid ""
29001
"If you installed the <application>dnsutils</application> package you can "
29002
"test your setup using the DNS lookup utility <application>dig</application>:"
29003
msgstr ""
29004
29005
#: serverguide/C/dns.xml:411(para)
29006
msgid ""
29007
"After installing <application>BIND9</application> use "
29008
"<application>dig</application> against the loopback interface to make sure "
29009
"it is listening on port 53. From a terminal prompt:"
29010
msgstr ""
29011
29012
#: serverguide/C/dns.xml:416(command)
29013
msgid "dig -x 127.0.0.1"
29014
msgstr ""
29015
29016
#: serverguide/C/dns.xml:418(para)
29017
msgid "You should see lines similar to the following in the command output:"
29018
msgstr ""
29019
29020
#: serverguide/C/dns.xml:421(programlisting)
29021
#, no-wrap
29022
msgid ""
29023
"\n"
29024
";; Query time: 1 msec\n"
29025
";; SERVER: 192.168.1.10#53(192.168.1.10)\n"
29026
msgstr ""
29027
29028
#: serverguide/C/dns.xml:427(para)
29029
msgid ""
29030
"If you have configured <application>BIND9</application> as a "
29031
"<emphasis>Caching</emphasis> nameserver \"dig\" an outside domain to check "
29032
"the query time:"
29033
msgstr ""
29034
29035
#: serverguide/C/dns.xml:432(command)
29036
msgid "dig ubuntu.com"
29037
msgstr ""
29038
29039
#: serverguide/C/dns.xml:434(para)
29040
msgid "Note the query time toward the end of the command output:"
29041
msgstr ""
29042
29043
#: serverguide/C/dns.xml:437(programlisting)
29044
#, no-wrap
29045
msgid ""
29046
"\n"
29047
";; Query time: 49 msec\n"
29048
msgstr ""
29049
29050
#: serverguide/C/dns.xml:440(para)
29051
msgid "After a second dig there should be improvement:"
29052
msgstr ""
29053
29054
#: serverguide/C/dns.xml:443(programlisting)
29055
#, no-wrap
29056
msgid ""
29057
"\n"
29058
";; Query time: 1 msec\n"
29059
msgstr ""
29060
29061
#: serverguide/C/dns.xml:450(title)
29062
msgid "ping"
29063
msgstr ""
29064
29065
#: serverguide/C/dns.xml:452(para)
29066
msgid ""
29067
"Now to demonstrate how applications make use of DNS to resolve a host name "
29068
"use the <application>ping</application> utility to send an ICMP echo "
29069
"request. From a terminal prompt enter:"
29070
msgstr ""
29071
29072
#: serverguide/C/dns.xml:458(command)
29073
msgid "ping example.com"
29074
msgstr ""
29075
29076
#: serverguide/C/dns.xml:460(para)
29077
msgid ""
29078
"This tests if the nameserver can resolve the name "
29079
"<emphasis>ns.example.com</emphasis> to an IP Address. The command output "
29080
"should resemble:"
29081
msgstr ""
29082
29083
#: serverguide/C/dns.xml:464(programlisting)
29084
#, no-wrap
29085
msgid ""
29086
"\n"
29087
"PING ns.example.com (192.168.1.10) 56(84) bytes of data.\n"
29088
"64 bytes from 192.168.1.10: icmp_seq=1 ttl=64 time=0.800 ms\n"
29089
"64 bytes from 192.168.1.10: icmp_seq=2 ttl=64 time=0.813 ms\n"
29090
msgstr ""
29091
29092
#: serverguide/C/dns.xml:471(title)
29093
msgid "named-checkzone"
29094
msgstr ""
29095
29096
#: serverguide/C/dns.xml:472(para)
29097
msgid ""
29098
"A great way to test your zone files is by using the <application>named-"
29099
"checkzone</application> utility installed with the "
29100
"<application>bind9</application> package. This utility allows you to make "
29101
"sure the configuration is correct before restarting "
29102
"<application>BIND9</application> and making the changes live."
29103
msgstr ""
29104
29105
#: serverguide/C/dns.xml:479(para)
29106
msgid ""
29107
"To test our example Forward zone file enter the following from a command "
29108
"prompt:"
29109
msgstr ""
29110
29111
#: serverguide/C/dns.xml:483(command)
29112
msgid "named-checkzone example.com /etc/bind/db.example.com"
29113
msgstr ""
29114
29115
#: serverguide/C/dns.xml:485(para)
29116
msgid ""
29117
"If everything is configured correctly you should see output similar to:"
29118
msgstr ""
29119
29120
#: serverguide/C/dns.xml:488(programlisting)
29121
#, no-wrap
29122
msgid ""
29123
"\n"
29124
"zone example.com/IN: loaded serial 6\n"
29125
"OK\n"
29126
msgstr ""
29127
29128
#: serverguide/C/dns.xml:494(para)
29129
msgid "Similarly, to test the Reverse zone file enter the following:"
29130
msgstr ""
29131
29132
#: serverguide/C/dns.xml:498(command)
29133
msgid "named-checkzone 1.168.192.in-addr.arpa /etc/bind/db.192"
29134
msgstr ""
29135
29136
#: serverguide/C/dns.xml:500(para)
29137
msgid "The output should be similar to:"
29138
msgstr ""
29139
29140
#: serverguide/C/dns.xml:503(programlisting)
29141
#, no-wrap
29142
msgid ""
29143
"\n"
29144
"zone 1.168.192.in-addr.arpa/IN: loaded serial 3\n"
29145
"OK\n"
29146
msgstr ""
29147
29148
#: serverguide/C/dns.xml:510(para)
29149
msgid ""
29150
"The <emphasis>Serial Number</emphasis> of your zone file will probably be "
29151
"different."
29152
msgstr ""
29153
29154
#: serverguide/C/dns.xml:518(para)
29155
msgid ""
29156
"<application>BIND9</application> has a wide variety of logging configuration "
29157
"options available. There are two main options. The "
29158
"<emphasis>channel</emphasis> option configures where logs go, and the "
29159
"<emphasis>category</emphasis> option determines what information to log."
29160
msgstr ""
29161
29162
#: serverguide/C/dns.xml:522(para)
29163
msgid "If no logging option is configured the default option is:"
29164
msgstr ""
29165
29166
#: serverguide/C/dns.xml:525(programlisting)
29167
#, no-wrap
29168
msgid ""
29169
"\n"
29170
"logging {\n"
29171
" category default { default_syslog; default_debug; };\n"
29172
" category unmatched { null; };\n"
29173
"};\n"
29174
msgstr ""
29175
29176
#: serverguide/C/dns.xml:531(para)
29177
msgid ""
29178
"This section covers configuring <application>BIND9</application> to send "
29179
"<emphasis>debug</emphasis> messages related to DNS queries to a separate "
29180
"file."
29181
msgstr ""
29182
29183
#: serverguide/C/dns.xml:536(para)
29184
msgid ""
29185
"First, we need to configure a channel to specify which file to send the "
29186
"messages to. Edit <filename>/etc/bind/named.conf.local</filename> and add "
29187
"the following:"
29188
msgstr ""
29189
29190
#: serverguide/C/dns.xml:540(programlisting)
29191
#, no-wrap
29192
msgid ""
29193
"\n"
29194
"logging {\n"
29195
" channel query.log { \n"
29196
" file \"/var/log/query.log\";\n"
29197
" severity debug 3; \n"
29198
" }; \n"
29199
"};\n"
29200
msgstr ""
29201
29202
#: serverguide/C/dns.xml:550(para)
29203
msgid "Next, configure a category to send all DNS queries to the query file:"
29204
msgstr ""
29205
29206
#: serverguide/C/dns.xml:553(programlisting)
29207
#, no-wrap
29208
msgid ""
29209
"\n"
29210
"logging {\n"
29211
" channel query.log { \n"
29212
" file \"/var/log/query.log\"; \n"
29213
" severity debug 3; \n"
29214
" }; \n"
29215
" <emphasis>category queries { query.log; };</emphasis> \n"
29216
"};\n"
29217
msgstr ""
29218
29219
#: serverguide/C/dns.xml:565(para)
29220
msgid ""
29221
"Note: the <emphasis>debug</emphasis> option can be set from 1 to 3. If a "
29222
"level isn't specified level 1 is the default."
29223
msgstr ""
29224
29225
#: serverguide/C/dns.xml:571(para)
29226
msgid ""
29227
"Since the <emphasis>named daemon</emphasis> runs as the "
29228
"<emphasis>bind</emphasis> user the <filename>/var/log/query.log</filename> "
29229
"file must be created and the ownership changed:"
29230
msgstr ""
29231
29232
#: serverguide/C/dns.xml:576(command)
29233
msgid "sudo touch /var/log/query.log"
29234
msgstr ""
29235
29236
#: serverguide/C/dns.xml:577(command)
29237
msgid "sudo chown bind /var/log/query.log"
29238
msgstr ""
29239
29240
#: serverguide/C/dns.xml:581(para)
29241
msgid ""
29242
"Before <application>named</application> daemon can write to the new log file "
29243
"the <application>AppArmor</application> profile must be updated. First, edit "
29244
"<filename>/etc/apparmor.d/usr.sbin.named</filename> and add:"
29245
msgstr ""
29246
29247
#: serverguide/C/dns.xml:585(programlisting)
29248
#, no-wrap
29249
msgid ""
29250
"\n"
29251
"/var/log/query.log w,\n"
29252
msgstr ""
29253
29254
#: serverguide/C/dns.xml:588(para)
29255
msgid "Next, reload the profile:"
29256
msgstr ""
29257
29258
#: serverguide/C/dns.xml:592(command)
29259
msgid "cat /etc/apparmor.d/usr.sbin.named | sudo apparmor_parser -r"
29260
msgstr ""
29261
29262
#: serverguide/C/dns.xml:594(para)
29263
msgid ""
29264
"For more information on <application>AppArmor</application> see <xref "
29265
"linkend=\"apparmor\"/>"
29266
msgstr ""
29267
29268
#: serverguide/C/dns.xml:599(para)
29269
msgid ""
29270
"Now restart <application>BIND9</application> for the changes to take effect:"
29271
msgstr ""
29272
29273
#: serverguide/C/dns.xml:607(para)
29274
msgid ""
29275
"You should see the file <filename>/var/log/query.log</filename> fill with "
29276
"query information. This is a simple example of the "
29277
"<application>BIND9</application> logging options. For coverage of advanced "
29278
"options see <xref linkend=\"dns-more-info\"/>."
29279
msgstr ""
29280
29281
#: serverguide/C/dns.xml:616(title)
29282
msgid "Common Record Types"
29283
msgstr ""
29284
29285
#: serverguide/C/dns.xml:617(para)
29286
msgid "This section covers some of the most common DNS record types."
29287
msgstr ""
29288
29289
#: serverguide/C/dns.xml:622(para)
29290
msgid ""
29291
"<emphasis>A</emphasis> record: This record maps an IP Address to a hostname."
29292
msgstr ""
29293
29294
#: serverguide/C/dns.xml:625(programlisting)
29295
#, no-wrap
29296
msgid ""
29297
"\n"
29298
"www IN A 192.168.1.12\n"
29299
msgstr ""
29300
29301
#: serverguide/C/dns.xml:630(para)
29302
msgid ""
29303
"<emphasis>CNAME</emphasis> record: Used to create an alias to an existing A "
29304
"record. You cannot create a CNAME record pointing to another CNAME record."
29305
msgstr ""
29306
29307
#: serverguide/C/dns.xml:633(programlisting)
29308
#, no-wrap
29309
msgid ""
29310
"\n"
29311
"web IN CNAME www\n"
29312
msgstr ""
29313
29314
#: serverguide/C/dns.xml:638(para)
29315
msgid ""
29316
"<emphasis>MX</emphasis> record: Used to define where email should be sent "
29317
"to. Must point to an A record, not a CNAME."
29318
msgstr ""
29319
29320
#: serverguide/C/dns.xml:641(programlisting)
29321
#, no-wrap
29322
msgid ""
29323
"\n"
29324
" IN MX 1 mail.example.com.\n"
29325
"mail IN A 192.168.1.13\n"
29326
msgstr ""
29327
29328
#: serverguide/C/dns.xml:647(para)
29329
msgid ""
29330
"<emphasis>NS</emphasis> record: Used to define which servers serve copies of "
29331
"a zone. It must point to an A record, not a CNAME. This is where Primary and "
29332
"Secondary servers are defined."
29333
msgstr ""
29334
29335
#: serverguide/C/dns.xml:651(programlisting)
29336
#, no-wrap
29337
msgid ""
29338
"\n"
29339
" IN NS ns.example.com.\n"
29340
" IN NS ns2.example.com.\n"
29341
"ns IN A 192.168.1.10\n"
29342
"ns2 IN A 192.168.1.11\n"
29343
msgstr ""
29344
29345
#: serverguide/C/dns.xml:661(title)
29346
msgid "More Information"
29347
msgstr ""
29348
29349
#: serverguide/C/dns.xml:664(para)
29350
msgid ""
29351
"The <ulink url=\"https://help.ubuntu.com/community/BIND9ServerHowto\">BIND9 "
29352
"Server HOWTO</ulink> in the Ubuntu Wiki has a lot of useful information."
29353
msgstr ""
29354
29355
#: serverguide/C/dns.xml:669(para)
29356
msgid ""
29357
"The <ulink url=\"http://www.tldp.org/HOWTO/DNS-HOWTO.html\">DNS "
29358
"HOWTO</ulink> at The Linux Documentation Project also has lots of "
29359
"information about configuring BIND9."
29360
msgstr ""
29361
29362
#: serverguide/C/dns.xml:674(para)
29363
msgid ""
29364
"<ulink url=\"http://www.bind9.net/\">Bind9.net</ulink> has links to a large "
29365
"collection of DNS and <application>BIND9</application> resources."
29366
msgstr ""
29367
29368
#: serverguide/C/dns.xml:679(para)
29369
msgid ""
29370
"<ulink url=\"http://shop.oreilly.com/product/9780596100575.do\">DNS and "
29371
"BIND</ulink> is a popular book now in it's fifth edition. There is now also "
29372
"a <ulink url=\"http://shop.oreilly.com/product/0636920020158.do\">DNS and "
29373
"BIND on IPv6</ulink> book."
29374
msgstr ""
29375
29376
#: serverguide/C/dns.xml:684(para)
29377
msgid ""
29378
"A great place to ask for <application>BIND9</application> assistance, and "
29379
"get involved with the Ubuntu Server community, is the <emphasis>#ubuntu-"
29380
"server</emphasis> IRC channel on <ulink "
29381
"url=\"http://freenode.net\">freenode</ulink>."
29382
msgstr ""
29383
29384
#: serverguide/C/dm-multipath.xml:22(title)
29385
msgid "DM-Multipath"
29386
msgstr ""
29387
29388
#: serverguide/C/dm-multipath.xml:25(title)
29389
msgid "Device Mapper Multipathing"
29390
msgstr ""
29391
29392
#: serverguide/C/dm-multipath.xml:27(para)
29393
msgid ""
29394
"Device mapper multipathing (DM-Multipath) allows you to configure multiple "
29395
"I/O paths between server nodes and storage arrays into a single device. "
29396
"These I/O paths are physical SAN connections that can include separate "
29397
"cables, switches, and controllers. Multipathing aggregates the I/O paths, "
29398
"creating a new device that consists of the aggregated paths. This chapter "
29399
"provides a summary of the features of DM-Multipath that are new for the "
29400
"initial release of Ubuntu Server 12.04. Following that, this chapter "
29401
"provides a high-level overview of DM Multipath and its components, as well "
29402
"as an overview of DM-Multipath setup."
29403
msgstr ""
29404
29405
#: serverguide/C/dm-multipath.xml:38(title)
29406
msgid "New and Changed Features for Ubuntu Server 12.04"
29407
msgstr ""
29408
29409
#: serverguide/C/dm-multipath.xml:40(para)
29410
msgid "Migrated from multipath-0.4.8 to multipath-0.4.9"
29411
msgstr ""
29412
29413
#: serverguide/C/dm-multipath.xml:43(title)
29414
msgid "Migration from 0.4.8"
29415
msgstr ""
29416
29417
#: serverguide/C/dm-multipath.xml:45(para)
29418
msgid ""
29419
"The priority checkers are no longer run as standalone binaries, but as "
29420
"shared libraries. The key value name for this feature has also slightly "
29421
"changed. Copy the attribute named <emphasis "
29422
"role=\"bold\">prio_callout</emphasis> to <emphasis "
29423
"role=\"bold\">prio</emphasis>, also modify the argument the name of the "
29424
"priority checker, a system path is no longer necessary. Example "
29425
"conversion:<screen>device {\n"
29426
" vendor \"NEC\"\n"
29427
" product \"DISK ARRAY\"\n"
29428
" prio_callout mpath_prio_alua /dev/%n\n"
29429
" prio alua\n"
29430
"}</screen>"
29431
msgstr ""
29432
29433
#: serverguide/C/dm-multipath.xml:58(para)
29434
msgid ""
29435
"See Table <xref endterm=\"checker-conversion-table\" linkend=\"priority-"
29436
"checker-conversion-table\"/> for a complete listing"
29437
msgstr ""
29438
29439
#: serverguide/C/dm-multipath.xml:62(title)
29440
msgid "Priority Checker Conversion"
29441
msgstr ""
29442
29443
#: serverguide/C/dm-multipath.xml:71(entry)
29444
msgid "v0.4.8"
29445
msgstr ""
29446
29447
#: serverguide/C/dm-multipath.xml:73(entry)
29448
msgid "v0.4.9"
29449
msgstr ""
29450
29451
#: serverguide/C/dm-multipath.xml:79(emphasis)
29452
msgid "prio_callout mpath_prio_emc /dev/%n"
29453
msgstr ""
29454
29455
#: serverguide/C/dm-multipath.xml:82(emphasis)
29456
msgid "prio emc"
29457
msgstr ""
29458
29459
#: serverguide/C/dm-multipath.xml:86(emphasis)
29460
msgid "prio_callout mpath_prio_alua /dev/%n"
29461
msgstr ""
29462
29463
#: serverguide/C/dm-multipath.xml:89(emphasis)
29464
msgid "prio alua"
29465
msgstr ""
29466
29467
#: serverguide/C/dm-multipath.xml:93(emphasis)
29468
msgid "prio_callout mpath_prio_netapp /dev/%n"
29469
msgstr ""
29470
29471
#: serverguide/C/dm-multipath.xml:96(emphasis)
29472
msgid "prio netapp"
29473
msgstr ""
29474
29475
#: serverguide/C/dm-multipath.xml:100(emphasis)
29476
msgid "prio_callout mpath_prio_rdac /dev/%n"
29477
msgstr ""
29478
29479
#: serverguide/C/dm-multipath.xml:103(emphasis)
29480
msgid "prio rdac"
29481
msgstr ""
29482
29483
#: serverguide/C/dm-multipath.xml:107(emphasis)
29484
msgid "prio_callout mpath_prio_hp_sw /dev/%n"
29485
msgstr ""
29486
29487
#: serverguide/C/dm-multipath.xml:110(emphasis)
29488
msgid "prio hp_sw"
29489
msgstr ""
29490
29491
#: serverguide/C/dm-multipath.xml:114(emphasis)
29492
msgid "prio_callout mpath_prio_hds_modular %b"
29493
msgstr ""
29494
29495
#: serverguide/C/dm-multipath.xml:117(emphasis)
29496
msgid "prio hds"
29497
msgstr ""
29498
29499
#: serverguide/C/dm-multipath.xml:123(para)
29500
msgid ""
29501
"Since the multipath config file parser essentially parses all key/value "
29502
"pairs it finds and then makes use of them, it is safe for both <emphasis "
29503
"role=\"bold\">prio_callout</emphasis> and <emphasis "
29504
"role=\"bold\">prio</emphasis> to coexist and is recommended that the "
29505
"<emphasis role=\"bold\">prio</emphasis> attribute be inserted before "
29506
"beginning migration. After which you can safely delete the legacy <emphasis "
29507
"role=\"bold\">prio_calliout</emphasis> attribute without interrupting "
29508
"service."
29509
msgstr ""
29510
29511
#: serverguide/C/dm-multipath.xml:137(para)
29512
msgid "DM-Multipath can be used to provide:"
29513
msgstr ""
29514
29515
#: serverguide/C/dm-multipath.xml:141(para)
29516
msgid ""
29517
"<emphasis> Redundancy </emphasis> DM-Multipath can provide failover in an "
29518
"active/passive configuration. In an active/passive configuration, only half "
29519
"the paths are used at any time for I/O. If any element of an I/O path (the "
29520
"cable, switch, or controller) fails, DM-Multipath switches to an alternate "
29521
"path."
29522
msgstr ""
29523
29524
#: serverguide/C/dm-multipath.xml:149(para)
29525
msgid ""
29526
"<emphasis> Improved Performance </emphasis> Performance DM-Multipath can be "
29527
"configured in active/active mode, where I/O is spread over the paths in a "
29528
"round-robin fashion. In some configurations, DM-Multipath can detect loading "
29529
"on the I/O paths and dynamically re-balance the load."
29530
msgstr ""
29531
29532
#: serverguide/C/dm-multipath.xml:159(title)
29533
msgid "Storage Array Overview"
29534
msgstr ""
29535
29536
#: serverguide/C/dm-multipath.xml:161(para)
29537
msgid ""
29538
"By default, DM-Multipath includes support for the most common storage arrays "
29539
"that support DM-Multipath. The supported devices can be found in the "
29540
"multipath.conf.defaults file. If your storage array supports DM-Multipath "
29541
"and is not configured by default in this file, you may need to add them to "
29542
"the DM-Multipath configuration file, multipath.conf. For information on the "
29543
"DM-Multipath configuration file, see Section, <link linkend=\"multipath-dm-"
29544
"multipath-config-file\">The DM-Multipath Configuration File</link>. Some "
29545
"storage arrays require special handling of I/O errors and path switching. "
29546
"These require separate hardware handler kernel modules."
29547
msgstr ""
29548
29549
#: serverguide/C/dm-multipath.xml:174(title)
29550
msgid "DM-Multipath components"
29551
msgstr ""
29552
29553
#: serverguide/C/dm-multipath.xml:176(para)
29554
msgid ""
29555
"Table <link linkend=\"multipath-components-table\">DM-Multipath "
29556
"Components</link> describes the components of the DM-Multipath package."
29557
msgstr ""
29558
29559
#: serverguide/C/dm-multipath.xml:183(title)
29560
msgid "DM-Multipath Setup Overview"
29561
msgstr ""
29562
29563
#: serverguide/C/dm-multipath.xml:190(para)
29564
msgid ""
29565
"Install the <emphasis role=\"bold\">multipath-tools</emphasis> and <emphasis "
29566
"role=\"bold\">multipath-tools-boot</emphasis> packages"
29567
msgstr ""
29568
29569
#: serverguide/C/dm-multipath.xml:196(para)
29570
msgid ""
29571
"Create an empty config file, <filename>/etc/multipath.conf</filename>, that "
29572
"re-defines the <link linkend=\"multipath-skel-config\">following</link>"
29573
msgstr ""
29574
29575
#: serverguide/C/dm-multipath.xml:202(para)
29576
msgid ""
29577
"If necessary, edit the <emphasis role=\"bold\">multipath.conf</emphasis> "
29578
"configuration file to modify default values and save the updated file."
29579
msgstr ""
29580
29581
#: serverguide/C/dm-multipath.xml:208(para)
29582
msgid "Start the multipath daemon"
29583
msgstr ""
29584
29585
#: serverguide/C/dm-multipath.xml:212(para)
29586
msgid "Update initial ramdisk"
29587
msgstr ""
29588
29589
#: serverguide/C/dm-multipath.xml:185(para)
29590
msgid ""
29591
"DM-Multipath includes compiled-in default settings that are suitable for "
29592
"common multipath configurations. Setting up DM-multipath is often a simple "
29593
"procedure. The basic procedure for configuring your system with DM-Multipath "
29594
"is as follows: <placeholder-1/> For detailed setup instructions for "
29595
"multipath configuration see Section, <link linkend=\"multipath-setup-"
29596
"overview\">Setting Up DM-Multipath</link>."
29597
msgstr ""
29598
29599
#: serverguide/C/dm-multipath.xml:222(title)
29600
msgid "Multipath Devices"
29601
msgstr ""
29602
29603
#: serverguide/C/dm-multipath.xml:224(para)
29604
msgid ""
29605
"Without DM-Multipath, each path from a server node to a storage controller "
29606
"is treated by the system as a separate device, even when the I/O path "
29607
"connects the same server node to the same storage controller. DM-Multipath "
29608
"provides a way of organizing the I/O paths logically, by creating a single "
29609
"multipath device on top of the underlying devices."
29610
msgstr ""
29611
29612
#: serverguide/C/dm-multipath.xml:232(title)
29613
msgid "Multipath Device Identifiers"
29614
msgstr ""
29615
29616
#: serverguide/C/dm-multipath.xml:260(para)
29617
msgid ""
29618
"The devices in <emphasis role=\"bold\">/dev/mapper</emphasis> are created "
29619
"early in the boot process. Use these devices to access the multipathed "
29620
"devices, for example when creating logical volumes."
29621
msgstr ""
29622
29623
#: serverguide/C/dm-multipath.xml:267(para)
29624
msgid ""
29625
"Any devices of the form <emphasis role=\"bold\">/dev/dm-n</emphasis> are for "
29626
"internal use only and should never be used."
29627
msgstr ""
29628
29629
#: serverguide/C/dm-multipath.xml:234(para)
29630
msgid ""
29631
"Each multipath device has a World Wide Identifier (WWID), which is "
29632
"guaranteed to be globally unique and unchanging. By default, the name of a "
29633
"multipath device is set to its WWID. Alternately, you can set the <emphasis "
29634
"role=\"bold\"><link linkend=\"attribute-"
29635
"user_friendly_names\">user_friendly_names</link></emphasis>option in the "
29636
"multipath configuration file, which causes DM-Multipath to use a node-unique "
29637
"alias of the form <emphasis role=\"bold\">mpathn</emphasis> as the name. For "
29638
"example, a node with two HBAs attached to a storage controller with two "
29639
"ports via a single unzoned FC switch sees four devices: <emphasis "
29640
"role=\"bold\">/dev/sda</emphasis>, <emphasis "
29641
"role=\"bold\">/dev/sdb</emphasis>, <emphasis "
29642
"role=\"bold\">/dev/sdc</emphasis>, and <emphasis "
29643
"role=\"bold\">/dev/sdd</emphasis>. DM-Multipath creates a single device with "
29644
"a unique WWID that reroutes I/O to those four underlying devices according "
29645
"to the multipath configuration. When the <emphasis role=\"bold\"><link "
29646
"linkend=\"attribute-"
29647
"user_friendly_names\">user_friendly_names</link></emphasis> configuration "
29648
"option is set to <emphasis role=\"bold\">yes</emphasis>, the name of the "
29649
"multipath device is set to <emphasis role=\"bold\">mpathn</emphasis>. When "
29650
"new devices are brought under the control of DM-Multipath, the new devices "
29651
"may be seen in two different places under the <emphasis "
29652
"role=\"bold\">/dev</emphasis> directory: <emphasis "
29653
"role=\"bold\">/dev/mapper/mpathn</emphasis> and <emphasis "
29654
"role=\"bold\">/dev/dm-n</emphasis>. <placeholder-1/>For information on the "
29655
"multipath configuration defaults, including the <emphasis "
29656
"role=\"bold\"><link linkend=\"attribute-"
29657
"user_friendly_names\">user_friendly_names</link></emphasis> configuration "
29658
"option, see Section , <link linkend=\"multipath-config-"
29659
"defaults\">Configuration File Defaults</link>. You can also set the name of "
29660
"a multipath device to a name of your choosing by using the <emphasis "
29661
"role=\"bold\"><link linkend=\"attribute-alias\">alias</link></emphasis> "
29662
"option in the <emphasis role=\"bold\">multipaths</emphasis> section of the "
29663
"multipath configuration file. For information on the <emphasis "
29664
"role=\"bold\">multipaths</emphasis> section of the multipath configuration "
29665
"file, see Section, <link linkend=\"multipath-config-multipath\">Multipaths "
29666
"Device Configuration Attributes</link>."
29667
msgstr ""
29668
29669
#: serverguide/C/dm-multipath.xml:288(title)
29670
msgid "Consistent Multipath Device Names in a Cluster"
29671
msgstr ""
29672
29673
#: serverguide/C/dm-multipath.xml:290(para)
29674
msgid ""
29675
"When the <emphasis role=\"bold\">user_friendly_names</emphasis> "
29676
"configuration option is set to yes, the name of the multipath device is "
29677
"unique to a node, but it is not guaranteed to be the same on all nodes using "
29678
"the multipath device. Similarly, if you set the <emphasis "
29679
"role=\"bold\">alias</emphasis> option for a device in the <emphasis "
29680
"role=\"bold\">multipaths</emphasis> section of the "
29681
"<filename>multipath.conf</filename> configuration file, the name is not "
29682
"automatically consistent across all nodes in the cluster. This should not "
29683
"cause any difficulties if you use LVM to create logical devices from the "
29684
"multipath device, but if you require that your multipath device names be "
29685
"consistent in every node it is recommended that you leave the <emphasis "
29686
"role=\"bold\">user_friendly_names</emphasis> option set to <emphasis "
29687
"role=\"bold\">no</emphasis> and that you not configure aliases for the "
29688
"devices. By default, if you do not set <emphasis "
29689
"role=\"bold\">user_friendly_names</emphasis> to yes or configure an alias "
29690
"for a device, a device name will be the WWID for the device, which is always "
29691
"the same. If you want the system-defined user-friendly names to be "
29692
"consistent across all nodes in the cluster, however, you can follow this "
29693
"procedure:"
29694
msgstr ""
29695
29696
#: serverguide/C/dm-multipath.xml:312(para)
29697
msgid "Set up all of the multipath devices on one machine."
29698
msgstr ""
29699
29700
#: serverguide/C/dm-multipath.xml:316(para) serverguide/C/dm-multipath.xml:353(para)
29701
msgid ""
29702
"Disable all of your multipath devices on your other machines by running the "
29703
"following commands:"
29704
msgstr ""
29705
29706
#: serverguide/C/dm-multipath.xml:319(screen) serverguide/C/dm-multipath.xml:356(screen)
29707
#, no-wrap
29708
msgid ""
29709
"# systemctl stop multipath-tools.service\n"
29710
"# multipath -F\n"
29711
msgstr ""
29712
29713
#: serverguide/C/dm-multipath.xml:325(para)
29714
msgid ""
29715
"Copy the <filename>/etc/multipath/bindings</filename> file from the first "
29716
"machine to all the other machines in the cluster."
29717
msgstr ""
29718
29719
#: serverguide/C/dm-multipath.xml:331(para) serverguide/C/dm-multipath.xml:367(para)
29720
msgid ""
29721
"Re-enable the multipathd daemon on all the other machines in the cluster by "
29722
"running the following command:"
29723
msgstr ""
29724
29725
#: serverguide/C/dm-multipath.xml:334(screen) serverguide/C/dm-multipath.xml:370(screen)
29726
#, no-wrap
29727
msgid "# systemctl start multipath-tools.service"
29728
msgstr ""
29729
29730
#: serverguide/C/dm-multipath.xml:338(para)
29731
msgid "If you add a new device, you will need to repeat this process."
29732
msgstr ""
29733
29734
#: serverguide/C/dm-multipath.xml:341(para)
29735
msgid ""
29736
"Similarly, if you configure an alias for a device that you would like to be "
29737
"consistent across the nodes in the cluster, you should ensure that the "
29738
"<filename>/etc/multipath.conf</filename> file is the same for each node in "
29739
"the cluster by following the same procedure:"
29740
msgstr ""
29741
29742
#: serverguide/C/dm-multipath.xml:348(para)
29743
msgid ""
29744
"Configure the aliases for the multipath devices in the in the "
29745
"<filename>multipath.conf</filename> file on one machine."
29746
msgstr ""
29747
29748
#: serverguide/C/dm-multipath.xml:362(para)
29749
msgid ""
29750
"Copy the <filename>multipath.conf</filename> file from the first machine to "
29751
"all the other machines in the cluster."
29752
msgstr ""
29753
29754
#: serverguide/C/dm-multipath.xml:374(para)
29755
msgid "When you add a new device you will need to repeat this process."
29756
msgstr ""
29757
29758
#: serverguide/C/dm-multipath.xml:379(title)
29759
msgid "Multipath Device attributes"
29760
msgstr ""
29761
29762
#: serverguide/C/dm-multipath.xml:381(para)
29763
msgid ""
29764
"In addition to the <emphasis role=\"bold\">user_friendly_names</emphasis> "
29765
"and <emphasis role=\"bold\">alias</emphasis> options, a multipath device has "
29766
"numerous attributes. You can modify these attributes for a specific "
29767
"multipath device by creating an entry for that device in the <emphasis "
29768
"role=\"bold\">multipaths</emphasis> section of the <emphasis "
29769
"role=\"bold\">multipath</emphasis> configuration file. For information on "
29770
"the <emphasis role=\"bold\">multipaths</emphasis> section of the multipath "
29771
"configuration file, see Section, \"<link endterm=\"config-multipath-title\" "
29772
"linkend=\"multipath-config-multipath\"/>\"."
29773
msgstr ""
29774
29775
#: serverguide/C/dm-multipath.xml:394(title)
29776
msgid "Multipath Devices in Logical Volumes"
29777
msgstr ""
29778
29779
#: serverguide/C/dm-multipath.xml:396(para)
29780
msgid ""
29781
"After creating multipath devices, you can use the multipath device names "
29782
"just as you would use a physical device name when creating an LVM physical "
29783
"volume. For example, if /dev/mapper/mpatha is the name of a multipath "
29784
"device, the following command will mark /dev/mapper/mpatha as a physical "
29785
"volume. <screen># pvcreate /dev/mapper/mpatha</screen> You can use the "
29786
"resulting LVM physical device when you create an LVM volume group just as "
29787
"you would use any other LVM physical device."
29788
msgstr ""
29789
29790
#: serverguide/C/dm-multipath.xml:405(para)
29791
msgid ""
29792
"If you attempt to create an LVM physical volume on a whole device on which "
29793
"you have configured partitions, the pvcreate command will fail."
29794
msgstr ""
29795
29796
#: serverguide/C/dm-multipath.xml:425(para)
29797
msgid ""
29798
"Every time either <filename>/etc/lvm.conf</filename> or "
29799
"<filename>/etc/multipath.conf</filename> is updated, the initrd should be "
29800
"rebuilt to reflect these changes. This is imperative when blacklists and "
29801
"filters are necessary to maintain a stable storage configuration."
29802
msgstr ""
29803
29804
#: serverguide/C/dm-multipath.xml:410(para)
29805
msgid ""
29806
"When you create an LVM logical volume that uses active/passive multipath "
29807
"arrays as the underlying physical devices, you should include filters in the "
29808
"<emphasis role=\"bold\">lvm.conf</emphasis> to exclude the disks that "
29809
"underlie the multipath devices. This is because if the array automatically "
29810
"changes the active path to the passive path when it receives I/O, multipath "
29811
"will failover and failback whenever LVM scans the passive path if these "
29812
"devices are not filtered. For active/passive arrays that require a command "
29813
"to make the passive path active, LVM prints a warning message when this "
29814
"occurs. To filter all SCSI devices in the LVM configuration file (lvm.conf), "
29815
"include the following filter in the devices section of the file. "
29816
"<screen>filter = [ \"r/block/\", \"r/disk/\", \"r/sd.*/\", \"a/.*/\" "
29817
"]</screen>After updating <filename>/etc/lvm.conf</filename>, it's necessary "
29818
"to update the <emphasis role=\"bold\">initrd</emphasis> so that this file "
29819
"will be copied there, where the filter matters the most, during boot. "
29820
"Perform:<screen>update-initramfs -u -k all</screen><placeholder-1/>"
29821
msgstr ""
29822
29823
#: serverguide/C/dm-multipath.xml:435(title)
29824
msgid "Setting up DM-Multipath Overview"
29825
msgstr ""
29826
29827
#: serverguide/C/dm-multipath.xml:437(para)
29828
msgid ""
29829
"This section provides step-by-step example procedures for configuring DM-"
29830
"Multipath. It includes the following procedures:"
29831
msgstr ""
29832
29833
#: serverguide/C/dm-multipath.xml:442(para)
29834
msgid "Basic DM-Multipath setup"
29835
msgstr ""
29836
29837
#: serverguide/C/dm-multipath.xml:446(para)
29838
msgid "Ignoring local disks"
29839
msgstr ""
29840
29841
#: serverguide/C/dm-multipath.xml:450(para)
29842
msgid "Adding more devices to the configuration file"
29843
msgstr ""
29844
29845
#: serverguide/C/dm-multipath.xml:455(title)
29846
msgid "Setting Up DM-Multipath"
29847
msgstr ""
29848
29849
#: serverguide/C/dm-multipath.xml:457(para)
29850
msgid ""
29851
"Before setting up DM-Multipath on your system, ensure that your system has "
29852
"been updated and includes the <emphasis role=\"bold\"><application>multipath-"
29853
"tools</application></emphasis> package. If boot from SAN is desired, then "
29854
"the <emphasis role=\"bold\"><application>multipath-tools-"
29855
"boot</application></emphasis> package is also required."
29856
msgstr ""
29857
29858
#: serverguide/C/dm-multipath.xml:475(para)
29859
msgid ""
29860
"To work around a quirk in multipathd, when an "
29861
"<filename>/etc/multipath.conf</filename> doesn't exist, the previous command "
29862
"will return nothing, as it is the result of a <emphasis>merge</emphasis> "
29863
"between the <filename>/etc/multipath.conf</filename> and the database in "
29864
"memory. To remedy this, either define an empty "
29865
"<filename>/etc/multipath.conf</filename>, by using <emphasis "
29866
"role=\"bold\">touch</emphasis>, or create one that redefines a default value "
29867
"like:<screen>defaults {\n"
29868
" user_friendly_names no\n"
29869
"}\n"
29870
"</screen>and restart multipathd:<screen># systemctl restart multipath-"
29871
"tools.service</screen>Now the \"show config\" command will return the live "
29872
"database."
29873
msgstr ""
29874
29875
#: serverguide/C/dm-multipath.xml:464(para)
29876
msgid ""
29877
"A basic <emphasis role=\"bold\">/etc/multipath.conf </emphasis> need not "
29878
"even exist, when <emphasis role=\"bold\">multpath</emphasis> is run without "
29879
"an accompanying <filename>/etc/multipath.conf</filename>, it draws from it's "
29880
"internal database to find a suitable configuration, it also draws from it's "
29881
"internal blacklist. If after running <emphasis role=\"bold\">multipath -"
29882
"ll</emphasis> without a config file, no multipaths are discovered. One must "
29883
"proceed to increase the verbosity to discover why a multipath was not "
29884
"created. Consider referencing the SAN vendor's documentation, the multipath "
29885
"example config files found in <filename>/usr/share/doc/multipath-"
29886
"tools/examples</filename>, and the live multipathd database:<screen "
29887
"id=\"multipath-skel-config\"># echo 'show config' | multipathd -k > "
29888
"multipath.conf-live</screen><placeholder-1/>"
29889
msgstr ""
29890
29891
#: serverguide/C/dm-multipath.xml:492(title)
29892
msgid "Installing with Multipath Support"
29893
msgstr ""
29894
29895
#: serverguide/C/dm-multipath.xml:494(para)
29896
msgid ""
29897
"To enable <ulink "
29898
"url=\"http://wiki.debian.org/DebianInstaller/MultipathSupport\">multipath "
29899
"support during installation</ulink> use<screen>install disk-"
29900
"detect/multipath/enable=true</screen>at the installer prompt. If multipath "
29901
"devices are found these will show up as <emphasis "
29902
"role=\"bold\">/dev/mapper/mpath<X></emphasis> during installation."
29903
msgstr ""
29904
29905
#: serverguide/C/dm-multipath.xml:503(title)
29906
msgid "Ignoring Local Disks When Generating Multipath Devices"
29907
msgstr ""
29908
29909
#: serverguide/C/dm-multipath.xml:505(para)
29910
msgid ""
29911
"Some machines have local SCSI cards for their internal disks. DM-Multipath "
29912
"is not recommended for these devices. The following procedure shows how to "
29913
"modify the multipath configuration file to ignore the local disks when "
29914
"configuring multipath."
29915
msgstr ""
29916
29917
#: serverguide/C/dm-multipath.xml:512(para)
29918
msgid ""
29919
"Determine which disks are the internal disks and mark them as the ones to "
29920
"blacklist. In this example, <emphasis "
29921
"role=\"bold\"><filename>/dev/sda</filename></emphasis> is the internal disk. "
29922
"Note that as originally configured in the default multipath configuration "
29923
"file, executing the <emphasis role=\"bold\">multipath -v2</emphasis> shows "
29924
"the local disk, <emphasis role=\"bold\">/dev/sda</emphasis>, in the "
29925
"multipath map. For further information on the <emphasis "
29926
"role=\"bold\">multipath</emphasis> command output, see Section <link "
29927
"linkend=\"multipath-command-output\">Multipath Command Output</link>."
29928
msgstr ""
29929
29930
#: serverguide/C/dm-multipath.xml:524(screen)
29931
#, no-wrap
29932
msgid ""
29933
"\n"
29934
"# multipath -v2\n"
29935
"create: SIBM-ESXSST336732LC____F3ET0EP0Q000072428BX1 undef WINSYS,SF2372\n"
29936
"size=33 GB features=\"0\" hwhandler=\"0\" wp=undef\n"
29937
"`-+- policy='round-robin 0' prio=1 status=undef\n"
29938
" |- 0:0:0:0 sda 8:0 [--------- \n"
29939
"\n"
29940
"device-mapper ioctl cmd 9 failed: Invalid argument\n"
29941
"device-mapper ioctl cmd 14 failed: No such device or address\n"
29942
"create: 3600a0b80001327d80000006d43621677 undef WINSYS,SF2372\n"
29943
"size=12G features='0' hwhandler='0' wp=undef\n"
29944
"`-+- policy='round-robin 0' prio=1 status=undef\n"
29945
" |- 2:0:0:0 sdb 8:16 undef ready running\n"
29946
" `- 3:0:0:0 sdf 8:80 undef ready running\n"
29947
"\n"
29948
"create: 3600a0b80001327510000009a436215ec undef WINSYS,SF2372\n"
29949
"size=12G features='0' hwhandler='0' wp=undef\n"
29950
"`-+- policy='round-robin 0' prio=1 status=undef\n"
29951
" |- 2:0:0:1 sdc 8:32 undef ready running\n"
29952
" `- 3:0:0:1 sdg 8:96 undef ready running\n"
29953
"\n"
29954
"create: 3600a0b80001327d800000070436216b3 undef WINSYS,SF2372\n"
29955
"size=12G features='0' hwhandler='0' wp=undef\n"
29956
"`-+- policy='round-robin 0' prio=1 status=undef\n"
29957
" |- 2:0:0:2 sdd 8:48 undef ready running\n"
29958
" `- 3:0:0:2 sdg 8:112 undef ready running\n"
29959
"\n"
29960
"create: 3600a0b80001327510000009b4362163e undef WINSYS,SF2372\n"
29961
"size=12G features='0' hwhandler='0' wp=undef\n"
29962
"`-+- policy='round-robin 0' prio=1 status=undef\n"
29963
" |- 2:0:0:3 sdd 8:64 undef ready running\n"
29964
" `- 3:0:0:3 sdg 8:128 undef ready running\n"
29965
msgstr ""
29966
29967
#: serverguide/C/dm-multipath.xml:560(para)
29968
msgid ""
29969
"In order to prevent the device mapper from mapping <emphasis "
29970
"role=\"bold\">/dev/sda</emphasis> in its multipath maps, edit the blacklist "
29971
"section of the <filename>/etc/multipath.conf</filename> file to include this "
29972
"device. Although you could blacklist the <emphasis "
29973
"role=\"bold\">sda</emphasis> device using a <emphasis "
29974
"role=\"bold\">devnode</emphasis> type, that would not be safe procedure "
29975
"since <emphasis role=\"bold\">/dev/sda</emphasis> is not guaranteed to be "
29976
"the same on reboot. To blacklist individual devices, you can blacklist using "
29977
"the WWID of that device. Note that in the output to the <emphasis "
29978
"role=\"bold\">multipath -v2</emphasis> command, the WWID of the "
29979
"<filename>/dev/sda</filename> device is SIBM-"
29980
"ESXSST336732LC____F3ET0EP0Q000072428BX1. To blacklist this device, include "
29981
"the following in the <filename>/etc/multipath.conf</filename> file."
29982
msgstr ""
29983
29984
#: serverguide/C/dm-multipath.xml:575(screen)
29985
#, no-wrap
29986
msgid ""
29987
"\n"
29988
"blacklist {\n"
29989
" wwid SIBM-ESXSST336732LC____F3ET0EP0Q000072428BX1\n"
29990
"}\n"
29991
msgstr ""
29992
29993
#: serverguide/C/dm-multipath.xml:583(para)
29994
msgid ""
29995
"After you have updated the <filename>/etc/multipath.conf</filename> file, "
29996
"you must manually tell the <emphasis role=\"bold\">multipathd</emphasis> "
29997
"daemon to reload the file. The following command reloads the updated "
29998
"<filename>/etc/multipath.conf</filename> file."
29999
msgstr ""
30000
30001
#: serverguide/C/dm-multipath.xml:588(screen)
30002
#, no-wrap
30003
msgid "# systemctl reload multipath-tools.service"
30004
msgstr ""
30005
30006
#: serverguide/C/dm-multipath.xml:592(para)
30007
msgid "Run the following command to remove the multipath device:"
30008
msgstr ""
30009
30010
#: serverguide/C/dm-multipath.xml:595(screen)
30011
#, no-wrap
30012
msgid ""
30013
"\n"
30014
"# multipath -f SIBM-ESXSST336732LC____F3ET0EP0Q000072428BX1\n"
30015
msgstr ""
30016
30017
#: serverguide/C/dm-multipath.xml:601(para)
30018
msgid ""
30019
"To check whether the device removal worked, you can run the "
30020
"<command>multipath -ll</command> command to display the current multipath "
30021
"configuration. For information on the <command>multipath -ll</command> "
30022
"command, see Section <link linkend=\"multipath-queries-and-"
30023
"commands\">Multipath Queries with multipath Command</link>. To check that "
30024
"the blacklisted device was not added back, you can run the multipath "
30025
"command, as in the following example. The multipath command defaults to a "
30026
"verbosity level of <emphasis role=\"bold\">v2</emphasis> if you do not "
30027
"specify a <emphasis role=\"bold\">-v</emphasis> option."
30028
msgstr ""
30029
30030
#: serverguide/C/dm-multipath.xml:612(screen)
30031
#, no-wrap
30032
msgid ""
30033
"\n"
30034
"# multipath\n"
30035
"\n"
30036
"create: 3600a0b80001327d80000006d43621677 undef WINSYS,SF2372\n"
30037
"size=12G features='0' hwhandler='0' wp=undef\n"
30038
"`-+- policy='round-robin 0' prio=1 status=undef\n"
30039
" |- 2:0:0:0 sdb 8:16 undef ready running\n"
30040
" `- 3:0:0:0 sdf 8:80 undef ready running\n"
30041
"\n"
30042
"create: 3600a0b80001327510000009a436215ec undef WINSYS,SF2372\n"
30043
"size=12G features='0' hwhandler='0' wp=undef\n"
30044
"`-+- policy='round-robin 0' prio=1 status=undef\n"
30045
" |- 2:0:0:1 sdc 8:32 undef ready running\n"
30046
" `- 3:0:0:1 sdg 8:96 undef ready running\n"
30047
"\n"
30048
"create: 3600a0b80001327d800000070436216b3 undef WINSYS,SF2372\n"
30049
"size=12G features='0' hwhandler='0' wp=undef\n"
30050
"`-+- policy='round-robin 0' prio=1 status=undef\n"
30051
" |- 2:0:0:2 sdd 8:48 undef ready running\n"
30052
" `- 3:0:0:2 sdg 8:112 undef ready running\n"
30053
"\n"
30054
"create: 3600a0b80001327510000009b4362163e undef WINSYS,SF2372\n"
30055
"size=12G features='0' hwhandler='0' wp=undef\n"
30056
"`-+- policy='round-robin 0' prio=1 status=undef\n"
30057
" |- 2:0:0:3 sdd 8:64 undef ready running\n"
30058
" `- 3:0:0:3 sdg 8:128 undef ready running\n"
30059
msgstr ""
30060
30061
#: serverguide/C/dm-multipath.xml:644(title)
30062
msgid "Configuring Storage Devices"
30063
msgstr ""
30064
30065
#: serverguide/C/dm-multipath.xml:646(para)
30066
msgid ""
30067
"By default, DM-Multipath includes support for the most common storage arrays "
30068
"that support DM-Multipath. The default configuration values, including "
30069
"supported devices, can be found in the "
30070
"<filename>multipath.conf.defaults</filename> file."
30071
msgstr ""
30072
30073
#: serverguide/C/dm-multipath.xml:651(para)
30074
msgid ""
30075
"If you need to add a storage device that is not supported by default as a "
30076
"known multipath device, edit the <filename>/etc/multipath.conf</filename> "
30077
"file and insert the appropriate device information."
30078
msgstr ""
30079
30080
#: serverguide/C/dm-multipath.xml:655(para)
30081
msgid ""
30082
"For example, to add information about the HP Open-V series the entry looks "
30083
"like this, where <emphasis role=\"bold\">%n</emphasis> is the device name:"
30084
msgstr ""
30085
30086
#: serverguide/C/dm-multipath.xml:659(screen)
30087
#, no-wrap
30088
msgid ""
30089
"devices {\n"
30090
" device {\n"
30091
" vendor \"HP\"\n"
30092
" product \"OPEN-V.\"\n"
30093
" getuid_callout \"/lib/udev/scsi_id --whitelisted --"
30094
"device=/dev/%n\"\n"
30095
" }\n"
30096
"}\n"
30097
msgstr ""
30098
30099
#: serverguide/C/dm-multipath.xml:668(para)
30100
msgid ""
30101
"For more information on the devices section of the configuration file, see "
30102
"Section <xref endterm=\"config-device-title\" linkend=\"multipath-config-"
30103
"device\"/>."
30104
msgstr ""
30105
30106
#: serverguide/C/dm-multipath.xml:675(title)
30107
msgid "The DM-Multipath Configuration File"
30108
msgstr ""
30109
30110
#: serverguide/C/dm-multipath.xml:677(para)
30111
msgid ""
30112
"By default, DM-Multipath provides configuration values for the most common "
30113
"uses of multipathing. In addition, DM-Multipath includes support for the "
30114
"most common storage arrays that support DM-Multipath. The default "
30115
"configuration values and the supported devices can be found in the "
30116
"<filename>multipath.conf.defaults</filename> file."
30117
msgstr ""
30118
30119
#: serverguide/C/dm-multipath.xml:683(para)
30120
msgid ""
30121
"You can override the default configuration values for DM-Multipath by "
30122
"editing the <filename>/etc/multipath.conf</filename> configuration file. If "
30123
"necessary, you can also add a storage array that is not supported by default "
30124
"to the configuration file. This chapter provides information on parsing and "
30125
"modifying the <filename>multipath.conf</filename> file. It contains sections "
30126
"on the following topics: <placeholder-1/>"
30127
msgstr ""
30128
30129
#: serverguide/C/dm-multipath.xml:715(para)
30130
msgid ""
30131
"In the multipath configuration file, you need to specify only the sections "
30132
"that you need for your configuration, or that you wish to change from the "
30133
"default values specified in the <filename>multipath.conf.defaults</filename> "
30134
"file. If there are sections of the file that are not relevant to your "
30135
"environment or for which you do not need to override the default values, you "
30136
"can leave them commented out, as they are in the initial file."
30137
msgstr ""
30138
30139
#: serverguide/C/dm-multipath.xml:723(para)
30140
msgid "The configuration file allows regular expression description syntax."
30141
msgstr ""
30142
30143
#: serverguide/C/dm-multipath.xml:726(para)
30144
msgid ""
30145
"An annotated version of the configuration file can be found in "
30146
"<filename><filename>/usr/share/doc/multipath-"
30147
"tools/examples/multipath.conf.annotated.gz</filename></filename>."
30148
msgstr ""
30149
30150
#: serverguide/C/dm-multipath.xml:730(title)
30151
msgid "Configuration File Overview"
30152
msgstr ""
30153
30154
#: serverguide/C/dm-multipath.xml:732(para)
30155
msgid ""
30156
"The multipath configuration file is divided into the following sections:"
30157
msgstr ""
30158
30159
#: serverguide/C/dm-multipath.xml:737(emphasis)
30160
msgid "blacklist"
30161
msgstr ""
30162
30163
#: serverguide/C/dm-multipath.xml:740(para)
30164
msgid ""
30165
"Listing of specific devices that will not be considered for multipath."
30166
msgstr ""
30167
30168
#: serverguide/C/dm-multipath.xml:746(emphasis)
30169
msgid "blacklist_exceptions"
30170
msgstr ""
30171
30172
#: serverguide/C/dm-multipath.xml:749(para)
30173
msgid ""
30174
"Listing of multipath candidates that would otherwise be blacklisted "
30175
"according to the parameters of the blacklist section."
30176
msgstr ""
30177
30178
#: serverguide/C/dm-multipath.xml:756(emphasis)
30179
msgid "defaults"
30180
msgstr ""
30181
30182
#: serverguide/C/dm-multipath.xml:759(para)
30183
msgid "General default settings for DM-Multipath."
30184
msgstr ""
30185
30186
#: serverguide/C/dm-multipath.xml:767(para)
30187
msgid ""
30188
"Settings for the characteristics of individual multipath devices. These "
30189
"values overwrite what is specified in the <emphasis "
30190
"role=\"bold\">defaults</emphasis> and <emphasis "
30191
"role=\"bold\">devices</emphasis> sections of the configuration file."
30192
msgstr ""
30193
30194
#: serverguide/C/dm-multipath.xml:776(emphasis)
30195
msgid "devices"
30196
msgstr ""
30197
30198
#: serverguide/C/dm-multipath.xml:779(para)
30199
msgid ""
30200
"Settings for the individual storage controllers. These values overwrite what "
30201
"is specified in the <emphasis role=\"bold\">defaults</emphasis> section of "
30202
"the configuration file. If you are using a storage array that is not "
30203
"supported by default, you may need to create a devices subsection for your "
30204
"array."
30205
msgstr ""
30206
30207
#: serverguide/C/dm-multipath.xml:788(para)
30208
msgid ""
30209
"When the system determines the attributes of a multipath device, first it "
30210
"checks the multipath settings, then the per devices settings, then the "
30211
"multipath system defaults."
30212
msgstr ""
30213
30214
#: serverguide/C/dm-multipath.xml:794(title)
30215
msgid "Configuration File Blacklist"
30216
msgstr ""
30217
30218
#: serverguide/C/dm-multipath.xml:796(para)
30219
msgid ""
30220
"The blacklist section of the multipath configuration file specifies the "
30221
"devices that will not be used when the system configures multipath devices. "
30222
"Devices that are blacklisted will not be grouped into a multipath device."
30223
msgstr ""
30224
30225
#: serverguide/C/dm-multipath.xml:803(para)
30226
msgid ""
30227
"If you do need to blacklist devices, you can do so according to the "
30228
"following criteria:"
30229
msgstr ""
30230
30231
#: serverguide/C/dm-multipath.xml:808(para)
30232
msgid ""
30233
"By WWID, as described <xref endterm=\"config-blacklist-by-wwid-title\" "
30234
"linkend=\"multipath-config-blacklist-by-wwid\"/>"
30235
msgstr ""
30236
30237
#: serverguide/C/dm-multipath.xml:814(para)
30238
msgid ""
30239
"By device name, as described in <xref endterm=\"config-blacklist-by-device-"
30240
"name-title\" linkend=\"multipath-config-blacklist-by-device-name\"/>"
30241
msgstr ""
30242
30243
#: serverguide/C/dm-multipath.xml:820(para)
30244
msgid ""
30245
"By device type, as described in <xref endterm=\"config-blacklist-by-device-"
30246
"type-title\" linkend=\"multipath-config-blacklist-by-device-type\"/>"
30247
msgstr ""
30248
30249
#: serverguide/C/dm-multipath.xml:826(para)
30250
msgid ""
30251
"By default, a variety of device types are blacklisted, even after you "
30252
"comment out the initial blacklist section of the configuration file. For "
30253
"information, see <xref endterm=\"config-blacklist-by-device-name-title\" "
30254
"linkend=\"multipath-config-blacklist-by-device-name\"/>"
30255
msgstr ""
30256
30257
#: serverguide/C/dm-multipath.xml:835(title)
30258
msgid "Blacklisting By WWID"
30259
msgstr ""
30260
30261
#: serverguide/C/dm-multipath.xml:838(para)
30262
msgid ""
30263
"You can specify individual devices to blacklist by their World-Wide "
30264
"IDentification with a <emphasis role=\"bold\">wwid</emphasis> entry in the "
30265
"<emphasis role=\"bold\">blacklist</emphasis> section of the configuration "
30266
"file."
30267
msgstr ""
30268
30269
#: serverguide/C/dm-multipath.xml:843(para)
30270
msgid ""
30271
"The following example shows the lines in the configuration file that would "
30272
"blacklist a device with a WWID of 26353900f02796769."
30273
msgstr ""
30274
30275
#: serverguide/C/dm-multipath.xml:846(screen)
30276
#, no-wrap
30277
msgid ""
30278
"\n"
30279
"blacklist {\n"
30280
" wwid 26353900f02796769\n"
30281
"}\n"
30282
msgstr ""
30283
30284
#: serverguide/C/dm-multipath.xml:854(title)
30285
msgid "Blacklisting By Device Name"
30286
msgstr ""
30287
30288
#: serverguide/C/dm-multipath.xml:857(para)
30289
msgid ""
30290
"You can blacklist device types by device name so that they will not be "
30291
"grouped into a multipath device by specifying a <emphasis "
30292
"role=\"bold\">devnode</emphasis> entry in the <emphasis "
30293
"role=\"bold\">blacklist</emphasis> section of the configuration file."
30294
msgstr ""
30295
30296
#: serverguide/C/dm-multipath.xml:863(para)
30297
msgid ""
30298
"The following example shows the lines in the configuration file that would "
30299
"blacklist all SCSI devices, since it blacklists all sd* devices. <screen>\n"
30300
"blacklist {\n"
30301
" devnode \"^sd[a-z]\"\n"
30302
"}</screen>"
30303
msgstr ""
30304
30305
#: serverguide/C/dm-multipath.xml:870(para)
30306
msgid ""
30307
"You can use a <emphasis role=\"bold\">devnode</emphasis> entry in the "
30308
"<emphasis role=\"bold\">blacklist</emphasis> section of the configuration "
30309
"file to specify individual devices to blacklist rather than all devices of a "
30310
"specific type. This is not recommended, however, since unless it is "
30311
"statically mapped by udev rules, there is no guarantee that a specific "
30312
"device will have the same name on reboot. For example, a device name could "
30313
"change from <filename>/dev/sda</filename> to <filename>/dev/sdb</filename> "
30314
"on reboot."
30315
msgstr ""
30316
30317
#: serverguide/C/dm-multipath.xml:880(para)
30318
msgid ""
30319
"By default, the following <emphasis role=\"bold\">devnode</emphasis> entries "
30320
"are compiled in the default blacklist; the devices that these entries "
30321
"blacklist do not generally support DM-Multipath. To enable multipathing on "
30322
"any of these devices, you would need to specify them in the <emphasis "
30323
"role=\"bold\">blacklist_exceptions</emphasis> section of the configuration "
30324
"file, as described in <xref endterm=\"config-blacklist-exceptions-title\" "
30325
"linkend=\"multipath-config-blacklist-exceptions\"/><screen>\n"
30326
"blacklist {\n"
30327
" devnode \"^(ram|raw|loop|fd|md|dm-|sr|scd|st)[0-9]*\"\n"
30328
" devnode \"^hd[a-z]\"\n"
30329
"}\n"
30330
"</screen>"
30331
msgstr ""
30332
30333
#: serverguide/C/dm-multipath.xml:897(title)
30334
msgid "Blacklisting By Device Type"
30335
msgstr ""
30336
30337
#: serverguide/C/dm-multipath.xml:900(para)
30338
msgid ""
30339
"You can specify specific device types in the <emphasis "
30340
"role=\"bold\">blacklist</emphasis> section of the configuration file with a "
30341
"device section. The following example blacklists all IBM DS4200 and HP "
30342
"devices. <screen>\n"
30343
"blacklist {\n"
30344
" device {\n"
30345
" vendor \"IBM\"\n"
30346
" product \"3S42\" #DS4200 Product 10\n"
30347
" }\n"
30348
" device {\n"
30349
" vendor \"HP\"\n"
30350
" product \"*\"\n"
30351
" }\n"
30352
"}\n"
30353
"</screen>"
30354
msgstr ""
30355
30356
#: serverguide/C/dm-multipath.xml:918(title)
30357
msgid "Blacklist Exceptions"
30358
msgstr ""
30359
30360
#: serverguide/C/dm-multipath.xml:921(para)
30361
msgid ""
30362
"You can use the <emphasis role=\"bold\">blacklist_exceptions</emphasis> "
30363
"section of the configuration file to enable multipathing on devices that "
30364
"have been blacklisted by default."
30365
msgstr ""
30366
30367
#: serverguide/C/dm-multipath.xml:926(para)
30368
msgid ""
30369
"For example, if you have a large number of devices and want to multipath "
30370
"only one of them (with the WWID of 3600d0230000000000e13955cc3757803), "
30371
"instead of individually blacklisting each of the devices except the one you "
30372
"want, you could instead blacklist all of them, and then allow only the one "
30373
"you want by adding the following lines to the "
30374
"<filename>/etc/multipath.conf</filename> file. <screen>\n"
30375
"blacklist {\n"
30376
" wwid \"*\"\n"
30377
"}\n"
30378
"\n"
30379
"blacklist_exceptions {\n"
30380
" wwid \"3600d0230000000000e13955cc3757803\"\n"
30381
"}\n"
30382
"</screen>"
30383
msgstr ""
30384
30385
#: serverguide/C/dm-multipath.xml:941(para)
30386
msgid ""
30387
"When specifying devices in the <emphasis "
30388
"role=\"bold\">blacklist_exceptions</emphasis> section of the configuration "
30389
"file, you must specify the exceptions in the same way they were specified in "
30390
"the <emphasis role=\"bold\">blacklist</emphasis>. For example, a WWID "
30391
"exception will not apply to devices specified by a <emphasis "
30392
"role=\"bold\">devnode</emphasis> blacklist entry, even if the blacklisted "
30393
"device is associated with that WWID. Similarly, devnode exceptions apply "
30394
"only to devnode entries, and device exceptions apply only to device entries."
30395
msgstr ""
30396
30397
#: serverguide/C/dm-multipath.xml:954(title)
30398
msgid "Configuration File Defaults"
30399
msgstr ""
30400
30401
#: serverguide/C/dm-multipath.xml:956(para)
30402
msgid ""
30403
"The <filename>/etc/multipath.conf</filename> configuration file includes a "
30404
"<emphasis role=\"bold\">defaults</emphasis> section that sets the <emphasis "
30405
"role=\"bold\">user_friendly_names</emphasis> parameter to <emphasis "
30406
"role=\"bold\">yes</emphasis>, as follows."
30407
msgstr ""
30408
30409
#: serverguide/C/dm-multipath.xml:961(screen)
30410
#, no-wrap
30411
msgid ""
30412
"\n"
30413
"defaults {\n"
30414
" user_friendly_names yes\n"
30415
"}\n"
30416
msgstr ""
30417
30418
#: serverguide/C/dm-multipath.xml:967(para)
30419
msgid ""
30420
"This overwrites the default value of the <emphasis "
30421
"role=\"bold\">user_friendly_names</emphasis> parameter."
30422
msgstr ""
30423
30424
#: serverguide/C/dm-multipath.xml:970(para)
30425
msgid ""
30426
"The configuration file includes a template of configuration defaults. This "
30427
"section is commented out, as follows."
30428
msgstr ""
30429
30430
#: serverguide/C/dm-multipath.xml:973(screen)
30431
#, no-wrap
30432
msgid ""
30433
"\n"
30434
"#defaults {\n"
30435
"# udev_dir /dev\n"
30436
"# polling_interval 5\n"
30437
"# selector \"round-robin 0\"\n"
30438
"# path_grouping_policy failover\n"
30439
"# getuid_callout \"/lib/dev/scsi_id --whitelisted --"
30440
"device=/dev/%n\"\n"
30441
"#\tprio\t\t\tconst\n"
30442
"#\tpath_checker\t\tdirectio\n"
30443
"#\trr_min_io\t\t1000\n"
30444
"#\trr_weight\t\tuniform\n"
30445
"#\tfailback\t\tmanual\n"
30446
"#\tno_path_retry\t\tfail\n"
30447
"#\tuser_friendly_names\tno\n"
30448
"#}\n"
30449
msgstr ""
30450
30451
#: serverguide/C/dm-multipath.xml:990(para)
30452
msgid ""
30453
"To overwrite the default value for any of the configuration parameters, you "
30454
"can copy the relevant line from this template into the <emphasis "
30455
"role=\"bold\">defaults</emphasis> section and uncomment it. For example, to "
30456
"overwrite the <emphasis role=\"bold\">path_grouping_policy</emphasis> "
30457
"parameter so that it is <emphasis role=\"bold\">multibus</emphasis> rather "
30458
"than the default value of <emphasis role=\"bold\">failover</emphasis>, copy "
30459
"the appropriate line from the template to the initial <emphasis "
30460
"role=\"bold\">defaults</emphasis> section of the configuration file, and "
30461
"uncomment it, as follows."
30462
msgstr ""
30463
30464
#: serverguide/C/dm-multipath.xml:1001(screen)
30465
#, no-wrap
30466
msgid ""
30467
"\n"
30468
"defaults {\n"
30469
" user_friendly_names yes\n"
30470
" path_grouping_policy multibus\n"
30471
"}\n"
30472
msgstr ""
30473
30474
#: serverguide/C/dm-multipath.xml:1008(para)
30475
msgid ""
30476
"Table <xref endterm=\"config-defaults-table-title\" linkend=\"multipath-"
30477
"config-defaults-table\"/> describes the attributes that are set in the "
30478
"<emphasis role=\"bold\">defaults</emphasis> section of the "
30479
"<filename>multipath.conf</filename> configuration file. These values are "
30480
"used by DM-Multipath unless they are overwritten by the attributes specified "
30481
"in the <emphasis role=\"bold\">devices</emphasis> and <emphasis "
30482
"role=\"bold\">multipaths</emphasis> sections of the "
30483
"<filename>multipath.conf</filename> file."
30484
msgstr ""
30485
30486
#: serverguide/C/dm-multipath.xml:1022(title)
30487
msgid "Configuration File Multipath Attributes"
30488
msgstr ""
30489
30490
#: serverguide/C/dm-multipath.xml:1025(para)
30491
msgid ""
30492
"Table <xref endterm=\"attributes-table-title\" linkend=\"multipath-"
30493
"attributes-table\"/> shows the attributes that you can set in the <emphasis "
30494
"role=\"bold\">multipaths</emphasis> section of the "
30495
"<filename>multipath.conf</filename> configuration file for each specific "
30496
"multipath device. These attributes apply only to the one specified "
30497
"multipath. These defaults are used by DM-Multipath and override attributes "
30498
"set in the <emphasis role=\"bold\">defaults</emphasis> and <emphasis "
30499
"role=\"bold\">devices</emphasis> sections of the multipath.conf file."
30500
msgstr ""
30501
30502
#: serverguide/C/dm-multipath.xml:1038(para)
30503
msgid ""
30504
"In addition, the following parameters may be overridden in this <emphasis "
30505
"role=\"bold\">multipath</emphasis> section"
30506
msgstr ""
30507
30508
#: serverguide/C/dm-multipath.xml:1087(para)
30509
msgid ""
30510
"The following example shows multipath attributes specified in the "
30511
"configuration file for two specific multipath devices. The first device has "
30512
"a WWID of 3600508b4000156d70001200000b0000 and a symbolic name of yellow."
30513
msgstr ""
30514
30515
#: serverguide/C/dm-multipath.xml:1092(para)
30516
msgid ""
30517
"The second multipath device in the example has a WWID of "
30518
"1DEC_____321816758474 and a symbolic name of red. In this example, the <link "
30519
"linkend=\"attribute-rr_weight\" role=\"bold\">rr_weight</link> attributes "
30520
"are set to priorities."
30521
msgstr ""
30522
30523
#: serverguide/C/dm-multipath.xml:1097(screen)
30524
#, no-wrap
30525
msgid ""
30526
"\n"
30527
"multipaths {\n"
30528
" multipath {\n"
30529
" wwid 3600508b4000156d70001200000b0000\n"
30530
" alias yellow\n"
30531
" path_grouping_policy multibus\n"
30532
" path_selector \"round-robin 0\"\n"
30533
" failback manual\n"
30534
" rr_weight priorities\n"
30535
" no_path_retry 5\n"
30536
" }\n"
30537
" multipath {\n"
30538
" wwid 1DEC_____321816758474\n"
30539
" alias red\n"
30540
" rr_weight priorities\n"
30541
" }\n"
30542
"}\n"
30543
msgstr ""
30544
30545
#: serverguide/C/dm-multipath.xml:1118(title)
30546
msgid "Configuration File Devices"
30547
msgstr ""
30548
30549
#: serverguide/C/dm-multipath.xml:1120(para)
30550
msgid ""
30551
"Table <xref endterm=\"device-attributes-table-title\" linkend=\"multipath-"
30552
"device-attributes-table\"/> shows the attributes that you can set for each "
30553
"individual storage device in the devices section of the multipath.conf "
30554
"configuration file. These attributes are used by DM-Multipath unless they "
30555
"are overwritten by the attributes specified in the <emphasis "
30556
"role=\"bold\">multipaths</emphasis> section of the "
30557
"<filename>multipath.conf</filename> file for paths that contain the device. "
30558
"These attributes override the attributes set in the <emphasis "
30559
"role=\"bold\">defaults</emphasis> section of the "
30560
"<filename>multipath.conf</filename> file."
30561
msgstr ""
30562
30563
#: serverguide/C/dm-multipath.xml:1131(para)
30564
msgid ""
30565
"Many devices that support multipathing are included by default in a "
30566
"multipath configuration. The values for the devices that are supported by "
30567
"default are listed in the <filename>multipath.conf.defaults</filename> file. "
30568
"You probably will not need to modify the values for these devices, but if "
30569
"you do you can overwrite the default values by including an entry in the "
30570
"configuration file for the device that overwrites those values. You can copy "
30571
"the device configuration defaults from the "
30572
"<filename>multipath.conf.annotated.gz</filename> or if you wish to have a "
30573
"brief config file, <filename>multipath.conf.synthetic</filename> file for "
30574
"the device and override the values that you want to change."
30575
msgstr ""
30576
30577
#: serverguide/C/dm-multipath.xml:1143(para)
30578
msgid ""
30579
"To add a device to this section of the configuration file that is not "
30580
"configured automatically by default, you must set the <emphasis "
30581
"role=\"bold\">vendor</emphasis> and <emphasis "
30582
"role=\"bold\">product</emphasis> parameters. You can find these values by "
30583
"looking at <emphasis "
30584
"role=\"bold\">/sys/block/device_name/device/vendor</emphasis> and <emphasis "
30585
"role=\"bold\">/sys/block/device_name/device/model</emphasis> where "
30586
"device_name is the device to be multipathed, as in the following example:"
30587
msgstr ""
30588
30589
#: serverguide/C/dm-multipath.xml:1153(screen)
30590
#, no-wrap
30591
msgid ""
30592
"\n"
30593
"# cat /sys/block/sda/device/vendor\n"
30594
"WINSYS \n"
30595
"# cat /sys/block/sda/device/model\n"
30596
"SF2372\n"
30597
msgstr ""
30598
30599
#: serverguide/C/dm-multipath.xml:1160(para)
30600
msgid ""
30601
"The additional parameters to specify depend on your specific device. If the "
30602
"device is active/active, you will usually not need to set additional "
30603
"parameters. You may want to set <link linkend=\"attribute-"
30604
"path_grouping_policy\">path_grouping_policy</link> to <emphasis "
30605
"role=\"bold\">multibus</emphasis>. Other parameters you may need to set are "
30606
"<link linkend=\"attribute-no_path_retry\">no_path_retry</link> and <link "
30607
"linkend=\"attribute-rr_min_io\">rr_min_io</link>, as described in Table "
30608
"<xref endterm=\"attributes-table-title\" linkend=\"multipath-attributes-"
30609
"table\"/>."
30610
msgstr ""
30611
30612
#: serverguide/C/dm-multipath.xml:1170(para)
30613
msgid ""
30614
"If the device is active/passive, but it automatically switches paths with "
30615
"I/O to the passive path, you need to change the checker function to one that "
30616
"does not send I/O to the path to test if it is working (otherwise, your "
30617
"device will keep failing over). This almost always means that you set the "
30618
"<link linkend=\"attribute-path_checker\">path_checker</link> to <emphasis "
30619
"role=\"bold\">tur</emphasis>; this works for all SCSI devices that support "
30620
"the Test Unit Ready command, which most do."
30621
msgstr ""
30622
30623
#: serverguide/C/dm-multipath.xml:1179(para)
30624
msgid ""
30625
"If the device needs a special command to switch paths, then configuring this "
30626
"device for multipath requires a hardware handler kernel module. The current "
30627
"available hardware handler is emc. If this is not sufficient for your "
30628
"device, you may not be able to configure the device for multipath."
30629
msgstr ""
30630
30631
#: serverguide/C/dm-multipath.xml:1188(para)
30632
msgid ""
30633
"In addition, the following parameters may be overridden in this <emphasis "
30634
"role=\"bold\">device</emphasis> section"
30635
msgstr ""
30636
30637
#: serverguide/C/dm-multipath.xml:1263(para)
30638
msgid ""
30639
"Whenever a hardware_handler is specified, it is your responsibility to "
30640
"ensure that the appropriate kernel module is loaded to support the specified "
30641
"interface. These modules can be found in <emphasis "
30642
"role=\"bold\"><filename>/lib/modules/`uname -"
30643
"r`/kernel/drivers/scsi/device_handler/ </filename></emphasis>. The requisite "
30644
"module should be integrated into the initrd to ensure the necessary "
30645
"discovery and failover-failback capacity is available during boot time. "
30646
"Example,<screen># echo scsi_dh_alua >> /etc/initramfs-tools/modules "
30647
"## append module to file\n"
30648
"# update-initramfs -u -k all</screen>"
30649
msgstr ""
30650
30651
#: serverguide/C/dm-multipath.xml:1274(para)
30652
msgid ""
30653
"The following example shows a device entry in the multipath configuration "
30654
"file."
30655
msgstr ""
30656
30657
#: serverguide/C/dm-multipath.xml:1277(screen)
30658
#, no-wrap
30659
msgid ""
30660
"\n"
30661
"#devices {\n"
30662
"#\tdevice {\n"
30663
"#\t\tvendor\t\t\t\"COMPAQ \"\n"
30664
"#\t\tproduct\t\t\t\"MSA1000 \"\n"
30665
"#\t\tpath_grouping_policy\tmultibus\n"
30666
"#\t\tpath_checker\t\ttur\n"
30667
"#\t\trr_weight\t\tpriorities\n"
30668
"#\t}\n"
30669
"#}\n"
30670
msgstr ""
30671
30672
#: serverguide/C/dm-multipath.xml:1289(para)
30673
msgid ""
30674
"The spacing reserved in the <emphasis role=\"bold\">vendor</emphasis>, "
30675
"<emphasis role=\"bold\">product</emphasis>, and <emphasis "
30676
"role=\"bold\">revision</emphasis> fields are significant as multipath is "
30677
"performing a direct match against these attributes, whose format is defined "
30678
"by the SCSI specification, specifically the <ulink "
30679
"url=\"http://en.wikipedia.org/wiki/SCSI_Inquiry_Command\">Standard "
30680
"INQUIRY</ulink> command. When quotes are used, the vendor, product, and "
30681
"revision fields will be interpreted strictly according to the spec. Regular "
30682
"expressions may be integrated into the quoted strings. Should a field be "
30683
"defined without the requisite spacing, multipath will copy the string into "
30684
"the properly sized buffer and pad with the appropriate number of spaces. The "
30685
"specification expects the entire field to be populated by printable "
30686
"characters or spaces, as seen in the example above"
30687
msgstr ""
30688
30689
#: serverguide/C/dm-multipath.xml:1306(para)
30690
msgid "vendor: 8 characters"
30691
msgstr ""
30692
30693
#: serverguide/C/dm-multipath.xml:1310(para)
30694
msgid "product: 16 characters"
30695
msgstr ""
30696
30697
#: serverguide/C/dm-multipath.xml:1314(para)
30698
msgid "revision: 4 characters"
30699
msgstr ""
30700
30701
#: serverguide/C/dm-multipath.xml:1318(para)
30702
msgid ""
30703
"To create a more robust configuration file, regular expressions can also be "
30704
"used. Operators include <emphasis role=\"bold\">^ $ [ ] . * ? +</emphasis>. "
30705
"Examples of functional regular expressions can be found by examining the "
30706
"live multipath database and <filename>multipath.conf </filename>example "
30707
"files found in <filename>/usr/share/doc/multipath-tools/examples:</filename>"
30708
msgstr ""
30709
30710
#: serverguide/C/dm-multipath.xml:1325(screen)
30711
#, no-wrap
30712
msgid "# echo 'show config' | multipathd -k"
30713
msgstr ""
30714
30715
#: serverguide/C/dm-multipath.xml:1330(title)
30716
msgid "DM-Multipath Administration and Troubleshooting"
30717
msgstr ""
30718
30719
#: serverguide/C/dm-multipath.xml:1333(title)
30720
msgid "Resizing an Online Multipath Device"
30721
msgstr ""
30722
30723
#: serverguide/C/dm-multipath.xml:1335(para)
30724
msgid ""
30725
"If you need to resize an online multipath device, use the following procedure"
30726
msgstr ""
30727
30728
#: serverguide/C/dm-multipath.xml:1340(para)
30729
msgid "Resize your physical device. This is storage platform specific."
30730
msgstr ""
30731
30732
#: serverguide/C/dm-multipath.xml:1345(para)
30733
msgid "Use the following command to find the paths to the LUN:"
30734
msgstr ""
30735
30736
#: serverguide/C/dm-multipath.xml:1347(screen)
30737
#, no-wrap
30738
msgid "# multipath -l"
30739
msgstr ""
30740
30741
#: serverguide/C/dm-multipath.xml:1351(para)
30742
msgid ""
30743
"Resize your paths. For SCSI devices, writing 1 to the "
30744
"<filename>rescan</filename> file for the device causes the SCSI driver to "
30745
"rescan, as in the following command:"
30746
msgstr ""
30747
30748
#: serverguide/C/dm-multipath.xml:1355(screen)
30749
#, no-wrap
30750
msgid "# echo 1 > /sys/block/device_name/device/rescan"
30751
msgstr ""
30752
30753
#: serverguide/C/dm-multipath.xml:1359(para)
30754
msgid ""
30755
"Resize your multipath device by running the multipathd resize command:"
30756
msgstr ""
30757
30758
#: serverguide/C/dm-multipath.xml:1362(screen)
30759
#, no-wrap
30760
msgid "# multipathd -k 'resize map mpatha'"
30761
msgstr ""
30762
30763
#: serverguide/C/dm-multipath.xml:1366(para)
30764
msgid "Resize the file system (assuming no LVM or DOS partitions are used):"
30765
msgstr ""
30766
30767
#: serverguide/C/dm-multipath.xml:1369(screen)
30768
#, no-wrap
30769
msgid "# resize2fs /dev/mapper/mpatha"
30770
msgstr ""
30771
30772
#: serverguide/C/dm-multipath.xml:1375(title)
30773
msgid ""
30774
"Moving root File Systems from a Single Path Device to a Multipath Device"
30775
msgstr ""
30776
30777
#: serverguide/C/dm-multipath.xml:1378(para)
30778
msgid ""
30779
"This is dramatically simplified by the use of UUIDs to identify devices as "
30780
"an intrinsic label. Simply install <emphasis role=\"bold\">multipath-tools-"
30781
"boot</emphasis> and reboot. This will rebuild the initial ramdisk and afford "
30782
"multipath the opportunity to build it's paths before the root file system is "
30783
"mounted by UUID."
30784
msgstr ""
30785
30786
#: serverguide/C/dm-multipath.xml:1385(para)
30787
msgid ""
30788
"Whenever <filename>multipath.conf</filename> is updated, so should the "
30789
"initrd by executing <command>update-initramfs -u -k all</command>. The "
30790
"reason being is <filename>multipath.conf</filename> is copied to the ramdisk "
30791
"and is integral to determining the available devices for grouping via it's "
30792
"blacklist and device sections."
30793
msgstr ""
30794
30795
#: serverguide/C/dm-multipath.xml:1394(title)
30796
msgid ""
30797
"Moving swap File Systems from a Single Path Device to a Multipath Device"
30798
msgstr ""
30799
30800
#: serverguide/C/dm-multipath.xml:1397(para)
30801
msgid ""
30802
"The procedure is exactly the same as illustrated in the previous section "
30803
"called <link linkend=\"multipath-moving-rootfs-from-single-path-to-multipath-"
30804
"device\">Moving root File Systems from a Single Path to a Multipath "
30805
"Device</link>."
30806
msgstr ""
30807
30808
#: serverguide/C/dm-multipath.xml:1405(title)
30809
msgid "The Multipath Daemon"
30810
msgstr ""
30811
30812
#: serverguide/C/dm-multipath.xml:1407(para)
30813
msgid ""
30814
"If you find you have trouble implementing a multipath configuration, you "
30815
"should ensure the multipath daemon is running as described in <link "
30816
"linkend=\"multipath-setting-up-dm-multipath\">\"Setting up DM-"
30817
"Multipath\"</link>. The <command>multipathd</command> daemon must be running "
30818
"in order to use multipathd devices. Also see section <link "
30819
"linkend=\"multipath-interacting-with-multipathd\">Troubleshooting with the "
30820
"multipathd interactive console</link> concerning interacting with "
30821
"<command>multipathd</command> as a debugging aid."
30822
msgstr ""
30823
30824
#: serverguide/C/dm-multipath.xml:1447(title)
30825
msgid "Issues with queue_if_no_path"
30826
msgstr ""
30827
30828
#: serverguide/C/dm-multipath.xml:1449(para)
30829
msgid ""
30830
"If <emphasis role=\"bold\">features \"1 queue_if_no_path\"</emphasis> is "
30831
"specified in the <filename>/etc/multipath.conf</filename> file, then any "
30832
"process that uses I/O will hang until one or more paths are restored. To "
30833
"avoid this, set the <emphasis role=\"bold\"><link linkend=\"attribute-"
30834
"no_path_retry\">no_path_retry</link> N</emphasis> parameter in the "
30835
"<filename>/etc/multipath.conf</filename>."
30836
msgstr ""
30837
30838
#: serverguide/C/dm-multipath.xml:1456(para)
30839
msgid ""
30840
"When you set the <emphasis role=\"bold\">no_path_retry</emphasis> parameter, "
30841
"remove the <emphasis role=\"bold\">features \"1 "
30842
"queue_if_no_path\"</emphasis> option from the "
30843
"<filename>/etc/multipath.conf</filename> file as well. If, however, you are "
30844
"using a multipathed device for which the <option>features \"1 "
30845
"queue_if_no_path\"</option> option is set as a compiled in default, as it is "
30846
"for many SAN devices, you must add <option>features \"0\"</option> to "
30847
"override this default. You can do this by copying the existing <emphasis "
30848
"role=\"bold\">devices</emphasis> section, and just that section (not the "
30849
"entire file), from <filename>/usr/share/doc/multipath-"
30850
"tools/examples/multipath.conf.annotated.gz</filename> into "
30851
"<filename>/etc/multipath.conf</filename> and editing to suit your needs."
30852
msgstr ""
30853
30854
#: serverguide/C/dm-multipath.xml:1470(para)
30855
msgid ""
30856
"If you need to use the <option>features \"1 queue_if_no_path\"</option> "
30857
"option and you experience the issue noted here, use the "
30858
"<command>dmsetup</command> command to edit the policy at runtime for a "
30859
"particular LUN (that is, for which all the paths are unavailable). For "
30860
"example, if you want to change the policy on the multipath device "
30861
"<filename>mpathc</filename> from <option>\"queue_if_no_path\"</option> to "
30862
"<option> \"fail_if_no_path\"</option>, execute the following command."
30863
msgstr ""
30864
30865
#: serverguide/C/dm-multipath.xml:1479(screen)
30866
#, no-wrap
30867
msgid "# dmsetup message mpathc 0 \"fail_if_no_path\""
30868
msgstr ""
30869
30870
#: serverguide/C/dm-multipath.xml:1482(para)
30871
msgid ""
30872
"You must specify the <filename>mpathN</filename> alias rather than the path"
30873
msgstr ""
30874
30875
#: serverguide/C/dm-multipath.xml:1488(title)
30876
msgid "Multipath Command Output"
30877
msgstr ""
30878
30879
#: serverguide/C/dm-multipath.xml:1490(para)
30880
msgid ""
30881
"When you create, modify, or list a multipath device, you get a printout of "
30882
"the current device setup. The format is as follows. For each multipath "
30883
"device:"
30884
msgstr ""
30885
30886
#: serverguide/C/dm-multipath.xml:1494(screen)
30887
#, no-wrap
30888
msgid ""
30889
" action_if_any: alias (wwid_if_different_from_alias) "
30890
"dm_device_name_if_known vendor,product\n"
30891
" size=size features='features' hwhandler='hardware_handler' "
30892
"wp=write_permission_if_known"
30893
msgstr ""
30894
30895
#: serverguide/C/dm-multipath.xml:1497(para)
30896
msgid "For each path group:"
30897
msgstr ""
30898
30899
#: serverguide/C/dm-multipath.xml:1499(screen)
30900
#, no-wrap
30901
msgid ""
30902
" -+- policy='scheduling_policy' prio=prio_if_known\n"
30903
" status=path_group_status_if_known"
30904
msgstr ""
30905
30906
#: serverguide/C/dm-multipath.xml:1502(para)
30907
msgid "For each path:"
30908
msgstr ""
30909
30910
#: serverguide/C/dm-multipath.xml:1504(screen)
30911
#, no-wrap
30912
msgid ""
30913
" `- host:channel:id:lun devnode major:minor dm_status_if_known "
30914
"path_status\n"
30915
" online_status"
30916
msgstr ""
30917
30918
#: serverguide/C/dm-multipath.xml:1507(para)
30919
msgid ""
30920
"For example, the output of a multipath command might appear as follows:"
30921
msgstr ""
30922
30923
#: serverguide/C/dm-multipath.xml:1510(screen)
30924
#, no-wrap
30925
msgid ""
30926
" 3600d0230000000000e13955cc3757800 dm-1 WINSYS,SF2372\n"
30927
" size=269G features='0' hwhandler='0' wp=rw\n"
30928
" |-+- policy='round-robin 0' prio=1 status=active\n"
30929
" | `- 6:0:0:0 sdb 8:16 active ready running\n"
30930
" `-+- policy='round-robin 0' prio=1 status=enabled\n"
30931
" `- 7:0:0:0 sdf 8:80 active ready running"
30932
msgstr ""
30933
30934
#: serverguide/C/dm-multipath.xml:1517(para)
30935
msgid ""
30936
"If the path is up and ready for I/O, the status of the path is <emphasis "
30937
"role=\"bold\">ready</emphasis> or <emphasis "
30938
"role=\"emphasis\">ghost</emphasis>. If the path is down, the status is "
30939
"<emphasis role=\"bold\">faulty</emphasis> or <emphasis "
30940
"role=\"bold\">shaky</emphasis>. The path status is updated periodically by "
30941
"the <command>multipathd</command> daemon based on the polling interval "
30942
"defined in the <filename>/etc/multipath.conf</filename> file."
30943
msgstr ""
30944
30945
#: serverguide/C/dm-multipath.xml:1525(para)
30946
msgid ""
30947
"The dm status is similar to the path status, but from the kernel's point of "
30948
"view. The dm status has two states: <emphasis "
30949
"role=\"bold\">failed</emphasis>, which is analogous to <emphasis "
30950
"role=\"bold\">faulty</emphasis>, and <emphasis "
30951
"role=\"bold\">active</emphasis> which covers all other path states. "
30952
"Occasionally, the path state and the dm state of a device will temporarily "
30953
"not agree."
30954
msgstr ""
30955
30956
#: serverguide/C/dm-multipath.xml:1533(para)
30957
msgid ""
30958
"The possible values for <emphasis role=\"bold\">online_status</emphasis> are "
30959
"<emphasis role=\"bold\">running</emphasis> and <emphasis "
30960
"role=\"bold\">offline</emphasis>. A status of <emphasis "
30961
"role=\"emphasis\">offline</emphasis> means that the SCSI device has been "
30962
"disabled."
30963
msgstr ""
30964
30965
#: serverguide/C/dm-multipath.xml:1541(para)
30966
msgid ""
30967
"When a multipath device is being created or modified , the path group "
30968
"status, the dm device name, the write permissions, and the dm status are not "
30969
"known. Also, the features are not always correct"
30970
msgstr ""
30971
30972
#: serverguide/C/dm-multipath.xml:1548(title)
30973
msgid "Multipath Queries with multipath Command"
30974
msgstr ""
30975
30976
#: serverguide/C/dm-multipath.xml:1550(para)
30977
msgid ""
30978
"You can use the <emphasis role=\"bold\">-l </emphasis>and <emphasis "
30979
"role=\"bold\">-ll</emphasis> options of the <emphasis "
30980
"role=\"bold\">multipath</emphasis> command to display the current multipath "
30981
"configuration. The <emphasis role=\"bold\">-l</emphasis> option displays "
30982
"multipath topology gathered from information in sysfs and the device mapper. "
30983
"The <emphasis role=\"bold\">-ll</emphasis> option displays the information "
30984
"the <emphasis role=\"bold\">-l</emphasis> displays in addition to all other "
30985
"available components of the system."
30986
msgstr ""
30987
30988
#: serverguide/C/dm-multipath.xml:1559(para)
30989
msgid ""
30990
"When displaying the multipath configuration, there are three verbosity "
30991
"levels you can specify with the <emphasis role=\"bold\">-v</emphasis> option "
30992
"of the multipath command. Specifying <emphasis role=\"bold\">-v0</emphasis> "
30993
"yields no output. Specifying<emphasis role=\"bold\"> -v1</emphasis> outputs "
30994
"the created or updated multipath names only, which you can then feed to "
30995
"other tools such as kpartx. Specifying <emphasis role=\"bold\">-"
30996
"v2</emphasis> prints all detected paths, multipaths, and device maps."
30997
msgstr ""
30998
30999
#: serverguide/C/dm-multipath.xml:1569(para)
31000
msgid ""
31001
"The default <emphasis role=\"bold\">verbosity</emphasis> level of multipath "
31002
"is <emphasis role=\"bold\">2</emphasis> and can be globally modified by "
31003
"defining the <link linkend=\"attribute-verbosity\">verbosity "
31004
"attribute</link> in the <emphasis role=\"bold\">defaults</emphasis> section "
31005
"of <filename>multipath.conf</filename>."
31006
msgstr ""
31007
31008
#: serverguide/C/dm-multipath.xml:1576(para)
31009
msgid ""
31010
"The following example shows the output of a <emphasis "
31011
"role=\"bold\">multipath -l</emphasis> command."
31012
msgstr ""
31013
31014
#: serverguide/C/dm-multipath.xml:1579(screen)
31015
#, no-wrap
31016
msgid ""
31017
"# multipath -l\n"
31018
" 3600d0230000000000e13955cc3757800 dm-1 WINSYS,SF2372\n"
31019
" size=269G features='0' hwhandler='0' wp=rw\n"
31020
" |-+- policy='round-robin 0' prio=1 status=active\n"
31021
" | `- 6:0:0:0 sdb 8:16 active ready running\n"
31022
" `-+- policy='round-robin 0' prio=1 status=enabled\n"
31023
" `- 7:0:0:0 sdf 8:80 active ready running"
31024
msgstr ""
31025
31026
#: serverguide/C/dm-multipath.xml:1587(para)
31027
msgid ""
31028
"The following example shows the output of a <emphasis "
31029
"role=\"bold\">multipath -ll</emphasis> command."
31030
msgstr ""
31031
31032
#: serverguide/C/dm-multipath.xml:1590(screen)
31033
#, no-wrap
31034
msgid ""
31035
"# multipath -ll\n"
31036
" 3600d0230000000000e13955cc3757801 dm-10 WINSYS,SF2372\n"
31037
" size=269G features='0' hwhandler='0' wp=rw\n"
31038
" |-+- policy='round-robin 0' prio=1 status=enabled\n"
31039
" | `- 19:0:0:1 sdc 8:32 active ready running\n"
31040
" `-+- policy='round-robin 0' prio=1 status=enabled\n"
31041
" `- 18:0:0:1 sdh 8:112 active ready running\n"
31042
" 3600d0230000000000e13955cc3757803 dm-2 WINSYS,SF2372\n"
31043
" size=125G features='0' hwhandler='0' wp=rw\n"
31044
" `-+- policy='round-robin 0' prio=1 status=active\n"
31045
" |- 19:0:0:3 sde 8:64 active ready running\n"
31046
" `- 18:0:0:3 sdj 8:144 active ready running"
31047
msgstr ""
31048
31049
#: serverguide/C/dm-multipath.xml:1605(title)
31050
msgid "Multipath Command Options"
31051
msgstr ""
31052
31053
#: serverguide/C/dm-multipath.xml:1607(para)
31054
msgid ""
31055
"Table <xref endterm=\"useful-multipath-command-options-title\" "
31056
"linkend=\"useful-multipath-command-options\"/> describes some options of the "
31057
"<emphasis role=\"bold\">multipath</emphasis> command that you might find "
31058
"useful."
31059
msgstr ""
31060
31061
#: serverguide/C/dm-multipath.xml:1613(title)
31062
msgid "Useful multipath Command Options"
31063
msgstr ""
31064
31065
#: serverguide/C/dm-multipath.xml:1622(entry)
31066
msgid "Option"
31067
msgstr ""
31068
31069
#: serverguide/C/dm-multipath.xml:1629(emphasis)
31070
msgid "-l"
31071
msgstr ""
31072
31073
#: serverguide/C/dm-multipath.xml:1631(emphasis) serverguide/C/dm-multipath.xml:1638(emphasis)
31074
msgid "sysfs"
31075
msgstr ""
31076
31077
#: serverguide/C/dm-multipath.xml:1630(entry)
31078
msgid ""
31079
"Display the current multipath configuration gathered from <placeholder-1/> "
31080
"and the device mapper."
31081
msgstr ""
31082
31083
#: serverguide/C/dm-multipath.xml:1636(emphasis)
31084
msgid "-ll"
31085
msgstr ""
31086
31087
#: serverguide/C/dm-multipath.xml:1637(entry)
31088
msgid ""
31089
"Display the current multipath configuration gathered from <placeholder-1/>, "
31090
"the device mapper, and all other available components on the system."
31091
msgstr ""
31092
31093
#: serverguide/C/dm-multipath.xml:1643(emphasis)
31094
msgid "-f device"
31095
msgstr ""
31096
31097
#: serverguide/C/dm-multipath.xml:1644(entry)
31098
msgid "Remove the named multipath device."
31099
msgstr ""
31100
31101
#: serverguide/C/dm-multipath.xml:1648(emphasis)
31102
msgid "-F"
31103
msgstr ""
31104
31105
#: serverguide/C/dm-multipath.xml:1649(entry)
31106
msgid "Remove all unused multipath devices."
31107
msgstr ""
31108
31109
#: serverguide/C/dm-multipath.xml:1657(title)
31110
msgid "Determining Device Mapper Entries with dmsetup Command"
31111
msgstr ""
31112
31113
#: serverguide/C/dm-multipath.xml:1659(para)
31114
msgid ""
31115
"You can use the <emphasis role=\"bold\">dmsetup</emphasis> command to find "
31116
"out which device mapper entries match the <emphasis "
31117
"role=\"bold\">multipathed</emphasis> devices."
31118
msgstr ""
31119
31120
#: serverguide/C/dm-multipath.xml:1663(para)
31121
msgid ""
31122
"The following command displays all the device mapper devices and their major "
31123
"and minor numbers. The minor numbers determine the name of the dm device. "
31124
"For example, a minor number of <emphasis role=\"bold\">3</emphasis> "
31125
"corresponds to the multipathed device <emphasis "
31126
"role=\"bold\"><filename>/dev/dm-3</filename></emphasis>."
31127
msgstr ""
31128
31129
#: serverguide/C/dm-multipath.xml:1669(screen)
31130
#, no-wrap
31131
msgid ""
31132
"\n"
31133
"# dmsetup ls\n"
31134
"mpathd (253, 4)\n"
31135
"mpathep1 (253, 12)\n"
31136
"mpathfp1 (253, 11)\n"
31137
"mpathb (253, 3)\n"
31138
"mpathgp1 (253, 14)\n"
31139
"mpathhp1 (253, 13)\n"
31140
"mpatha (253, 2)\n"
31141
"mpathh (253, 9)\n"
31142
"mpathg (253, 8)\n"
31143
"VolGroup00-LogVol01 (253, 1)\n"
31144
"mpathf (253, 7)\n"
31145
"VolGroup00-LogVol00 (253, 0)\n"
31146
"mpathe (253, 6)\n"
31147
"mpathbp1 (253, 10)\n"
31148
"mpathd (253, 5)\n"
31149
" "
31150
msgstr ""
31151
31152
#: serverguide/C/dm-multipath.xml:1690(title)
31153
msgid "Troubleshooting with the multipathd interactive console"
31154
msgstr ""
31155
31156
#: serverguide/C/dm-multipath.xml:1692(para)
31157
msgid ""
31158
"The <emphasis role=\"bold\">multipathd -k</emphasis> command is an "
31159
"interactive interface to the <emphasis role=\"bold\">multipathd</emphasis> "
31160
"daemon. Entering this command brings up an interactive multipath console. "
31161
"After entering this command, you can enter help to get a list of available "
31162
"commands, you can enter a interactive command, or you can enter <emphasis "
31163
"role=\"bold\">CTRL-D</emphasis> to quit."
31164
msgstr ""
31165
31166
#: serverguide/C/dm-multipath.xml:1699(para)
31167
msgid ""
31168
"The multipathd interactive console can be used to troubleshoot problems you "
31169
"may be having with your system. For example, the following command sequence "
31170
"displays the multipath configuration, including the defaults, before exiting "
31171
"the console. See the IBM article <ulink url=\"http://www-"
31172
"01.ibm.com/support/docview.wss?uid=isg3T1011985\">\"Tricks with "
31173
"Multipathd\"</ulink> for more examples."
31174
msgstr ""
31175
31176
#: serverguide/C/dm-multipath.xml:1706(screen)
31177
#, no-wrap
31178
msgid ""
31179
"# multipathd -k\n"
31180
" > > show config\n"
31181
" > > CTRL-D"
31182
msgstr ""
31183
31184
#: serverguide/C/dm-multipath.xml:1710(para)
31185
msgid ""
31186
"The following command sequence ensures that multipath has picked up any "
31187
"changes to the multipath.conf,"
31188
msgstr ""
31189
31190
#: serverguide/C/dm-multipath.xml:1713(screen)
31191
#, no-wrap
31192
msgid ""
31193
"\n"
31194
"# multipathd -k\n"
31195
"> > reconfigure\n"
31196
"> > CTRL-D\n"
31197
msgstr ""
31198
31199
#: serverguide/C/dm-multipath.xml:1719(para)
31200
msgid ""
31201
"Use the following command sequence to ensure that the path checker is "
31202
"working properly."
31203
msgstr ""
31204
31205
#: serverguide/C/dm-multipath.xml:1722(screen)
31206
#, no-wrap
31207
msgid ""
31208
"\n"
31209
"# multipathd -k\n"
31210
"> > show paths\n"
31211
"> > CTRL-D\n"
31212
msgstr ""
31213
31214
#: serverguide/C/dm-multipath.xml:1728(para)
31215
msgid ""
31216
"Commands can also be streamed into multipathd using stdin like so:<screen># "
31217
"echo 'show config' | multipathd -k</screen>"
31218
msgstr ""
31219
31220
#: serverguide/C/databases.xml:11(title)
31221
msgid "Databases"
31222
msgstr "Basis Data"
31223
31224
#: serverguide/C/databases.xml:12(para)
31225
msgid "Ubuntu provides two popular database servers. They are:"
31226
msgstr ""
31227
31228
#: serverguide/C/databases.xml:17(trademark) serverguide/C/databases.xml:29(title)
31229
msgid "MySQL"
31230
msgstr "MySQL"
31231
31232
#: serverguide/C/databases.xml:20(application) serverguide/C/databases.xml:293(title)
31233
msgid "PostgreSQL"
31234
msgstr "PostgreSQL"
31235
31236
#: serverguide/C/databases.xml:23(para)
31237
msgid ""
31238
"They are available in the main repository. This section explains how to "
31239
"install and configure these database servers."
31240
msgstr ""
31241
31242
#: serverguide/C/databases.xml:30(para)
31243
msgid ""
31244
"<application>MySQL</application> is a fast, multi-threaded, multi-user, and "
31245
"robust SQL database server. It is intended for mission-critical, heavy-load "
31246
"production systems as well as for embedding into mass-deployed software."
31247
msgstr ""
31248
31249
#: serverguide/C/databases.xml:38(para)
31250
msgid "To install MySQL, run the following command from a terminal prompt:"
31251
msgstr ""
31252
"Untuk menginstal MySQL, jalankan perintah berikut dari terminal prompt:"
31253
31254
#: serverguide/C/databases.xml:42(command)
31255
msgid "sudo apt install mysql-server"
31256
msgstr ""
31257
31258
#: serverguide/C/databases.xml:44(para)
31259
msgid ""
31260
"During the installation process you will be prompted to enter a password for "
31261
"the MySQL root user."
31262
msgstr ""
31263
31264
#: serverguide/C/databases.xml:48(para)
31265
msgid ""
31266
"Once the installation is complete, the MySQL server should be started "
31267
"automatically. You can run the following command from a terminal prompt to "
31268
"check whether the MySQL server is running:"
31269
msgstr ""
31270
31271
#: serverguide/C/databases.xml:55(command)
31272
msgid "sudo netstat -tap | grep mysql"
31273
msgstr "sudo netstat -tap | grep mysql"
31274
31275
#: serverguide/C/databases.xml:58(para)
31276
msgid ""
31277
"When you run this command, you should see the following line or something "
31278
"similar:"
31279
msgstr ""
31280
"Ketika Anda menjalankan perintah ini, Anda akan melihat baris berikut atau "
31281
"yang agak mirip:"
31282
31283
#: serverguide/C/databases.xml:62(programlisting)
31284
#, no-wrap
31285
msgid ""
31286
"\n"
31287
"tcp 0 0 localhost:mysql *:* LISTEN "
31288
"2556/mysqld\n"
31289
msgstr ""
31290
31291
#: serverguide/C/databases.xml:65(para)
31292
msgid ""
31293
"If the server is not running correctly, you can type the following command "
31294
"to start it:"
31295
msgstr ""
31296
"Jika server tidak berjalan dengan benar, Anda dapat mengetik perintah "
31297
"berikut untuk menjalankannya:"
31298
31299
#: serverguide/C/databases.xml:69(command) serverguide/C/databases.xml:93(command)
31300
msgid "sudo systemctl restart mysql.service"
31301
msgstr ""
31302
31303
#: serverguide/C/databases.xml:74(para)
31304
msgid ""
31305
"You can edit the <filename>/etc/mysql/my.cnf</filename> file to configure "
31306
"the basic settings -- log file, port number, etc. For example, to configure "
31307
"MySQL to listen for connections from network hosts, change the "
31308
"<emphasis>bind-address</emphasis> directive to the server's IP address:"
31309
msgstr ""
31310
31311
#: serverguide/C/databases.xml:80(programlisting)
31312
#, no-wrap
31313
msgid ""
31314
"\n"
31315
"bind-address = 192.168.0.5\n"
31316
msgstr ""
31317
31318
#: serverguide/C/databases.xml:84(para)
31319
msgid "Replace 192.168.0.5 with the appropriate address."
31320
msgstr ""
31321
31322
#: serverguide/C/databases.xml:88(para)
31323
msgid ""
31324
"After making a change to <filename>/etc/mysql/my.cnf</filename> the MySQL "
31325
"daemon will need to be restarted:"
31326
msgstr ""
31327
31328
#: serverguide/C/databases.xml:95(para)
31329
msgid ""
31330
"If you would like to change the MySQL <emphasis>root</emphasis> password, in "
31331
"a terminal enter:"
31332
msgstr ""
31333
31334
#: serverguide/C/databases.xml:100(command)
31335
msgid "sudo dpkg-reconfigure mysql-server-5.5"
31336
msgstr ""
31337
31338
#: serverguide/C/databases.xml:102(para)
31339
msgid ""
31340
"The MySQL daemon will be stopped, and you will be prompted to enter a new "
31341
"password."
31342
msgstr ""
31343
31344
#: serverguide/C/databases.xml:107(title)
31345
msgid "Database Engines"
31346
msgstr ""
31347
31348
#: serverguide/C/databases.xml:108(para)
31349
msgid ""
31350
"Whilst the default configuration of MySQL provided by the Ubuntu packages is "
31351
"perfectly functional and performs well there are things you may wish to "
31352
"consider before you proceed."
31353
msgstr ""
31354
31355
#: serverguide/C/databases.xml:112(para)
31356
msgid ""
31357
"MySQL is designed to allow data to be stored in different ways. These "
31358
"methods are referred to as either database or storage engines. There are two "
31359
"main engines that you'll be interested in: InnoDB and MyISAM. Storage "
31360
"engines are transparent to the end user. MySQL will handle things "
31361
"differently under the surface, but regardless of which storage engine is in "
31362
"use, you will interact with the database in the same way."
31363
msgstr ""
31364
31365
#: serverguide/C/databases.xml:119(para)
31366
msgid "Each engine has its own advantages and disadvantages."
31367
msgstr ""
31368
31369
#: serverguide/C/databases.xml:122(para)
31370
msgid ""
31371
"While it is possible, and may be advantageous to mix and match database "
31372
"engines on a table level, doing so reduces the effectiveness of the "
31373
"performance tuning you can do as you'll be splitting the resources between "
31374
"two engines instead of dedicating them to one."
31375
msgstr ""
31376
31377
#: serverguide/C/databases.xml:129(para)
31378
msgid ""
31379
"MyISAM is the older of the two. It can be faster than InnoDB under certain "
31380
"circumstances and favours a read only workload. Some web applications have "
31381
"been tuned around MyISAM (though that's not to imply that they will slow "
31382
"under InnoDB). MyISAM also supports the FULLTEXT data type, which allows "
31383
"very fast searches of large quantities of text data. However MyISAM is only "
31384
"capable of locking an entire table for writing. This means only one process "
31385
"can update a table at a time. As any application that uses the table scales "
31386
"this may prove to be a hindrance. It also lacks journaling, which makes it "
31387
"harder for data to be recovered after a crash. The following link provides "
31388
"some points for consideration about using <ulink "
31389
"url=\"http://www.mysqlperformanceblog.com/2006/06/17/using-myisam-in-"
31390
"production/\">MyISAM on a production database</ulink>."
31391
msgstr ""
31392
31393
#: serverguide/C/databases.xml:143(para)
31394
msgid ""
31395
"InnoDB is a more modern database engine, designed to be <ulink "
31396
"url=\"http://en.wikipedia.org/wiki/ACID\">ACID compliant</ulink> which "
31397
"guarantees database transactions are processed reliably. Write locking can "
31398
"occur on a row level basis within a table. That means multiple updates can "
31399
"occur on a single table simultaneously. Data caching is also handled in "
31400
"memory within the database engine, allowing caching on a more efficient row "
31401
"level basis rather than file block. To meet ACID compliance all transactions "
31402
"are journaled independently of the main tables. This allows for much more "
31403
"reliable data recovery as data consistency can be checked."
31404
msgstr ""
31405
31406
#: serverguide/C/databases.xml:156(para)
31407
msgid ""
31408
"As of MySQL 5.5 InnoDB is the default engine, and is highly recommended over "
31409
"MyISAM unless you have specific need for features unique to the engine."
31410
msgstr ""
31411
31412
#: serverguide/C/databases.xml:163(title)
31413
msgid "Creating a tuned my.cnf file"
31414
msgstr ""
31415
31416
#: serverguide/C/databases.xml:164(para)
31417
msgid ""
31418
"There are a number of parameters that can be adjusted within MySQL's "
31419
"configuration file that will allow you to improve the performance of the "
31420
"server over time. For initial set-up you may find <ulink "
31421
"url=\"http://tools.percona.com/members/wizard\">Percona's my.cnf generating "
31422
"tool</ulink> useful. This tool will help generate a my.cnf file that will be "
31423
"much more optimised for your specific server capabilities and your "
31424
"requirements."
31425
msgstr ""
31426
31427
#: serverguide/C/databases.xml:169(para)
31428
msgid ""
31429
"<emphasis>Do not</emphasis> replace your existing my.cnf file with Percona's "
31430
"one if you have already loaded data into the database. Some of the changes "
31431
"that will be in the file will be incompatible as they alter how data is "
31432
"stored on the hard disk and you'll be unable to start MySQL. If you do wish "
31433
"to use it and you have existing data, you will need to carry out a mysqldump "
31434
"and reload: <screen>\n"
31435
"mysqldump --all-databases --routines -u root -p > ~/fulldump.sql\n"
31436
"</screen> This will then prompt you for the root password before creating a "
31437
"copy of the data. It is advisable to make sure there are no other users or "
31438
"processes using the database whilst this takes place. Depending on how much "
31439
"data you've got in your database, this may take a while. You won't see "
31440
"anything on the screen during this process."
31441
msgstr ""
31442
31443
#: serverguide/C/databases.xml:180(para)
31444
msgid ""
31445
"Once the dump has been completed, shut down MySQL: <screen>\n"
31446
"<command>sudo systemctl stop mysql.service</command>\n"
31447
"</screen> Now backup the original my.cnf file and replace with the new one: "
31448
"<screen>\n"
31449
"<command>sudo cp /etc/mysql/my.cnf /etc/mysql/my.cnf.backup</command>\n"
31450
"<command>sudo cp /path/to/new/my.cnf /etc/mysql/my.cnf</command>\n"
31451
"</screen> Then delete and re-initialise the database space and make sure "
31452
"ownership is correct before restarting MySQL: <screen>\n"
31453
"<command>sudo rm -rf /var/lib/mysql/*</command>\n"
31454
"<command>sudo mysql_install_db</command>\n"
31455
"<command>sudo chown -R mysql: /var/lib/mysql</command>\n"
31456
"<command>sudo systemctl start mysql.service</command>\n"
31457
"</screen> Finally all that's left is to re-import your data. To give us an "
31458
"idea of how far the import process has got you may find the 'Pipe Viewer' "
31459
"utility, pv, useful. The following shows how to install and use pv for this "
31460
"case, but if you'd rather not use it just replace pv with cat in the "
31461
"following command. Ignore any ETA times produced by pv, they're based on the "
31462
"average time taken to handle each row of the file, but the speed of "
31463
"inserting can vary wildly from row to row with mysqldumps: <screen>\n"
31464
"<command>sudo apt install pv</command>\n"
31465
"<command>pv ~/fulldump.sql | mysql</command>\n"
31466
"</screen> Once that is complete all is good to go!"
31467
msgstr ""
31468
31469
#: serverguide/C/databases.xml:206(para)
31470
msgid ""
31471
"This is not necessary for all my.cnf changes. Most of the variables you may "
31472
"wish to change to improve performance are adjustable even whilst the server "
31473
"is running. As with anything, make sure to have a good backup copy of config "
31474
"files and data before making changes."
31475
msgstr ""
31476
31477
#: serverguide/C/databases.xml:215(title)
31478
msgid "MySQL Tuner"
31479
msgstr ""
31480
31481
#: serverguide/C/databases.xml:216(para)
31482
msgid ""
31483
"<application>MySQL Tuner</application> is a useful tool that will connect to "
31484
"a running MySQL instance and offer suggestions for how it can be best "
31485
"configured for your workload. The longer the server has been running for, "
31486
"the better the advice mysqltuner can provide. In a production environment, "
31487
"consider waiting for at least 24 hours before running the tool. You can get "
31488
"install mysqltuner from the Ubuntu repositories: <screen>\n"
31489
"<command>sudo apt install mysqltuner</command>\n"
31490
"</screen> Then once its been installed, run it: <screen>\n"
31491
"<command>mysqltuner</command>\n"
31492
"</screen> and wait for its final report. The top section provides general "
31493
"information about the database server, and the bottom section provides "
31494
"tuning suggestions to alter in your my.cnf. Most of these can be altered "
31495
"live on the server without restarting, look through the official MySQL "
31496
"documentation (link in Resources section) for the relevant variables to "
31497
"change in production. The following is part of an example report from a "
31498
"production database which shows there may be some benefit from increasing "
31499
"the amount of query cache: <screen>\n"
31500
"-------- Recommendations ----------------------------------------------------"
31501
"-\n"
31502
"General recommendations:\n"
31503
" Run OPTIMIZE TABLE to defragment tables for better performance\n"
31504
" Increase table_cache gradually to avoid file descriptor limits\n"
31505
"Variables to adjust:\n"
31506
" key_buffer_size (> 1.4G)\n"
31507
" query_cache_size (> 32M)\n"
31508
" table_cache (> 64)\n"
31509
" innodb_buffer_pool_size (>= 22G)\n"
31510
"</screen>"
31511
msgstr ""
31512
31513
#: serverguide/C/databases.xml:250(para)
31514
msgid ""
31515
"One final comment on tuning databases: Whilst we can broadly say that "
31516
"certain settings are the best, performance can vary from application to "
31517
"application. For example, what works best for Wordpress might not be the "
31518
"best for Drupal, Joomla or proprietary applications. Performance is "
31519
"dependent on the types of queries, use of indexes, how efficient the "
31520
"database design is and so on. You may find it useful to spend some time "
31521
"searching for database tuning tips based on what applications you're using "
31522
"it for. Once you get past a certain point any adjustments you make will only "
31523
"result in minor improvements, and you'll be better off either improving the "
31524
"application, or looking at scaling up your database environment through "
31525
"either using more powerful hardware or by adding slave servers."
31526
msgstr ""
31527
31528
#: serverguide/C/databases.xml:267(para)
31529
msgid ""
31530
"See the <ulink url=\"http://www.mysql.com/\">MySQL Home Page</ulink> for "
31531
"more information."
31532
msgstr ""
31533
31534
#: serverguide/C/databases.xml:272(para)
31535
msgid ""
31536
"Full documentation is available in both online and offline formats from the "
31537
"<ulink url=\"http://dev.mysql.com/doc/\"> MySQL Developers portal</ulink>"
31538
msgstr ""
31539
31540
#: serverguide/C/databases.xml:278(para)
31541
msgid ""
31542
"For general SQL information see <ulink "
31543
"url=\"http://www.informit.com/store/product.aspx?isbn=0768664128\"> Using "
31544
"SQL Special Edition</ulink> by Rafe Colburn."
31545
msgstr ""
31546
31547
#: serverguide/C/databases.xml:284(para)
31548
msgid ""
31549
"The <ulink url=\"https://help.ubuntu.com/community/ApacheMySQLPHP\">Apache "
31550
"MySQL PHP Ubuntu Wiki</ulink> page also has useful information."
31551
msgstr ""
31552
31553
#: serverguide/C/databases.xml:294(para)
31554
msgid ""
31555
"<application>PostgreSQL</application> is an object-relational database "
31556
"system that has the features of traditional commercial database systems with "
31557
"enhancements to be found in next-generation DBMS systems."
31558
msgstr ""
31559
31560
#: serverguide/C/databases.xml:301(para)
31561
msgid ""
31562
"To install <application>PostgreSQL</application>, run the following command "
31563
"in the command prompt:"
31564
msgstr ""
31565
31566
#: serverguide/C/databases.xml:307(command)
31567
msgid "sudo apt install postgresql"
31568
msgstr ""
31569
31570
#: serverguide/C/databases.xml:310(para)
31571
msgid ""
31572
"Once the installation is complete, you should configure the "
31573
"<application>PostgreSQL</application> server based on your needs, although "
31574
"the default configuration is viable."
31575
msgstr ""
31576
31577
#: serverguide/C/databases.xml:317(para)
31578
msgid ""
31579
"<application>PostgreSQL</application> supports multiple client "
31580
"authentication methods. IDENT authentication method is used for "
31581
"<application>postgres</application> and local users, unless otherwise "
31582
"configured. Please refer to the <ulink "
31583
"url=\"http://www.postgresql.org/docs/current/static/admin.html\"> PostgreSQL "
31584
"Administrator's Guide</ulink> if you would like to configure alternatives "
31585
"like Kerberos."
31586
msgstr ""
31587
31588
#: serverguide/C/databases.xml:323(para)
31589
msgid ""
31590
"The following discussion assumes that you wish to enable TCP/IP connections "
31591
"and use the MD5 method for client authentication. "
31592
"<application>PostgreSQL</application>configuration files are stored in the "
31593
"<filename>/etc/postgresql/<version>/main</filename> directory. For "
31594
"example, if you install <application>PostgreSQL 9.5</application>, the "
31595
"configuration files are stored in the "
31596
"<filename>/etc/postgresql/9.5/main</filename> directory."
31597
msgstr ""
31598
31599
#: serverguide/C/databases.xml:332(para)
31600
msgid ""
31601
"To configure <emphasis>ident</emphasis> authentication, add entries to the "
31602
"<filename>/etc/postgresql/9.5/main/pg_ident.conf</filename> file. There are "
31603
"detailed comments in the file to guide you."
31604
msgstr ""
31605
31606
#: serverguide/C/databases.xml:338(para)
31607
msgid ""
31608
"To enable other computers to connect to your "
31609
"<application>PostgreSQL</application> server, edit the file "
31610
"<filename>/etc/postgresql/9.5/main/postgresql.conf</filename>"
31611
msgstr ""
31612
31613
#: serverguide/C/databases.xml:339(para)
31614
msgid ""
31615
"Locate the line <emphasis>#listen_addresses = 'localhost'</emphasis> and "
31616
"change it to:"
31617
msgstr ""
31618
31619
#: serverguide/C/databases.xml:342(programlisting)
31620
#, no-wrap
31621
msgid ""
31622
"\n"
31623
"listen_addresses = '*'\n"
31624
msgstr ""
31625
31626
#: serverguide/C/databases.xml:346(para)
31627
msgid "To allow both IPv4 and IPv6 connections replace 'localhost' with '::'"
31628
msgstr ""
31629
31630
#: serverguide/C/databases.xml:350(para)
31631
msgid ""
31632
"You may also edit all other parameters, if you know what you are doing! For "
31633
"details, refer to the configuration file or to the "
31634
"<application>PostgreSQL</application> documentation."
31635
msgstr ""
31636
31637
#: serverguide/C/databases.xml:355(para)
31638
msgid ""
31639
"Now that we can connect to our <application>PostgreSQL</application> server, "
31640
"the next step is to set a password for the <emphasis>postgres</emphasis> "
31641
"user. Run the following command at a terminal prompt to connect to the "
31642
"default <application>PostgreSQL</application> template database:"
31643
msgstr ""
31644
31645
#: serverguide/C/databases.xml:362(command)
31646
msgid "sudo -u postgres psql template1"
31647
msgstr ""
31648
31649
#: serverguide/C/databases.xml:364(para)
31650
msgid ""
31651
"The above command connects to <application>PostgreSQL</application> database "
31652
"<emphasis>template1</emphasis> as user <emphasis>postgres</emphasis>. Once "
31653
"you connect to the <application>PostgreSQL</application> server, you will be "
31654
"at a SQL prompt. You can run the following SQL command at the "
31655
"<application>psql</application> prompt to configure the password for the "
31656
"user <emphasis role=\"italics\">postgres</emphasis>."
31657
msgstr ""
31658
31659
#: serverguide/C/databases.xml:372(command)
31660
msgid "ALTER USER postgres with encrypted password 'your_password';"
31661
msgstr ""
31662
31663
#: serverguide/C/databases.xml:374(para)
31664
msgid ""
31665
"After configuring the password, edit the file "
31666
"<filename>/etc/postgresql/9.5/main/pg_hba.conf</filename> to use "
31667
"<emphasis>MD5</emphasis> authentication with the "
31668
"<emphasis>postgres</emphasis> user:"
31669
msgstr ""
31670
31671
#: serverguide/C/databases.xml:380(programlisting)
31672
#, no-wrap
31673
msgid ""
31674
"\n"
31675
"local all postgres md5\n"
31676
msgstr ""
31677
31678
#: serverguide/C/databases.xml:384(para)
31679
msgid ""
31680
"Finally, you should restart the <application>PostgreSQL</application> "
31681
"service to initialize the new configuration. From a terminal prompt enter "
31682
"the following to restart <application>PostgreSQL</application>:"
31683
msgstr ""
31684
31685
#: serverguide/C/databases.xml:390(command)
31686
msgid "sudo systemctl restart postgresql.service"
31687
msgstr ""
31688
31689
#: serverguide/C/databases.xml:393(para)
31690
msgid ""
31691
"The above configuration is not complete by any means. Please refer to the "
31692
"<ulink url=\"http://www.postgresql.org/docs/current/static/admin.html\"> "
31693
"PostgreSQL Administrator's Guide</ulink> to configure more parameters."
31694
msgstr ""
31695
31696
#: serverguide/C/databases.xml:399(para)
31697
msgid ""
31698
"You can test server connections from other machines by using the "
31699
"<application>PostgreSQL</application> client."
31700
msgstr ""
31701
31702
#: serverguide/C/databases.xml:403(command)
31703
msgid "sudo apt install postgresql-client"
31704
msgstr ""
31705
31706
#: serverguide/C/databases.xml:404(command)
31707
msgid "psql -h postgres.example.com -U postgres -W"
31708
msgstr ""
31709
31710
#: serverguide/C/databases.xml:407(para)
31711
msgid "Replace the domain name with your actual server domain name."
31712
msgstr ""
31713
31714
#: serverguide/C/databases.xml:413(title) serverguide/C/backups.xml:11(title)
31715
msgid "Backups"
31716
msgstr ""
31717
31718
#: serverguide/C/databases.xml:414(para)
31719
msgid ""
31720
"<application>PostgreSQL</application> databases should be backed up "
31721
"regularly. Refer to the <ulink "
31722
"url=\"http://www.postgresql.org/docs/current/static/backup.html\">PostgreSQL "
31723
"Administrator's Guide</ulink> for different approaches."
31724
msgstr ""
31725
31726
#: serverguide/C/databases.xml:422(para)
31727
msgid ""
31728
"As mentioned above the <ulink "
31729
"url=\"http://www.postgresql.org/docs/current/static/admin.html\">PostgreSQL "
31730
"Administrator's Guide</ulink> is an excellent resource. The guide is also "
31731
"available in the <application>postgresql-doc-9.5</application> package. "
31732
"Execute the following in a terminal to install the package:"
31733
msgstr ""
31734
31735
#: serverguide/C/databases.xml:428(command)
31736
msgid "sudo apt install postgresql-doc-9.5"
31737
msgstr ""
31738
31739
#: serverguide/C/databases.xml:430(para)
31740
msgid ""
31741
"To view the guide enter <command>file:///usr/share/doc/postgresql-doc-"
31742
"9.5/html/index.html</command> into the address bar of your browser."
31743
msgstr ""
31744
31745
#: serverguide/C/databases.xml:436(para)
31746
msgid ""
31747
"For general SQL information see <ulink "
31748
"url=\"http://www.informit.com/store/product.aspx?isbn=0768664128\">Using SQL "
31749
"Special Edition</ulink> by Rafe Colburn."
31750
msgstr ""
31751
31752
#: serverguide/C/databases.xml:442(para)
31753
msgid ""
31754
"Also, see the <ulink "
31755
"url=\"https://help.ubuntu.com/community/PostgreSQL\">PostgreSQL Ubuntu "
31756
"Wiki</ulink> page for more information."
31757
msgstr ""
31758
31759
#: serverguide/C/clustering.xml:11(title)
31760
msgid "Clustering"
31761
msgstr ""
31762
31763
#: serverguide/C/clustering.xml:14(title)
31764
msgid "DRBD"
31765
msgstr ""
31766
31767
#: serverguide/C/clustering.xml:16(para)
31768
msgid ""
31769
"Distributed Replicated Block Device (DRBD) mirrors block devices between "
31770
"multiple hosts. The replication is transparent to other applications on the "
31771
"host systems. Any block device hard disks, partitions, RAID devices, logical "
31772
"volumes, etc can be mirrored."
31773
msgstr ""
31774
31775
#: serverguide/C/clustering.xml:22(para)
31776
msgid ""
31777
"To get started using <application>drbd</application>, first install the "
31778
"necessary packages. From a terminal enter:"
31779
msgstr ""
31780
31781
#: serverguide/C/clustering.xml:27(command)
31782
msgid "sudo apt install drbd8-utils"
31783
msgstr ""
31784
31785
#: serverguide/C/clustering.xml:31(para)
31786
msgid ""
31787
"If you are using the <emphasis>virtual kernel</emphasis> as part of a "
31788
"virtual machine you will need to manually compile the "
31789
"<application>drbd</application> module. It may be easier to install the "
31790
"<application>linux-server</application> package inside the virtual machine."
31791
msgstr ""
31792
31793
#: serverguide/C/clustering.xml:38(para)
31794
msgid ""
31795
"This section covers setting up a <application>drbd</application> to "
31796
"replicate a separate <filename>/srv</filename> partition, with an "
31797
"<application>ext3</application> filesystem between two hosts. The partition "
31798
"size is not particularly relevant, but both partitions need to be the same "
31799
"size."
31800
msgstr ""
31801
31802
#: serverguide/C/clustering.xml:47(para)
31803
msgid ""
31804
"The two hosts in this example will be called <emphasis>drbd01</emphasis> and "
31805
"<emphasis>drbd02</emphasis>. They will need to have name resolution "
31806
"configured either through DNS or the <filename>/etc/hosts</filename> file. "
31807
"See <xref linkend=\"dns\"/> for details."
31808
msgstr ""
31809
31810
#: serverguide/C/clustering.xml:55(para)
31811
msgid ""
31812
"To configure <application>drbd</application>, on the first host edit "
31813
"<filename>/etc/drbd.conf</filename>:"
31814
msgstr ""
31815
31816
#: serverguide/C/clustering.xml:59(programlisting)
31817
#, no-wrap
31818
msgid ""
31819
"\n"
31820
"global { usage-count no; }\n"
31821
"common { syncer { rate 100M; } }\n"
31822
"resource r0 {\n"
31823
" protocol C;\n"
31824
" startup {\n"
31825
" wfc-timeout 15;\n"
31826
" degr-wfc-timeout 60;\n"
31827
" }\n"
31828
" net {\n"
31829
" cram-hmac-alg sha1;\n"
31830
" shared-secret \"secret\";\n"
31831
" }\n"
31832
" on drbd01 {\n"
31833
" device /dev/drbd0;\n"
31834
" disk /dev/sdb1;\n"
31835
" address 192.168.0.1:7788;\n"
31836
" meta-disk internal;\n"
31837
" }\n"
31838
" on drbd02 {\n"
31839
" device /dev/drbd0;\n"
31840
" disk /dev/sdb1;\n"
31841
" address 192.168.0.2:7788;\n"
31842
" meta-disk internal;\n"
31843
" }\n"
31844
"} \n"
31845
msgstr ""
31846
31847
#: serverguide/C/clustering.xml:88(para)
31848
msgid ""
31849
"There are many other options in <filename>/etc/drbd.conf</filename>, but for "
31850
"this example their default values are fine."
31851
msgstr ""
31852
31853
#: serverguide/C/clustering.xml:96(para)
31854
msgid "Now copy <filename>/etc/drbd.conf</filename> to the second host:"
31855
msgstr ""
31856
31857
#: serverguide/C/clustering.xml:101(command)
31858
msgid "scp /etc/drbd.conf drbd02:~"
31859
msgstr ""
31860
31861
#: serverguide/C/clustering.xml:107(para)
31862
msgid ""
31863
"And, on <emphasis>drbd02</emphasis> move the file to "
31864
"<filename>/etc</filename>:"
31865
msgstr ""
31866
31867
#: serverguide/C/clustering.xml:112(command)
31868
msgid "sudo mv drbd.conf /etc/"
31869
msgstr ""
31870
31871
#: serverguide/C/clustering.xml:118(para)
31872
msgid ""
31873
"Now using the <application>drbdadm</application> utility initialize the meta "
31874
"data storage. On each server execute:"
31875
msgstr ""
31876
31877
#: serverguide/C/clustering.xml:124(command)
31878
msgid "sudo drbdadm create-md r0"
31879
msgstr ""
31880
31881
#: serverguide/C/clustering.xml:130(para)
31882
msgid ""
31883
"Next, on both hosts, start the <application>drbd</application> daemon:"
31884
msgstr ""
31885
31886
#: serverguide/C/clustering.xml:135(command)
31887
msgid "sudo systemctl start drbd.service"
31888
msgstr ""
31889
31890
#: serverguide/C/clustering.xml:141(para)
31891
msgid ""
31892
"On the <emphasis>drbd01</emphasis>, or whichever host you wish to be the "
31893
"primary, enter the following:"
31894
msgstr ""
31895
31896
#: serverguide/C/clustering.xml:146(command)
31897
msgid "sudo drbdadm -- --overwrite-data-of-peer primary all"
31898
msgstr ""
31899
31900
#: serverguide/C/clustering.xml:152(para)
31901
msgid ""
31902
"After executing the above command, the data will start syncing with the "
31903
"secondary host. To watch the progress, on <emphasis>drbd02</emphasis> enter "
31904
"the following:"
31905
msgstr ""
31906
31907
#: serverguide/C/clustering.xml:158(command)
31908
msgid "watch -n1 cat /proc/drbd"
31909
msgstr ""
31910
31911
#: serverguide/C/clustering.xml:161(para)
31912
msgid "To stop watching the output press <emphasis>Ctrl+c</emphasis>."
31913
msgstr ""
31914
31915
#: serverguide/C/clustering.xml:168(para)
31916
msgid ""
31917
"Finally, add a filesystem to <filename>/dev/drbd0</filename> and mount it:"
31918
msgstr ""
31919
31920
#: serverguide/C/clustering.xml:173(command)
31921
msgid "sudo mkfs.ext3 /dev/drbd0"
31922
msgstr ""
31923
31924
#: serverguide/C/clustering.xml:174(command) serverguide/C/clustering.xml:222(command)
31925
msgid "sudo mount /dev/drbd0 /srv"
31926
msgstr ""
31927
31928
#: serverguide/C/clustering.xml:184(para)
31929
msgid ""
31930
"To test that the data is actually syncing between the hosts copy some files "
31931
"on the <emphasis>drbd01</emphasis>, the primary, to "
31932
"<filename>/srv</filename>:"
31933
msgstr ""
31934
31935
#: serverguide/C/clustering.xml:193(para)
31936
msgid "Next, unmount <filename>/srv</filename>:"
31937
msgstr ""
31938
31939
#: serverguide/C/clustering.xml:201(para)
31940
msgid ""
31941
"<emphasis>Demote</emphasis> the <emphasis>primary</emphasis> server to the "
31942
"<emphasis>secondary</emphasis> role:"
31943
msgstr ""
31944
31945
#: serverguide/C/clustering.xml:206(command)
31946
msgid "sudo drbdadm secondary r0"
31947
msgstr ""
31948
31949
#: serverguide/C/clustering.xml:209(para)
31950
msgid ""
31951
"Now on the <emphasis>secondary</emphasis> server "
31952
"<emphasis>promote</emphasis> it to the <emphasis>primary</emphasis> role:"
31953
msgstr ""
31954
31955
#: serverguide/C/clustering.xml:214(command)
31956
msgid "sudo drbdadm primary r0"
31957
msgstr ""
31958
31959
#: serverguide/C/clustering.xml:217(para)
31960
msgid "Lastly, mount the partition:"
31961
msgstr ""
31962
31963
#: serverguide/C/clustering.xml:225(para)
31964
msgid ""
31965
"Using <emphasis>ls</emphasis> you should see "
31966
"<filename>/srv/default</filename> copied from the former "
31967
"<emphasis>primary</emphasis> host <emphasis>drbd01</emphasis>."
31968
msgstr ""
31969
31970
#: serverguide/C/clustering.xml:236(para)
31971
msgid ""
31972
"For more information on <application>DRBD</application> see the <ulink "
31973
"url=\"http://www.drbd.org/\">DRBD web site</ulink>."
31974
msgstr ""
31975
31976
#: serverguide/C/clustering.xml:241(para)
31977
msgid ""
31978
"The <ulink "
31979
"url=\"http://manpages.ubuntu.com/manpages/xenial/en/man5/drbd.conf.5.html\">d"
31980
"rbd.conf man page</ulink> contains details on the options not covered in "
31981
"this guide."
31982
msgstr ""
31983
31984
#: serverguide/C/clustering.xml:247(para)
31985
msgid ""
31986
"Also, see the <ulink "
31987
"url=\"http://manpages.ubuntu.com/manpages/xenial/en/man8/drbdadm.8.html\">drb"
31988
"dadm man page</ulink>."
31989
msgstr ""
31990
31991
#: serverguide/C/clustering.xml:252(para)
31992
msgid ""
31993
"The <ulink url=\"https://help.ubuntu.com/community/DRBD\">DRBD Ubuntu "
31994
"Wiki</ulink> page also has more information."
31995
msgstr ""
31996
31997
#: serverguide/C/chat.xml:11(title)
31998
msgid "Chat Applications"
31999
msgstr ""
32000
32001
#: serverguide/C/chat.xml:17(para)
32002
msgid ""
32003
"In this section, we will discuss how to install and configure a IRC server, "
32004
"<application>ircd-irc2</application>. We will also discuss how to install "
32005
"and configure Jabber, an instance messaging server."
32006
msgstr ""
32007
32008
#: serverguide/C/chat.xml:26(title)
32009
msgid "IRC Server"
32010
msgstr ""
32011
32012
#: serverguide/C/chat.xml:28(para)
32013
msgid ""
32014
"The Ubuntu repository has many Internet Relay Chat servers. This section "
32015
"explains how to install and configure the original IRC server "
32016
"<application>ircd-irc2</application>."
32017
msgstr ""
32018
32019
#: serverguide/C/chat.xml:37(para)
32020
msgid ""
32021
"To install <application>ircd-irc2</application>, run the following command "
32022
"in the command prompt:"
32023
msgstr ""
32024
32025
#: serverguide/C/chat.xml:43(command)
32026
msgid "sudo apt install ircd-irc2"
32027
msgstr ""
32028
32029
#: serverguide/C/chat.xml:46(para)
32030
msgid ""
32031
"The configuration files are stored in <filename>/etc/ircd</filename> "
32032
"directory. The documents are available in <filename>/usr/share/doc/ircd-"
32033
"irc2</filename> directory."
32034
msgstr ""
32035
32036
#: serverguide/C/chat.xml:57(para)
32037
msgid ""
32038
"The IRC settings can be done in the configuration file "
32039
"<filename>/etc/ircd/ircd.conf</filename>. You can set the IRC host name in "
32040
"this file by editing the following line:"
32041
msgstr ""
32042
32043
#: serverguide/C/chat.xml:62(programlisting)
32044
#, no-wrap
32045
msgid ""
32046
"\n"
32047
"M:irc.localhost::Debian ircd default configuration::000A\n"
32048
msgstr ""
32049
32050
#: serverguide/C/chat.xml:66(para)
32051
msgid ""
32052
"Please make sure you add DNS aliases for the IRC host name. For instance, if "
32053
"you set irc.livecipher.com as IRC host name, please make sure "
32054
"irc.livecipher.com is resolvable in your Domain Name Server. The IRC host "
32055
"name should not be same as the host name."
32056
msgstr ""
32057
32058
#: serverguide/C/chat.xml:73(para)
32059
msgid ""
32060
"The IRC admin details can be configured by editing the following line:"
32061
msgstr ""
32062
32063
#: serverguide/C/chat.xml:78(programlisting)
32064
#, no-wrap
32065
msgid ""
32066
"\n"
32067
"A:Organization, IRC dept.:Daemon <ircd@example.irc.org>:Client "
32068
"Server::IRCnet:\n"
32069
msgstr ""
32070
32071
#: serverguide/C/chat.xml:82(para)
32072
msgid ""
32073
"You should add specific lines to configure the list of IRC ports to listen "
32074
"on, to configure Operator credentials, to configure client authentication, "
32075
"etc. For details, please refer to the example configuration file "
32076
"<filename>/usr/share/doc/ircd-irc2/ircd.conf.example.gz</filename>."
32077
msgstr ""
32078
32079
#: serverguide/C/chat.xml:90(para)
32080
msgid ""
32081
"The IRC banner to be displayed in the IRC client, when the user connects to "
32082
"the server can be set in <filename>/etc/ircd/ircd.motd</filename> file."
32083
msgstr ""
32084
32085
#: serverguide/C/chat.xml:95(para)
32086
msgid ""
32087
"After making necessary changes to the configuration file, you can restart "
32088
"the IRC server using following command:"
32089
msgstr ""
32090
32091
#: serverguide/C/chat.xml:101(command)
32092
msgid "sudo systemctl restart ircd-irc2.service"
32093
msgstr ""
32094
32095
#: serverguide/C/chat.xml:108(para)
32096
msgid ""
32097
"You may also be interested to take a look at other IRC servers available in "
32098
"Ubuntu Repository. It includes, <application>ircd-ircu</application> and "
32099
"<application>ircd-hybrid</application>."
32100
msgstr ""
32101
32102
#: serverguide/C/chat.xml:116(para)
32103
msgid ""
32104
"Refer to <ulink url=\"http://www.irc.org/tech_docs/ircnet/faq.html\">IRCD "
32105
"FAQ</ulink> for more details about the IRC Server."
32106
msgstr ""
32107
32108
#: serverguide/C/chat.xml:126(title)
32109
msgid "Jabber Instant Messaging Server"
32110
msgstr ""
32111
32112
#: serverguide/C/chat.xml:128(para)
32113
msgid ""
32114
"<emphasis>Jabber</emphasis> a popular instant message protocol is based on "
32115
"XMPP, an open standard for instant messaging, and used by many popular "
32116
"applications. This section covers setting up a <emphasis>Jabberd "
32117
"2</emphasis> server on a local LAN. This configuration can also be adapted "
32118
"to providing messaging services to users over the Internet."
32119
msgstr ""
32120
32121
#: serverguide/C/chat.xml:137(para)
32122
msgid "To install <application>jabberd2</application>, in a terminal enter:"
32123
msgstr ""
32124
32125
#: serverguide/C/chat.xml:142(command)
32126
msgid "sudo apt install jabberd2"
32127
msgstr ""
32128
32129
#: serverguide/C/chat.xml:149(para)
32130
msgid ""
32131
"A couple of XML configuration files will be used to configure "
32132
"<application>jabberd2</application> for <emphasis>Berkeley DB</emphasis> "
32133
"user authentication. This is a very simple form of authentication. However, "
32134
"<application>jabberd2</application> can be configured to use LDAP, MySQL, "
32135
"PostgreSQL, etc for for user authentication."
32136
msgstr ""
32137
32138
#: serverguide/C/chat.xml:156(para)
32139
msgid "First, edit <filename>/etc/jabberd2/sm.xml</filename> changing:"
32140
msgstr ""
32141
32142
#: serverguide/C/chat.xml:160(programlisting)
32143
#, no-wrap
32144
msgid ""
32145
"\n"
32146
" <id>jabber.example.com</id>\n"
32147
msgstr ""
32148
32149
#: serverguide/C/chat.xml:165(para)
32150
msgid ""
32151
"Replace <emphasis>jabber.example.com</emphasis> with the hostname, or other "
32152
"id, of your server."
32153
msgstr ""
32154
32155
#: serverguide/C/chat.xml:170(para)
32156
msgid "Now in the <storage> section change the <driver> to:"
32157
msgstr ""
32158
32159
#: serverguide/C/chat.xml:174(programlisting)
32160
#, no-wrap
32161
msgid ""
32162
"\n"
32163
" <driver>db</driver>\n"
32164
msgstr ""
32165
32166
#: serverguide/C/chat.xml:178(para)
32167
msgid ""
32168
"Next, edit <filename>/etc/jabberd2/c2s.xml</filename> in the "
32169
"<emphasis><local></emphasis> section change:"
32170
msgstr ""
32171
32172
#: serverguide/C/chat.xml:182(programlisting)
32173
#, no-wrap
32174
msgid ""
32175
"\n"
32176
" <id>jabber.example.com</id>\n"
32177
msgstr ""
32178
32179
#: serverguide/C/chat.xml:186(para)
32180
msgid ""
32181
"And in the <authreg> section adjust the <module> section to:"
32182
msgstr ""
32183
32184
#: serverguide/C/chat.xml:190(programlisting)
32185
#, no-wrap
32186
msgid ""
32187
"\n"
32188
" <module>db</module>\n"
32189
msgstr ""
32190
32191
#: serverguide/C/chat.xml:194(para)
32192
msgid ""
32193
"Finally, restart <application>jabberd2</application> to enable the new "
32194
"settings:"
32195
msgstr ""
32196
32197
#: serverguide/C/chat.xml:199(command)
32198
msgid "sudo systemctl restart jabberd2.service"
32199
msgstr ""
32200
32201
#: serverguide/C/chat.xml:202(para)
32202
msgid ""
32203
"You should now be able to connect to the server using a Jabber client like "
32204
"<application>Pidgin</application> for example."
32205
msgstr ""
32206
32207
#: serverguide/C/chat.xml:207(para)
32208
msgid ""
32209
"The advantage of using Berkeley DB for user data is that after being "
32210
"configured no additional maintenance is required. If you need more control "
32211
"over user accounts and credentials another authentication method is "
32212
"recommended."
32213
msgstr ""
32214
32215
#: serverguide/C/chat.xml:219(para)
32216
msgid ""
32217
"The <ulink url=\"http://codex.xiaoka.com/wiki/jabberd2:start\">Jabberd2 Web "
32218
"Site</ulink> contains more details on configuring "
32219
"<application>Jabberd2</application>."
32220
msgstr ""
32221
32222
#: serverguide/C/chat.xml:225(para)
32223
msgid ""
32224
"For more authentication options see the <ulink "
32225
"url=\"http://www.jabberdoc.org/\">Jabberd2 Install Guide</ulink>."
32226
msgstr ""
32227
32228
#: serverguide/C/chat.xml:230(para)
32229
msgid ""
32230
"Also, the <ulink "
32231
"url=\"https://help.ubuntu.com/community/SettingUpJabberServer\">Setting Up "
32232
"Jabber Server Ubuntu Wiki</ulink> page has more information."
32233
msgstr ""
32234
32235
#: serverguide/C/cgroups.xml:13(para)
32236
msgid ""
32237
"Control groups (cgroups) are a kernel mechanism for grouping, tracking, and "
32238
"limiting the resource usage of tasks. The kernel-provided administration "
32239
"interface is through a virtual filesystem. Higher level cgroup "
32240
"administration tools have been developed, including libcgroup and lmctfy. "
32241
"Additionally, there is guidance at freedesktop.org for how applications can "
32242
"best cooperate using the cgroup filesystem interface (see Resources)."
32243
msgstr ""
32244
32245
#: serverguide/C/cgroups.xml:23(para)
32246
msgid ""
32247
"As of Ubuntu 14.04, the cgroup manager (cgmanager) is available as another "
32248
"cgroup administion interface. It's goal is to respond to dbus requests from "
32249
"any user, allowing him to administer only those cgroups which have been "
32250
"delegated to him."
32251
msgstr ""
32252
32253
#: serverguide/C/cgroups.xml:30(para)
32254
msgid ""
32255
"<xref linkend=\"cgroups-overview\"/> will describe cgroups in more detail. "
32256
"<xref linkend=\"cgroups-fs\"/> will describe the long-standing cgroups "
32257
"filesystem interface. <xref linkend=\"cgroups-manager\"/> will describe the "
32258
"cgroup manager."
32259
msgstr ""
32260
32261
#: serverguide/C/cgroups.xml:40(para)
32262
msgid ""
32263
"Cgroups are the generalized feature for grouping tasks. The actual resource "
32264
"tracking and limits are implemented by subsystems. A hierarchy is a set of "
32265
"subsystems mounted together. For instance, if the memory and devices "
32266
"subsystems are mounted together under /sys/fs/cgroups/set1, then any task "
32267
"which is in \"/child1\" will be subject to the corresponding limits of both "
32268
"subsystems."
32269
msgstr ""
32270
32271
#: serverguide/C/cgroups.xml:49(para)
32272
msgid ""
32273
"Each set of mounted subsystems consittutes a 'hierarchy'. With exceptions, "
32274
"cgroups which are children of \"/child1\" will be subject to all limits "
32275
"placed on \"/child1\", and their resource usage will be accounted to "
32276
"\"/child1\"."
32277
msgstr ""
32278
32279
#: serverguide/C/cgroups.xml:56(para)
32280
msgid "The existing subsystems include:"
32281
msgstr ""
32282
32283
#: serverguide/C/cgroups.xml:61(para)
32284
msgid ""
32285
"<emphasis>cpusets</emphasis>: fascilitate assigning a set of CPUS and memory "
32286
"nodes to cgroups. Tasks in a cpuset cgroup may only be scheduled on CPUS "
32287
"assigned to that cpuset."
32288
msgstr ""
32289
32290
#: serverguide/C/cgroups.xml:65(para)
32291
msgid "<emphasis> blkio </emphasis>: limits per-cgroup block io."
32292
msgstr ""
32293
32294
#: serverguide/C/cgroups.xml:66(para)
32295
msgid ""
32296
"<emphasis> cpuacct </emphasis>: provides per-cgroup cpu usage accounting."
32297
msgstr ""
32298
32299
#: serverguide/C/cgroups.xml:67(para)
32300
msgid ""
32301
"<emphasis> devices </emphasis>: controls the ability of tasks to create or "
32302
"use devices nodes using either a blacklist or whitelist."
32303
msgstr ""
32304
32305
#: serverguide/C/cgroups.xml:69(para)
32306
msgid ""
32307
"<emphasis> freezer </emphasis>: provides a way to 'freeze' and 'thaw' whole "
32308
"cgroups. Tasks in the cgroup will not be scheduled while they are frozen."
32309
msgstr ""
32310
32311
#: serverguide/C/cgroups.xml:71(para)
32312
msgid ""
32313
"<emphasis> hugetlb </emphasis>: fascilitates limiting hugetlb usage per "
32314
"cgroup."
32315
msgstr ""
32316
32317
#: serverguide/C/cgroups.xml:72(para)
32318
msgid ""
32319
"<emphasis> memory </emphasis>: allows memory, kernel memory, and swap usage "
32320
"to be tracked and limited."
32321
msgstr ""
32322
32323
#: serverguide/C/cgroups.xml:74(para)
32324
msgid ""
32325
"<emphasis> net_cls </emphasis>: provides an interface for tagging packets "
32326
"based on the sender cgroup. These tags can then be used by tc (traffic "
32327
"controller) to assign priorities."
32328
msgstr ""
32329
32330
#: serverguide/C/cgroups.xml:77(para)
32331
msgid ""
32332
"<emphasis> net_prio </emphasis>: allows setting network traffic priority on "
32333
"a per-cgroup basis."
32334
msgstr ""
32335
32336
#: serverguide/C/cgroups.xml:79(para)
32337
msgid ""
32338
"<emphasis> cpu </emphasis>: enables setting of scheduling preferences on per-"
32339
"cgroup basis."
32340
msgstr ""
32341
32342
#: serverguide/C/cgroups.xml:80(para)
32343
msgid ""
32344
"<emphasis> perf_event </emphasis>: enables per-cpu mode to monitor only "
32345
"threads in certain cgroups."
32346
msgstr ""
32347
32348
#: serverguide/C/cgroups.xml:84(para)
32349
msgid ""
32350
"In addition, named cgroups can be created with no bound subsystems for the "
32351
"sake of process tracking. As an example, systemd does this to track services "
32352
"and user sessions."
32353
msgstr ""
32354
32355
#: serverguide/C/cgroups.xml:93(title)
32356
msgid "Filesystem"
32357
msgstr ""
32358
32359
#: serverguide/C/cgroups.xml:95(para)
32360
msgid ""
32361
"A hierarchy is created by mounting an instance of the cgroup filesystem with "
32362
"each of the desired subsystems listed as a mount option. For instance,"
32363
msgstr ""
32364
32365
#: serverguide/C/cgroups.xml:100(command)
32366
msgid "mount -t cgroup -o devices,memory,freezer cgroup /cgroup1"
32367
msgstr ""
32368
32369
#: serverguide/C/cgroups.xml:104(para)
32370
msgid ""
32371
"would instantiate a hierarchy with the devices and memory cgroups comounted. "
32372
"A child cgroup \"child1\" can be created using 'mkdir'"
32373
msgstr ""
32374
32375
#: serverguide/C/cgroups.xml:109(command)
32376
msgid "mkdir /cgroup1/child1"
32377
msgstr ""
32378
32379
#: serverguide/C/cgroups.xml:113(para)
32380
msgid ""
32381
"and tasks can be moved into the new child cgroup by writing their process "
32382
"IDs into the 'tasks' or 'cgroup.procs' file:"
32383
msgstr ""
32384
32385
#: serverguide/C/cgroups.xml:118(command)
32386
msgid "sleep 100 & echo $! > /cgroup1/child1/cgroup.procs"
32387
msgstr ""
32388
32389
#: serverguide/C/cgroups.xml:123(para)
32390
msgid ""
32391
"Other administration is done through files in the cgroup directories. For "
32392
"instance, to freeze all tasks in child1,"
32393
msgstr ""
32394
32395
#: serverguide/C/cgroups.xml:128(command)
32396
msgid "echo FROZEN > /cgroup1/child1/freezer.state"
32397
msgstr ""
32398
32399
#: serverguide/C/cgroups.xml:132(para)
32400
msgid ""
32401
"A great deal of information about cgroups and its subsystems can be found "
32402
"under the cgroups documentation directory in the kernel source tree (see "
32403
"Resources)."
32404
msgstr ""
32405
32406
#: serverguide/C/cgroups.xml:141(title)
32407
msgid "Delegation"
32408
msgstr ""
32409
32410
#: serverguide/C/cgroups.xml:143(para)
32411
msgid ""
32412
"Cgroup files and directories can be owned by non-root users, enabling "
32413
"delegation of cgroup administration. In general, the kernel enforces the "
32414
"hierarchical constraints on limits, so that for instance if devices cgroup "
32415
"<filename>/child1</filename> cannot access a disk drive, then "
32416
"<filename>/child1/child2</filename> cannot give itself those rights."
32417
msgstr ""
32418
32419
#: serverguide/C/cgroups.xml:151(para)
32420
msgid ""
32421
"As of Ubuntu 14.04, users are automatically placed in a set of cgroups which "
32422
"they own, safely allowing them to contrain their own jobs using child "
32423
"cgroups. This feature is relied upon, for instance, for unprivileged "
32424
"container creation in lxc."
32425
msgstr ""
32426
32427
#: serverguide/C/cgroups.xml:161(title)
32428
msgid "Manager"
32429
msgstr ""
32430
32431
#: serverguide/C/cgroups.xml:163(para)
32432
msgid ""
32433
"The cgroup manager (cgmanager) provides a D-Bus service allowing programs "
32434
"and users to administer cgroups without needing direct knowledge of or "
32435
"access to the cgroup filesystem. For requests from tasks in the same "
32436
"namespaces as the manager, the manager can directly perform the needed "
32437
"security checks to ensure that requests are legitimate. For other requests - "
32438
"such as those from a task in a container - enhanced D-Bus requests must be "
32439
"made, where process-, user- and group-ids are passed as SCM_CREDENTIALS, so "
32440
"that the kernel maps the identifiers to their global host values."
32441
msgstr ""
32442
32443
#: serverguide/C/cgroups.xml:175(para)
32444
msgid ""
32445
"To fascilitate the use of simple D-Bus calls from all users, a 'cgroup "
32446
"manager proxy' (cgproxy) is automatically started when in a container. The "
32447
"proxy accepts standard D-Bus requests from tasks in the same namespaces as "
32448
"itself, and converts them to SCM-enhanced D-Bus requests which it passes on "
32449
"to the cgmanager."
32450
msgstr ""
32451
32452
#: serverguide/C/cgroups.xml:183(para)
32453
msgid ""
32454
"A simple example of creating a new cgroup in which to run a cpu-intensive "
32455
"compile would look like:"
32456
msgstr ""
32457
32458
#: serverguide/C/cgroups.xml:188(command)
32459
msgid ""
32460
"cgm create cpuset build1 cgm movepid cpuset build1 $$ cgm setvalue cpuset "
32461
"build1 cpuset.cpus 1 make"
32462
msgstr ""
32463
32464
#: serverguide/C/cgroups.xml:204(ulink)
32465
msgid "cgm"
32466
msgstr ""
32467
32468
#: serverguide/C/cgroups.xml:205(ulink)
32469
msgid "cgconfig.conf"
32470
msgstr ""
32471
32472
#: serverguide/C/cgroups.xml:206(ulink)
32473
msgid "cgmanager"
32474
msgstr ""
32475
32476
#: serverguide/C/cgroups.xml:207(ulink)
32477
msgid "cgproxy"
32478
msgstr ""
32479
32480
#: serverguide/C/cgroups.xml:212(para)
32481
msgid ""
32482
"The upstream cgmanager project is hosted at <ulink "
32483
"url=\"http://cgmanager.linuxcontainers.org\">linuxcontainers.org</ulink>."
32484
msgstr ""
32485
32486
#: serverguide/C/cgroups.xml:217(para)
32487
msgid ""
32488
"The upstream kernel documentation page on cgroups can be seen <ulink "
32489
"url=\"https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Do"
32490
"cumentation/cgroups\">here </ulink>."
32491
msgstr ""
32492
32493
#: serverguide/C/cgroups.xml:223(para)
32494
msgid ""
32495
"The freedesktop.org control group usage guidelines can be seen <ulink "
32496
"url=\"http://www.freedesktop.org/wiki/Software/systemd/PaxControlGroups/\">he"
32497
"re</ulink>."
32498
msgstr ""
32499
32500
#: serverguide/C/backups.xml:12(para)
32501
msgid ""
32502
"There are many ways to backup an Ubuntu installation. The most important "
32503
"thing about backups is to develop a <emphasis>backup plan</emphasis> "
32504
"consisting of what to backup, where to back it up to, and how to restore it."
32505
msgstr ""
32506
32507
#: serverguide/C/backups.xml:16(para)
32508
msgid ""
32509
"The following sections discuss various ways of accomplishing these tasks."
32510
msgstr ""
32511
32512
#: serverguide/C/backups.xml:20(title)
32513
msgid "Shell Scripts"
32514
msgstr ""
32515
32516
#: serverguide/C/backups.xml:21(para)
32517
msgid ""
32518
"One of the simplest ways to backup a system is using a <emphasis>shell "
32519
"script</emphasis>. For example, a script can be used to configure which "
32520
"directories to backup, and pass those directories as arguments to the "
32521
"<application>tar</application> utility, which creates an archive file. The "
32522
"archive file can then be moved or copied to another location. The archive "
32523
"can also be created on a remote file system such as an "
32524
"<emphasis>NFS</emphasis> mount."
32525
msgstr ""
32526
32527
#: serverguide/C/backups.xml:27(para)
32528
msgid ""
32529
"The <application>tar</application> utility creates one archive file out of "
32530
"many files or directories. <application>tar</application> can also filter "
32531
"the files through compression utilities, thus reducing the size of the "
32532
"archive file."
32533
msgstr ""
32534
32535
#: serverguide/C/backups.xml:33(title)
32536
msgid "Simple Shell Script"
32537
msgstr ""
32538
32539
#: serverguide/C/backups.xml:34(para)
32540
msgid ""
32541
"The following shell script uses <application>tar</application> to create an "
32542
"archive file on a remotely mounted NFS file system. The archive filename is "
32543
"determined using additional command line utilities."
32544
msgstr ""
32545
32546
#: serverguide/C/backups.xml:38(programlisting)
32547
#, no-wrap
32548
msgid ""
32549
"\n"
32550
"#!/bin/bash\n"
32551
"####################################\n"
32552
"#\n"
32553
"# Backup to NFS mount script.\n"
32554
"#\n"
32555
"####################################\n"
32556
"\n"
32557
"# What to backup. \n"
32558
"backup_files=\"/home /var/spool/mail /etc /root /boot /opt\"\n"
32559
"\n"
32560
"# Where to backup to.\n"
32561
"dest=\"/mnt/backup\"\n"
32562
"\n"
32563
"# Create archive filename.\n"
32564
"day=$(date +%A)\n"
32565
"hostname=$(hostname -s)\n"
32566
"archive_file=\"$hostname-$day.tgz\"\n"
32567
"\n"
32568
"# Print start status message.\n"
32569
"echo \"Backing up $backup_files to $dest/$archive_file\"\n"
32570
"date\n"
32571
"echo\n"
32572
"\n"
32573
"# Backup the files using tar.\n"
32574
"tar czf $dest/$archive_file $backup_files\n"
32575
"\n"
32576
"# Print end status message.\n"
32577
"echo\n"
32578
"echo \"Backup finished\"\n"
32579
"date\n"
32580
"\n"
32581
"# Long listing of files in $dest to check file sizes.\n"
32582
"ls -lh $dest\n"
32583
msgstr ""
32584
32585
#: serverguide/C/backups.xml:75(para)
32586
msgid ""
32587
"<emphasis>$backup_files:</emphasis> a variable listing which directories you "
32588
"would like to backup. The list should be customized to fit your needs."
32589
msgstr ""
32590
32591
#: serverguide/C/backups.xml:81(para)
32592
msgid ""
32593
"<emphasis>$day:</emphasis> a variable holding the day of the week (Monday, "
32594
"Tuesday, Wednesday, etc). This is used to create an archive file for each "
32595
"day of the week, giving a backup history of seven days. There are other ways "
32596
"to accomplish this including using the <application>date</application> "
32597
"utility."
32598
msgstr ""
32599
32600
#: serverguide/C/backups.xml:88(para)
32601
msgid ""
32602
"<emphasis>$hostname:</emphasis> variable containing the "
32603
"<emphasis>short</emphasis> hostname of the system. Using the hostname in the "
32604
"archive filename gives you the option of placing daily archive files from "
32605
"multiple systems in the same directory."
32606
msgstr ""
32607
32608
#: serverguide/C/backups.xml:95(para)
32609
msgid "<emphasis>$archive_file:</emphasis> the full archive filename."
32610
msgstr ""
32611
32612
#: serverguide/C/backups.xml:100(para)
32613
msgid ""
32614
"<emphasis>$dest:</emphasis> destination of the archive file. The directory "
32615
"needs to be created and in this case <emphasis>mounted</emphasis> before "
32616
"executing the backup script. See <xref linkend=\"network-file-system\"/> for "
32617
"details of using <emphasis>NFS</emphasis>."
32618
msgstr ""
32619
32620
#: serverguide/C/backups.xml:107(para)
32621
msgid ""
32622
"<emphasis>status messages:</emphasis> optional messages printed to the "
32623
"console using the <application>echo</application> utility."
32624
msgstr ""
32625
32626
#: serverguide/C/backups.xml:113(para)
32627
msgid ""
32628
"<emphasis>tar czf $dest/$archive_file $backup_files:</emphasis> the "
32629
"<application>tar</application> command used to create the archive file."
32630
msgstr ""
32631
32632
#: serverguide/C/backups.xml:119(para)
32633
msgid "<emphasis>c:</emphasis> creates an archive."
32634
msgstr ""
32635
32636
#: serverguide/C/backups.xml:124(para)
32637
msgid ""
32638
"<emphasis>z:</emphasis> filter the archive through the "
32639
"<application>gzip</application> utility compressing the archive."
32640
msgstr ""
32641
32642
#: serverguide/C/backups.xml:129(para)
32643
msgid ""
32644
"<emphasis>f:</emphasis> output to an archive file. Otherwise the "
32645
"<application>tar</application> output will be sent to STDOUT."
32646
msgstr ""
32647
32648
#: serverguide/C/backups.xml:136(para)
32649
msgid ""
32650
"<emphasis>ls -lh $dest:</emphasis> optional statement prints a <emphasis>-"
32651
"l</emphasis> long listing in <emphasis>-h</emphasis> human readable format "
32652
"of the destination directory. This is useful for a quick file size check of "
32653
"the archive file. This check should not replace testing the archive file."
32654
msgstr ""
32655
32656
#: serverguide/C/backups.xml:143(para)
32657
msgid ""
32658
"This is a simple example of a backup shell script; however there are many "
32659
"options that can be included in such a script. See <xref linkend=\"backup-"
32660
"shellscript-references\"/> for links to resources providing more in-depth "
32661
"shell scripting information."
32662
msgstr ""
32663
32664
#: serverguide/C/backups.xml:150(title)
32665
msgid "Executing the Script"
32666
msgstr ""
32667
32668
#: serverguide/C/backups.xml:152(title)
32669
msgid "Executing from a Terminal"
32670
msgstr ""
32671
32672
#: serverguide/C/backups.xml:153(para)
32673
msgid ""
32674
"The simplest way of executing the above backup script is to copy and paste "
32675
"the contents into a file. <filename>backup.sh</filename> for example. The "
32676
"file must be made executable:"
32677
msgstr ""
32678
32679
#: serverguide/C/backups.xml:158(command)
32680
msgid "chmod u+x backup.sh"
32681
msgstr ""
32682
32683
#: serverguide/C/backups.xml:160(para)
32684
msgid "Then from a terminal prompt:"
32685
msgstr ""
32686
32687
#: serverguide/C/backups.xml:164(command)
32688
msgid "sudo ./backup.sh"
32689
msgstr ""
32690
32691
#: serverguide/C/backups.xml:166(para)
32692
msgid ""
32693
"This is a great way to test the script to make sure everything works as "
32694
"expected."
32695
msgstr ""
32696
32697
#: serverguide/C/backups.xml:171(title)
32698
msgid "Executing with cron"
32699
msgstr ""
32700
32701
#: serverguide/C/backups.xml:172(para)
32702
msgid ""
32703
"The <application>cron</application> utility can be used to automate the "
32704
"script execution. The <application>cron</application> daemon allows the "
32705
"execution of scripts, or commands, at a specified time and date."
32706
msgstr ""
32707
32708
#: serverguide/C/backups.xml:176(para)
32709
msgid ""
32710
"<application>cron</application> is configured through entries in a "
32711
"<filename>crontab</filename> file. <filename>crontab</filename> files are "
32712
"separated into fields:"
32713
msgstr ""
32714
32715
#: serverguide/C/backups.xml:180(programlisting)
32716
#, no-wrap
32717
msgid ""
32718
"\n"
32719
"# m h dom mon dow command\n"
32720
msgstr ""
32721
32722
#: serverguide/C/backups.xml:185(para)
32723
msgid ""
32724
"<emphasis>m:</emphasis> minute the command executes on, between 0 and 59."
32725
msgstr ""
32726
32727
#: serverguide/C/backups.xml:190(para)
32728
msgid ""
32729
"<emphasis>h:</emphasis> hour the command executes on, between 0 and 23."
32730
msgstr ""
32731
32732
#: serverguide/C/backups.xml:195(para)
32733
msgid "<emphasis>dom:</emphasis> day of month the command executes on."
32734
msgstr ""
32735
32736
#: serverguide/C/backups.xml:200(para)
32737
msgid ""
32738
"<emphasis>mon:</emphasis> the month the command executes on, between 1 and "
32739
"12."
32740
msgstr ""
32741
32742
#: serverguide/C/backups.xml:205(para)
32743
msgid ""
32744
"<emphasis>dow:</emphasis> the day of the week the command executes on, "
32745
"between 0 and 7. Sunday may be specified by using 0 or 7, both values are "
32746
"valid."
32747
msgstr ""
32748
32749
#: serverguide/C/backups.xml:210(para)
32750
msgid "<emphasis>command:</emphasis> the command to execute."
32751
msgstr ""
32752
32753
#: serverguide/C/backups.xml:215(para)
32754
msgid ""
32755
"To add or change entries in a <filename>crontab</filename> file the "
32756
"<application>crontab -e</application> command should be used. Also, the "
32757
"contents of a <filename>crontab</filename> file can be viewed using the "
32758
"<application>crontab -l</application> command."
32759
msgstr ""
32760
32761
#: serverguide/C/backups.xml:219(para)
32762
msgid ""
32763
"To execute the <application>backup.sh</application> script listed above "
32764
"using <application>cron</application>. Enter the following from a terminal "
32765
"prompt:"
32766
msgstr ""
32767
32768
#: serverguide/C/backups.xml:224(command)
32769
msgid "sudo crontab -e"
32770
msgstr ""
32771
32772
#: serverguide/C/backups.xml:227(para)
32773
msgid ""
32774
"Using <application>sudo</application> with the <application>crontab -"
32775
"e</application> command edits the <emphasis>root</emphasis> user's crontab. "
32776
"This is necessary if you are backing up directories only the root user has "
32777
"access to."
32778
msgstr ""
32779
32780
#: serverguide/C/backups.xml:232(para)
32781
msgid "Add the following entry to the <filename>crontab</filename> file:"
32782
msgstr ""
32783
32784
#: serverguide/C/backups.xml:235(programlisting)
32785
#, no-wrap
32786
msgid ""
32787
"\n"
32788
"# m h dom mon dow command\n"
32789
"0 0 * * * bash /usr/local/bin/backup.sh\n"
32790
msgstr ""
32791
32792
#: serverguide/C/backups.xml:239(para)
32793
msgid ""
32794
"The <application>backup.sh</application> script will now be executed every "
32795
"day at 12:00 am."
32796
msgstr ""
32797
32798
#: serverguide/C/backups.xml:243(para)
32799
msgid ""
32800
"The <application>backup.sh</application> script will need to be copied to "
32801
"the <filename>/usr/local/bin/</filename> directory in order for this entry "
32802
"to execute properly. The script can reside anywhere on the file system, "
32803
"simply change the script path appropriately."
32804
msgstr ""
32805
32806
#: serverguide/C/backups.xml:248(para)
32807
msgid ""
32808
"For more in-depth <application>crontab</application> options see <xref "
32809
"linkend=\"backup-shellscript-references\"/>."
32810
msgstr ""
32811
32812
#: serverguide/C/backups.xml:254(title)
32813
msgid "Restoring from the Archive"
32814
msgstr ""
32815
32816
#: serverguide/C/backups.xml:255(para)
32817
msgid ""
32818
"Once an archive has been created it is important to test the archive. The "
32819
"archive can be tested by listing the files it contains, but the best test is "
32820
"to <emphasis>restore</emphasis> a file from the archive."
32821
msgstr ""
32822
32823
#: serverguide/C/backups.xml:261(para)
32824
msgid ""
32825
"To see a listing of the archive contents. From a terminal prompt type:"
32826
msgstr ""
32827
32828
#: serverguide/C/backups.xml:265(command)
32829
msgid "tar -tzvf /mnt/backup/host-Monday.tgz"
32830
msgstr ""
32831
32832
#: serverguide/C/backups.xml:269(para)
32833
msgid "To restore a file from the archive to a different directory enter:"
32834
msgstr ""
32835
32836
#: serverguide/C/backups.xml:273(command)
32837
msgid "tar -xzvf /mnt/backup/host-Monday.tgz -C /tmp etc/hosts"
32838
msgstr ""
32839
32840
#: serverguide/C/backups.xml:275(para)
32841
msgid ""
32842
"The <emphasis>-C</emphasis> option to <application>tar</application> "
32843
"redirects the extracted files to the specified directory. The above example "
32844
"will extract the <filename>/etc/hosts</filename> file to "
32845
"<filename>/tmp/etc/hosts</filename>. <application>tar</application> "
32846
"recreates the directory structure that it contains."
32847
msgstr ""
32848
32849
#: serverguide/C/backups.xml:280(para)
32850
msgid ""
32851
"Also, notice the leading <emphasis>\"/\"</emphasis> is left off the path of "
32852
"the file to restore."
32853
msgstr ""
32854
32855
#: serverguide/C/backups.xml:285(para)
32856
msgid "To restore all files in the archive enter the following:"
32857
msgstr ""
32858
32859
#: serverguide/C/backups.xml:289(command)
32860
msgid "cd /"
32861
msgstr ""
32862
32863
#: serverguide/C/backups.xml:290(command)
32864
msgid "sudo tar -xzvf /mnt/backup/host-Monday.tgz"
32865
msgstr ""
32866
32867
#: serverguide/C/backups.xml:295(para)
32868
msgid "This will overwrite the files currently on the file system."
32869
msgstr ""
32870
32871
#: serverguide/C/backups.xml:304(para)
32872
msgid ""
32873
"For more information on shell scripting see the <ulink "
32874
"url=\"http://tldp.org/LDP/abs/html/\">Advanced Bash-Scripting Guide</ulink>"
32875
msgstr ""
32876
32877
#: serverguide/C/backups.xml:309(para)
32878
msgid ""
32879
"The book <ulink url=\"http://safari.samspublishing.com/0672323583\">Teach "
32880
"Yourself Shell Programming in 24 Hours</ulink> is available online and a "
32881
"great resource for shell scripting."
32882
msgstr ""
32883
32884
#: serverguide/C/backups.xml:315(para)
32885
msgid ""
32886
"The <ulink url=\"https://help.ubuntu.com/community/CronHowto\">CronHowto "
32887
"Wiki Page</ulink> contains details on advanced "
32888
"<application>cron</application> options."
32889
msgstr ""
32890
32891
#: serverguide/C/backups.xml:322(para)
32892
msgid ""
32893
"See the <ulink url=\"http://www.gnu.org/software/tar/manual/index.html\">GNU "
32894
"tar Manual</ulink> for more <application>tar</application> options."
32895
msgstr ""
32896
32897
#: serverguide/C/backups.xml:328(para)
32898
msgid ""
32899
"The Wikipedia <ulink "
32900
"url=\"http://en.wikipedia.org/wiki/Backup_rotation_scheme\">Backup Rotation "
32901
"Scheme</ulink> article contains information on other backup rotation schemes."
32902
msgstr ""
32903
32904
#: serverguide/C/backups.xml:334(para)
32905
msgid ""
32906
"The shell script uses <application>tar</application> to create the archive, "
32907
"but there many other command line utilities that can be used. For example:"
32908
msgstr ""
32909
32910
#: serverguide/C/backups.xml:340(para)
32911
msgid ""
32912
"<ulink url=\"http://www.gnu.org/software/cpio/\">cpio</ulink>: used to copy "
32913
"files to and from archives."
32914
msgstr ""
32915
32916
#: serverguide/C/backups.xml:345(para)
32917
msgid ""
32918
"<ulink url=\"http://www.gnu.org/software/coreutils/\">dd</ulink>: part of "
32919
"the <application>coreutils</application> package. A low level utility that "
32920
"can copy data from one format to another."
32921
msgstr ""
32922
32923
#: serverguide/C/backups.xml:351(para)
32924
msgid ""
32925
"<ulink url=\"http://www.rsnapshot.org/\">rsnapshot</ulink>: a file system "
32926
"snapshot utility used to create copies of an entire file system."
32927
msgstr ""
32928
32929
#: serverguide/C/backups.xml:357(para)
32930
msgid ""
32931
"<ulink url=\"http://www.samba.org/ftp/rsync/rsync.html\">rsync</ulink>: a "
32932
"flexible utility used to create incremental copies of files."
32933
msgstr ""
32934
32935
#: serverguide/C/backups.xml:368(title)
32936
msgid "Archive Rotation"
32937
msgstr ""
32938
32939
#: serverguide/C/backups.xml:369(para)
32940
msgid ""
32941
"The shell script in <xref linkend=\"backup-shellscripts\"/> only allows for "
32942
"seven different archives. For a server whose data doesn't change often, this "
32943
"may be enough. If the server has a large amount of data, a more complex "
32944
"rotation scheme should be used."
32945
msgstr ""
32946
32947
#: serverguide/C/backups.xml:375(title)
32948
msgid "Rotating NFS Archives"
32949
msgstr ""
32950
32951
#: serverguide/C/backups.xml:376(para)
32952
msgid ""
32953
"In this section, the shell script will be slightly modified to implement a "
32954
"grandfather-father-son rotation scheme (monthly-weekly-daily):"
32955
msgstr ""
32956
32957
#: serverguide/C/backups.xml:382(para)
32958
msgid ""
32959
"The rotation will do a <emphasis>daily</emphasis> backup Sunday through "
32960
"Friday."
32961
msgstr ""
32962
32963
#: serverguide/C/backups.xml:387(para)
32964
msgid ""
32965
"On Saturday a <emphasis>weekly</emphasis> backup is done giving you four "
32966
"weekly backups a month."
32967
msgstr ""
32968
32969
#: serverguide/C/backups.xml:392(para)
32970
msgid ""
32971
"The <emphasis>monthly</emphasis> backup is done on the first of the month "
32972
"rotating two monthly backups based on if the month is odd or even."
32973
msgstr ""
32974
32975
#: serverguide/C/backups.xml:398(para)
32976
msgid "Here is the new script:"
32977
msgstr ""
32978
32979
#: serverguide/C/backups.xml:401(programlisting)
32980
#, no-wrap
32981
msgid ""
32982
"\n"
32983
"#!/bin/bash\n"
32984
"####################################\n"
32985
"#\n"
32986
"# Backup to NFS mount script with\n"
32987
"# grandfather-father-son rotation.\n"
32988
"#\n"
32989
"####################################\n"
32990
"\n"
32991
"# What to backup. \n"
32992
"backup_files=\"/home /var/spool/mail /etc /root /boot /opt\"\n"
32993
"\n"
32994
"# Where to backup to.\n"
32995
"dest=\"/mnt/backup\"\n"
32996
"\n"
32997
"# Setup variables for the archive filename.\n"
32998
"day=$(date +%A)\n"
32999
"hostname=$(hostname -s)\n"
33000
"\n"
33001
"# Find which week of the month 1-4 it is.\n"
33002
"day_num=$(date +%-d)\n"
33003
"if (( $day_num <= 7 )); then\n"
33004
" week_file=\"$hostname-week1.tgz\"\n"
33005
"elif (( $day_num > 7 && $day_num <= 14 )); then\n"
33006
" week_file=\"$hostname-week2.tgz\"\n"
33007
"elif (( $day_num > 14 && $day_num <= 21 )); then\n"
33008
" week_file=\"$hostname-week3.tgz\"\n"
33009
"elif (( $day_num > 21 && $day_num < 32 )); then\n"
33010
" week_file=\"$hostname-week4.tgz\"\n"
33011
"fi\n"
33012
"\n"
33013
"# Find if the Month is odd or even.\n"
33014
"month_num=$(date +%m)\n"
33015
"month=$(expr $month_num % 2)\n"
33016
"if [ $month -eq 0 ]; then\n"
33017
" month_file=\"$hostname-month2.tgz\"\n"
33018
"else\n"
33019
" month_file=\"$hostname-month1.tgz\"\n"
33020
"fi\n"
33021
"\n"
33022
"# Create archive filename.\n"
33023
"if [ $day_num == 1 ]; then\n"
33024
"\tarchive_file=$month_file\n"
33025
"elif [ $day != \"Saturday\" ]; then\n"
33026
" archive_file=\"$hostname-$day.tgz\"\n"
33027
"else \n"
33028
"\tarchive_file=$week_file\n"
33029
"fi\n"
33030
"\n"
33031
"# Print start status message.\n"
33032
"echo \"Backing up $backup_files to $dest/$archive_file\"\n"
33033
"date\n"
33034
"echo\n"
33035
"\n"
33036
"# Backup the files using tar.\n"
33037
"tar czf $dest/$archive_file $backup_files\n"
33038
"\n"
33039
"# Print end status message.\n"
33040
"echo\n"
33041
"echo \"Backup finished\"\n"
33042
"date\n"
33043
"\n"
33044
"# Long listing of files in $dest to check file sizes.\n"
33045
"ls -lh $dest/\n"
33046
msgstr ""
33047
33048
#: serverguide/C/backups.xml:466(para)
33049
msgid ""
33050
"The script can be executed using the same methods as in <xref "
33051
"linkend=\"backup-executing-shellscript\"/>."
33052
msgstr ""
33053
33054
#: serverguide/C/backups.xml:469(para)
33055
msgid ""
33056
"It is good practice to take backup media off-site in case of a disaster. In "
33057
"the shell script example the backup media is another server providing an NFS "
33058
"share. In all likelihood taking the NFS server to another location would not "
33059
"be practical. Depending upon connection speeds it may be an option to copy "
33060
"the archive file over a WAN link to a server in another location."
33061
msgstr ""
33062
33063
#: serverguide/C/backups.xml:475(para)
33064
msgid ""
33065
"Another option is to copy the archive file to an external hard drive which "
33066
"can then be taken off-site. Since the price of external hard drives continue "
33067
"to decrease, it may be cost-effective to use two drives for each archive "
33068
"level. This would allow you to have one external drive attached to the "
33069
"backup server and one in another location."
33070
msgstr ""
33071
33072
#: serverguide/C/backups.xml:482(title)
33073
msgid "Tape Drives"
33074
msgstr ""
33075
33076
#: serverguide/C/backups.xml:483(para)
33077
msgid ""
33078
"A tape drive attached to the server can be used instead of an NFS share. "
33079
"Using a tape drive simplifies archive rotation, and makes taking the media "
33080
"off-site easier as well."
33081
msgstr ""
33082
33083
#: serverguide/C/backups.xml:487(para)
33084
msgid ""
33085
"When using a tape drive, the filename portions of the script aren't needed "
33086
"because the data is sent directly to the tape device. Some commands to "
33087
"manipulate the tape are needed. This is accomplished using "
33088
"<application>mt</application>, a magnetic tape control utility part of the "
33089
"<application>cpio</application> package."
33090
msgstr ""
33091
33092
#: serverguide/C/backups.xml:492(para)
33093
msgid "Here is the shell script modified to use a tape drive:"
33094
msgstr ""
33095
33096
#: serverguide/C/backups.xml:495(programlisting)
33097
#, no-wrap
33098
msgid ""
33099
"\n"
33100
"#!/bin/bash\n"
33101
"####################################\n"
33102
"#\n"
33103
"# Backup to tape drive script.\n"
33104
"#\n"
33105
"####################################\n"
33106
"\n"
33107
"# What to backup. \n"
33108
"backup_files=\"/home /var/spool/mail /etc /root /boot /opt\"\n"
33109
"\n"
33110
"# Where to backup to.\n"
33111
"dest=\"/dev/st0\"\n"
33112
"\n"
33113
"# Print start status message.\n"
33114
"echo \"Backing up $backup_files to $dest\"\n"
33115
"date\n"
33116
"echo\n"
33117
"\n"
33118
"# Make sure the tape is rewound.\n"
33119
"mt -f $dest rewind\n"
33120
"\n"
33121
"# Backup the files using tar.\n"
33122
"tar czf $dest $backup_files\n"
33123
"\n"
33124
"# Rewind and eject the tape.\n"
33125
"mt -f $dest rewoffl\n"
33126
"\n"
33127
"# Print end status message.\n"
33128
"echo\n"
33129
"echo \"Backup finished\"\n"
33130
"date\n"
33131
msgstr ""
33132
33133
#: serverguide/C/backups.xml:529(para)
33134
msgid ""
33135
"The default device name for a SCSI tape drive is "
33136
"<filename>/dev/st0</filename>. Use the appropriate device path for your "
33137
"system."
33138
msgstr ""
33139
33140
#: serverguide/C/backups.xml:534(para)
33141
msgid ""
33142
"Restoring from a tape drive is basically the same as restoring from a file. "
33143
"Simply rewind the tape and use the device path instead of a file path. For "
33144
"example to restore the <filename>/etc/hosts</filename> file to "
33145
"<filename>/tmp/etc/hosts</filename>:"
33146
msgstr ""
33147
33148
#: serverguide/C/backups.xml:539(command)
33149
msgid "mt -f /dev/st0 rewind"
33150
msgstr ""
33151
33152
#: serverguide/C/backups.xml:540(command)
33153
msgid "tar -xzf /dev/st0 -C /tmp etc/hosts"
33154
msgstr ""
33155
33156
#: serverguide/C/backups.xml:545(title)
33157
msgid "Bacula"
33158
msgstr ""
33159
33160
#: serverguide/C/backups.xml:546(para)
33161
msgid ""
33162
"<application>Bacula</application> is a backup program enabling you to "
33163
"backup, restore, and verify data across your network. There are Bacula "
33164
"clients for Linux, Windows, and Mac OS X - making it a cross-platform "
33165
"network wide solution."
33166
msgstr ""
33167
33168
#: serverguide/C/backups.xml:552(para)
33169
msgid ""
33170
"<application>Bacula</application> is made up of several components and "
33171
"services used to manage which files to backup and backup locations:"
33172
msgstr ""
33173
33174
#: serverguide/C/backups.xml:557(para)
33175
msgid ""
33176
"<application>Bacula Director:</application> a service that controls all "
33177
"backup, restore, verify, and archive operations."
33178
msgstr ""
33179
33180
#: serverguide/C/backups.xml:562(para)
33181
msgid ""
33182
"<application>Bacula Console:</application> an application allowing "
33183
"communication with the Director. There are three versions of the Console:"
33184
msgstr ""
33185
33186
#: serverguide/C/backups.xml:567(para)
33187
msgid "Text based command line version."
33188
msgstr ""
33189
33190
#: serverguide/C/backups.xml:568(para)
33191
msgid "Gnome based GTK+ Graphical User Interface (GUI) interface."
33192
msgstr ""
33193
33194
#: serverguide/C/backups.xml:569(para)
33195
msgid "wxWidgets GUI interface."
33196
msgstr ""
33197
33198
#: serverguide/C/backups.xml:573(para)
33199
msgid ""
33200
"<application>Bacula File:</application> also known as the "
33201
"<application>Bacula Client</application> program. This application is "
33202
"installed on machines to be backed up, and is responsible for the data "
33203
"requested by the Director."
33204
msgstr ""
33205
33206
#: serverguide/C/backups.xml:579(para)
33207
msgid ""
33208
"<application>Bacula Storage:</application> the programs that perform the "
33209
"storage and recovery of data to the physical media."
33210
msgstr ""
33211
33212
#: serverguide/C/backups.xml:584(para)
33213
msgid ""
33214
"<application>Bacula Catalog:</application> is responsible for maintaining "
33215
"the file indexes and volume databases for all files backed up, enabling "
33216
"quick location and restoration of archived files. The Catalog supports three "
33217
"different databases MySQL, PostgreSQL, and SQLite."
33218
msgstr ""
33219
33220
#: serverguide/C/backups.xml:590(para)
33221
msgid ""
33222
"<application>Bacula Monitor:</application> allows the monitoring of the "
33223
"Director, File daemons, and Storage daemons. Currently the Monitor is only "
33224
"available as a GTK+ GUI application."
33225
msgstr ""
33226
33227
#: serverguide/C/backups.xml:596(para)
33228
msgid ""
33229
"These services and applications can be run on multiple servers and clients, "
33230
"or they can be installed on one machine if backing up a single disk or "
33231
"volume."
33232
msgstr ""
33233
33234
#: serverguide/C/backups.xml:604(para)
33235
msgid ""
33236
"If using MySQL or PostgreSQL as your database, you should already have the "
33237
"services available. <application>Bacula</application> will not install them "
33238
"for you."
33239
msgstr ""
33240
33241
#: serverguide/C/backups.xml:609(para)
33242
msgid ""
33243
"There are multiple packages containing the different "
33244
"<application>Bacula</application> components. To install Bacula, from a "
33245
"terminal prompt enter:"
33246
msgstr ""
33247
33248
#: serverguide/C/backups.xml:614(command)
33249
msgid "sudo apt install bacula"
33250
msgstr ""
33251
33252
#: serverguide/C/backups.xml:616(para)
33253
msgid ""
33254
"By default installing the <application>bacula</application> package will use "
33255
"a <application>MySQL</application> database for the Catalog. If you want to "
33256
"use SQLite or PostgreSQL, for the Catalog, install <application>bacula-"
33257
"director-sqlite3</application> or <application>bacula-director-"
33258
"pgsql</application> respectively."
33259
msgstr ""
33260
33261
#: serverguide/C/backups.xml:622(para)
33262
msgid ""
33263
"During the install process you will be asked to supply credentials for the "
33264
"database <emphasis>administrator</emphasis> and the "
33265
"<emphasis>bacula</emphasis> database <emphasis>owner</emphasis>. The "
33266
"database administrator will need to have the appropriate rights to create a "
33267
"database, see <xref linkend=\"mysql\"/> for more information."
33268
msgstr ""
33269
33270
#: serverguide/C/backups.xml:632(para)
33271
msgid ""
33272
"<application>Bacula</application> configuration files are formatted based on "
33273
"<emphasis>resources</emphasis> comprising of <emphasis>directives</emphasis> "
33274
"surrounded by <quote>{}</quote> braces. Each Bacula component has an "
33275
"individual file in the <filename role=\"directory\">/etc/bacula</filename> "
33276
"directory."
33277
msgstr ""
33278
33279
#: serverguide/C/backups.xml:637(para)
33280
msgid ""
33281
"The various <application>Bacula</application> components must authorize "
33282
"themselves to each other. This is accomplished using the "
33283
"<emphasis>password</emphasis> directive. For example, the "
33284
"<emphasis>Storage</emphasis> resource password in the "
33285
"<filename>/etc/bacula/bacula-dir.conf</filename> file must match the "
33286
"<emphasis>Director</emphasis> resource password in "
33287
"<filename>/etc/bacula/bacula-sd.conf</filename>."
33288
msgstr ""
33289
33290
#: serverguide/C/backups.xml:643(para)
33291
msgid ""
33292
"By default the backup job named <emphasis>Client1</emphasis> is configured "
33293
"to archive the <application>Bacula</application> Catalog. If you plan on "
33294
"using the server to backup more than one client you should change the name "
33295
"of this job to something more descriptive. To change the name edit "
33296
"<filename>/etc/bacula/bacula-dir.conf</filename>:"
33297
msgstr ""
33298
33299
#: serverguide/C/backups.xml:648(programlisting)
33300
#, no-wrap
33301
msgid ""
33302
"\n"
33303
"#\n"
33304
"# Define the main nightly save backup job\n"
33305
"# By default, this job will back up to disk in \n"
33306
"Job {\n"
33307
" Name = \"BackupServer\"\n"
33308
" JobDefs = \"DefaultJob\"\n"
33309
" Write Bootstrap = \"/var/lib/bacula/Client1.bsr\"\n"
33310
"}\n"
33311
msgstr ""
33312
33313
#: serverguide/C/backups.xml:659(para)
33314
msgid ""
33315
"The example above changes the job name to <emphasis>BackupServer</emphasis> "
33316
"matching the machine's host name. Replace <quote>BackupServer</quote> with "
33317
"your appropriate hostname, or other descriptive name."
33318
msgstr ""
33319
33320
#: serverguide/C/backups.xml:664(para)
33321
msgid ""
33322
"The <emphasis>Console</emphasis> can be used to query the "
33323
"<emphasis>Director</emphasis> about jobs, but to use the Console with a "
33324
"<emphasis>non-root</emphasis> user, the user needs to be in the "
33325
"<emphasis>bacula</emphasis> group. To add a user to the bacula group enter "
33326
"the following from a terminal:"
33327
msgstr ""
33328
33329
#: serverguide/C/backups.xml:670(command)
33330
msgid "sudo adduser $username bacula"
33331
msgstr ""
33332
33333
#: serverguide/C/backups.xml:673(para)
33334
msgid ""
33335
"Replace <emphasis>$username</emphasis> with the actual username. Also, if "
33336
"you are adding the current user to the group you should log out and back in "
33337
"for the new permissions to take effect."
33338
msgstr ""
33339
33340
#: serverguide/C/backups.xml:680(title)
33341
msgid "Localhost Backup"
33342
msgstr ""
33343
33344
#: serverguide/C/backups.xml:681(para)
33345
msgid ""
33346
"This section describes how to backup specified directories on a single host "
33347
"to a local tape drive."
33348
msgstr ""
33349
33350
#: serverguide/C/backups.xml:686(para)
33351
msgid ""
33352
"First, the <emphasis>Storage</emphasis> device needs to be configured. Edit "
33353
"<filename>/etc/bacula/bacula-sd.conf</filename> add:"
33354
msgstr ""
33355
33356
#: serverguide/C/backups.xml:689(programlisting)
33357
#, no-wrap
33358
msgid ""
33359
"\n"
33360
"Device {\n"
33361
" Name = \"Tape Drive\"\n"
33362
" Device Type = tape\n"
33363
" Media Type = DDS-4\n"
33364
" Archive Device = /dev/st0\n"
33365
" Hardware end of medium = No;\n"
33366
" AutomaticMount = yes; # when device opened, read it\n"
33367
" AlwaysOpen = Yes;\n"
33368
" RemovableMedia = yes;\n"
33369
" RandomAccess = no;\n"
33370
" Alert Command = \"sh -c 'tapeinfo -f %c | grep TapeAlert'\"\n"
33371
"}\n"
33372
msgstr ""
33373
33374
#: serverguide/C/backups.xml:703(para)
33375
msgid ""
33376
"The example is for a <emphasis>DDS-4</emphasis> tape drive. Adjust the "
33377
"<quote>Media Type</quote> and <quote>Archive Device</quote> to match your "
33378
"hardware."
33379
msgstr ""
33380
33381
#: serverguide/C/backups.xml:706(para)
33382
msgid "You could also uncomment one of the other examples in the file."
33383
msgstr ""
33384
33385
#: serverguide/C/backups.xml:711(para)
33386
msgid ""
33387
"After editing <filename>/etc/bacula/bacula-sd.conf</filename> the "
33388
"<application>Storage</application> daemon will need to be restarted:"
33389
msgstr ""
33390
33391
#: serverguide/C/backups.xml:716(command)
33392
msgid "sudo systemctl restart bacula-sd.service"
33393
msgstr ""
33394
33395
#: serverguide/C/backups.xml:720(para)
33396
msgid ""
33397
"Now add a <emphasis>Storage</emphasis> resource in "
33398
"<filename>/etc/bacula/bacula-dir.conf</filename> to use the new Device:"
33399
msgstr ""
33400
33401
#: serverguide/C/backups.xml:723(programlisting)
33402
#, no-wrap
33403
msgid ""
33404
"\n"
33405
"# Definition of \"Tape Drive\" storage device\n"
33406
"Storage {\n"
33407
" Name = TapeDrive\n"
33408
" # Do not use \"localhost\" here \n"
33409
" Address = backupserver # N.B. Use a fully qualified name "
33410
"here\n"
33411
" SDPort = 9103\n"
33412
" Password = \"Cv70F6pf1t6pBopT4vQOnigDrR0v3LT3Cgkiyjc\"\n"
33413
" Device = \"Tape Drive\"\n"
33414
" Media Type = tape\n"
33415
"}\n"
33416
msgstr ""
33417
33418
#: serverguide/C/backups.xml:735(para)
33419
msgid ""
33420
"The <emphasis>Address</emphasis> directive needs to be the Fully Qualified "
33421
"Domain Name (FQDN) of the server. Change <emphasis>backupserver</emphasis> "
33422
"to the actual host name."
33423
msgstr ""
33424
33425
#: serverguide/C/backups.xml:739(para)
33426
msgid ""
33427
"Also, make sure the <emphasis>Password</emphasis> directive matches the "
33428
"password string in <filename>/etc/bacula/bacula-sd.conf</filename>."
33429
msgstr ""
33430
33431
#: serverguide/C/backups.xml:745(para)
33432
msgid ""
33433
"Create a new <emphasis>FileSet</emphasis>, which will determine what "
33434
"directories to backup, by adding:"
33435
msgstr ""
33436
33437
#: serverguide/C/backups.xml:748(programlisting)
33438
#, no-wrap
33439
msgid ""
33440
"\n"
33441
"# LocalhostBacup FileSet.\n"
33442
"FileSet {\n"
33443
" Name = \"LocalhostFiles\"\n"
33444
" Include {\n"
33445
" Options {\n"
33446
" signature = MD5\n"
33447
" compression=GZIP\n"
33448
" }\n"
33449
" File = /etc\n"
33450
" File = /home\n"
33451
" }\n"
33452
"}\n"
33453
msgstr ""
33454
33455
#: serverguide/C/backups.xml:762(para)
33456
msgid ""
33457
"This <emphasis>FileSet</emphasis> will backup the <filename "
33458
"role=\"directory\">/etc</filename> and <filename "
33459
"role=\"directory\">/home</filename> directories. The "
33460
"<emphasis>Options</emphasis> resource directives configure the FileSet to "
33461
"create an MD5 signature for each file backed up, and to compress the files "
33462
"using GZIP."
33463
msgstr ""
33464
33465
#: serverguide/C/backups.xml:769(para)
33466
msgid "Next, create a new <emphasis>Schedule</emphasis> for the backup job:"
33467
msgstr ""
33468
33469
#: serverguide/C/backups.xml:772(programlisting)
33470
#, no-wrap
33471
msgid ""
33472
"\n"
33473
"# LocalhostBackup Schedule -- Daily.\n"
33474
"Schedule {\n"
33475
" Name = \"LocalhostDaily\"\n"
33476
" Run = Full daily at 00:01\n"
33477
"}\n"
33478
msgstr ""
33479
33480
#: serverguide/C/backups.xml:779(para)
33481
msgid ""
33482
"The job will run every day at 00:01 or 12:01 am. There are many other "
33483
"scheduling options available."
33484
msgstr ""
33485
33486
#: serverguide/C/backups.xml:784(para)
33487
msgid "Finally create the <emphasis>Job</emphasis>:"
33488
msgstr ""
33489
33490
#: serverguide/C/backups.xml:787(programlisting)
33491
#, no-wrap
33492
msgid ""
33493
"\n"
33494
"# Localhost backup.\n"
33495
"Job {\n"
33496
" Name = \"LocalhostBackup\"\n"
33497
" JobDefs = \"DefaultJob\"\n"
33498
" Enabled = yes\n"
33499
" Level = Full\n"
33500
" FileSet = \"LocalhostFiles\"\n"
33501
" Schedule = \"LocalhostDaily\"\n"
33502
" Storage = TapeDrive\n"
33503
" Write Bootstrap = \"/var/lib/bacula/LocalhostBackup.bsr\"\n"
33504
"} \n"
33505
msgstr ""
33506
33507
#: serverguide/C/backups.xml:800(para)
33508
msgid ""
33509
"The job will do a <emphasis>Full</emphasis> backup every day to the tape "
33510
"drive."
33511
msgstr ""
33512
33513
#: serverguide/C/backups.xml:805(para)
33514
msgid ""
33515
"Each tape used will need to have a <emphasis>Label</emphasis>. If the "
33516
"current tape does not have a label <application>Bacula</application> will "
33517
"send an email letting you know. To label a tape using the "
33518
"<application>Console</application> enter the following from a terminal:"
33519
msgstr ""
33520
33521
#: serverguide/C/backups.xml:811(command)
33522
msgid "bconsole"
33523
msgstr ""
33524
33525
#: serverguide/C/backups.xml:815(para)
33526
msgid "At the Bacula Console prompt enter:"
33527
msgstr ""
33528
33529
#: serverguide/C/backups.xml:819(command)
33530
msgid "label"
33531
msgstr ""
33532
33533
#: serverguide/C/backups.xml:823(para)
33534
msgid ""
33535
"You will then be prompted for the <emphasis>Storage</emphasis> resource:"
33536
msgstr ""
33537
33538
#: serverguide/C/backups.xml:833(userinput)
33539
#, no-wrap
33540
msgid "2"
33541
msgstr ""
33542
33543
#: serverguide/C/backups.xml:827(computeroutput)
33544
#, no-wrap
33545
msgid ""
33546
"\n"
33547
"Automatically selected Catalog: MyCatalog\n"
33548
"Using Catalog \"MyCatalog\"\n"
33549
"The defined Storage resources are:\n"
33550
" 1: File\n"
33551
" 2: TapeDrive\n"
33552
"Select Storage resource (1-2):<placeholder-1/>\n"
33553
msgstr ""
33554
33555
#: serverguide/C/backups.xml:838(para)
33556
msgid "Enter the new <emphasis>Volume</emphasis> name:"
33557
msgstr ""
33558
33559
#: serverguide/C/backups.xml:843(userinput)
33560
#, no-wrap
33561
msgid "Sunday"
33562
msgstr ""
33563
33564
#: serverguide/C/backups.xml:842(computeroutput)
33565
#, no-wrap
33566
msgid ""
33567
"\n"
33568
"Enter new Volume name: <placeholder-1/>\n"
33569
"Defined Pools:\n"
33570
" 1: Default\n"
33571
" 2: Scratch"
33572
msgstr ""
33573
33574
#: serverguide/C/backups.xml:848(para)
33575
msgid "Replace <emphasis>Sunday</emphasis> with the desired label."
33576
msgstr ""
33577
33578
#: serverguide/C/backups.xml:853(para)
33579
msgid "Now, select the <emphasis>Pool</emphasis>:"
33580
msgstr ""
33581
33582
#: serverguide/C/backups.xml:857(computeroutput)
33583
#, no-wrap
33584
msgid ""
33585
"\n"
33586
"Select the Pool (1-2): <placeholder-1/>\n"
33587
"Connecting to Storage daemon TapeDrive at backupserver:9103 ...\n"
33588
"Sending label command for Volume \"Sunday\" Slot 0 ...\n"
33589
msgstr ""
33590
33591
#: serverguide/C/backups.xml:865(para)
33592
msgid ""
33593
"Congratulations, you have now configured <emphasis>Bacula</emphasis> to "
33594
"backup the localhost to an attached tape drive."
33595
msgstr ""
33596
33597
#: serverguide/C/backups.xml:873(para)
33598
msgid ""
33599
"For more <emphasis>Bacula</emphasis> configuration options, refer to <ulink "
33600
"url=\"http://blog.bacula.org/documentation/documentation/\">Bacula's "
33601
"Documentation</ulink>."
33602
msgstr ""
33603
33604
#: serverguide/C/backups.xml:881(para)
33605
msgid ""
33606
"The <ulink url=\"http://www.bacula.org/\">Bacula Home Page</ulink> contains "
33607
"the latest Bacula news and developments."
33608
msgstr ""
33609
33610
#: serverguide/C/backups.xml:886(para)
33611
msgid ""
33612
"Also, see the <ulink url=\"https://help.ubuntu.com/community/Bacula\">Bacula "
33613
"Ubuntu Wiki</ulink> page."
33614
msgstr ""
33615
33616
#. Put one translator per line, in the form of NAME <EMAIL>, YEAR1, YEAR2
33617
#: serverguide/C/backups.xml:0(None)
33618
msgid "translator-credits"
33619
msgstr ""
33620
"Launchpad Contributions:\n"
33621
" Andika Triwidada https://launchpad.net/~andika\n"
33622
" Arif Budiman https://launchpad.net/~arifpedia\n"
33623
" Matthew East https://launchpad.net/~mdke"
33624
33625
#~ msgid "sudo apt-get install samba"
33626
#~ msgstr "sudo apt-get install samba"
33627
33628
#~ msgid "sudo chown nobody.nogroup /srv/samba/share/"
33629
#~ msgstr "sudo chown nobody.nogroup /srv/samba/share/"
33630
33631
#~ msgid "sudo apt-get install libpam-smbpass"
33632
#~ msgstr "sudo apt-get install libpam-smbpass"
33633
33634
#~ msgid "sudo apt-get install apparmor-profiles"
33635
#~ msgstr "sudo apt-get install apparmor-profiles"
33636
33637
#~ msgid "sudo apt-get install samba libpam-smbpass"
33638
#~ msgstr "sudo apt-get install samba libpam-smbpass"
33639
33640
#~ msgid "sudo apt-get install libapache2-mod-auth-mysql"
33641
#~ msgstr "sudo apt-get install libapache2-mod-auth-mysql"
33642
33643
#~ msgid "PHP5 - Scripting Language"
33644
#~ msgstr "PHP5 - Scripting Language"
33645
33646
#~ msgid ""
33647
#~ "To verify your installation, you can run following PHP5 phpinfo script:"
33648
#~ msgstr ""
33649
#~ "Untuk menguji instalasi, Anda dapat menjalankan skrip PHP5 phpinfo berikut:"
33650
33651
#~ msgid "sudo apt-get install openssh-client"
33652
#~ msgstr "sudo apt-get install openssh-client"
33653
33654
#~ msgid "sudo apt-get install openssh-server"
33655
#~ msgstr "sudo apt-get install openssh-server"
33656
33657
#~ msgid "Apt-Get"
33658
#~ msgstr "Apt-Get"
33659
33660
#~ msgid ""
33661
#~ "Some examples of popular uses for the <application>apt-get</application> "
33662
#~ "utility: <placeholder-1/>"
33663
#~ msgstr ""
33664
#~ "Beberapa contoh penggunaan dari perkakas <application>apt-get</application>: "
33665
#~ "<placeholder-1/>"
33666
33667
#~ msgid ""
33668
#~ "Actions of the <application>apt-get</application> command, such as "
33669
#~ "installation and removal of packages, are logged in the /var/log/dpkg.log "
33670
#~ "log file."
33671
#~ msgstr ""
33672
#~ "Aksi dari perintah <application>apt-get</application>, seperti instalasi dan "
33673
#~ "penghapusan paket, tercatat di dalam berkas log /var/log/dpkg.log."
33674
33675
#~ msgid "Time Synchronisation with NTP"
33676
#~ msgstr "Sinkhronisasi Waktu dengan NTP"
33677
33678
#~ msgid "ntpdate"
33679
#~ msgstr "ntpdate"
33680
33681
#~ msgid ""
33682
#~ "MoinMoin is a Wiki engine implemented in Python, based on the PikiPiki Wiki "
33683
#~ "engine, and licensed under the GNU GPL."
33684
#~ msgstr ""
33685
#~ "MoinMoin adalah sebuah sistem Wiki yang diimplementasikan menggunakan "
33686
#~ "Python, berdasarkan sistem Wiki PikiPiki, dan berlisensi GNU GPL."
33687
33688
#~ msgid "sudo apt-get install python-moinmoin"
33689
#~ msgstr "sudo apt-get install python-moinmoin"
33690
33691
#~ msgid ""
33692
#~ "You should also install <application>apache2</application> web server. For "
33693
#~ "installing <application>apache2</application> web server, please refer to "
33694
#~ "<xref linkend=\"http-installation\"/> sub-section in <xref "
33695
#~ "linkend=\"httpd\"/> section."
33696
#~ msgstr ""
33697
#~ "Anda juga sebaiknya menginstal server web<application>apache2</application>. "
33698
#~ "Untuk menginstal server web <application>apache2</application>, silakan "
33699
#~ "ikuti sub-seksi <xref linkend=\"http-installation\"/> di bagian <xref "
33700
#~ "linkend=\"httpd\"/>."
33701
33702
#~ msgid ""
33703
#~ "For configuring your first Wiki application, please run the following set of "
33704
#~ "commands. Let us assume that you are creating a Wiki named "
33705
#~ "<emphasis>mywiki</emphasis>:"
33706
#~ msgstr ""
33707
#~ "Untuk mengkonfigurasi aplikasi Wiki anda yang pertama, jalankan beberapa "
33708
#~ "perintah berikut ini. Diasumsikan <emphasis>mywiki</emphasis> adalah nama "
33709
#~ "Wiki yang anda buat :"
33710
33711
#~ msgid ""
33712
#~ "Now you should configure <application>MoinMoin</application> to find your "
33713
#~ "new Wiki <emphasis>mywiki</emphasis>. To configure "
33714
#~ "<application>MoinMoin</application>, open "
33715
#~ "<filename>/etc/moin/mywiki.py</filename> file and change the following line:"
33716
#~ msgstr ""
33717
#~ "Kini anda dapat mengkonfigurasi <application>MoinMoin</application> untuk "
33718
#~ "menemukan Wiki <emphasis>mywiki</emphasis> baru anda. Untuk mengkonfigurasi "
33719
#~ "<application>MoinMoin</application>, buka file "
33720
#~ "<filename>/etc/moin/mywiki.py</filename> dan sesuaikan beberapa baris "
33721
#~ "berikut ini :"
33722
33723
#~ msgid ""
33724
#~ "If you have named your Wiki as <emphasis>my_wiki_name</emphasis> you should "
33725
#~ "insert a line <quote>(\"my_wiki_name\", r\".*\")</quote> in "
33726
#~ "<filename>/etc/moin/farmconfig.py</filename> file after the line "
33727
#~ "<quote>(\"mywiki\", r\".*\")</quote>."
33728
#~ msgstr ""
33729
#~ "Jika anda telah memberi nama Wiki anda dengan "
33730
#~ "<emphasis>my_wiki_name</emphasis> anda harus menambahkan baris "
33731
#~ "<quote>(\"my_wiki_name\", r\".*\")</quote> pada file "
33732
#~ "<filename>/etc/moin/farmconfig.py</filename> setelah baris "
33733
#~ "<quote>(\"mywiki\", r\".*\")</quote>."
33734
33735
#~ msgid ""
33736
#~ "Once you have configured <application>MoinMoin</application> to find your "
33737
#~ "first Wiki application <emphasis>mywiki</emphasis>, you should configure "
33738
#~ "<application>apache2</application> and make it ready for your Wiki "
33739
#~ "application."
33740
#~ msgstr ""
33741
#~ "Setelah anda mengkonfigurasi <application>MoinMoin</application> untuk dapat "
33742
#~ "menggunakan aplikasi Wiki <emphasis>mywiki</emphasis> anda yang pertama, "
33743
#~ "anda juga harus mengkonfigurasi <application>apache2</application> dan "
33744
#~ "membuatnya siap digunakan untuk aplikasi Wiki anda."
33745
33746
#~ msgid ""
33747
#~ "Once you configure the <application>apache2</application> web server and "
33748
#~ "make it ready for your Wiki application, you should restart it. You can run "
33749
#~ "the following command to restart the <application>apache2</application> web "
33750
#~ "server:"
33751
#~ msgstr ""
33752
#~ "Setelah anda mengonfigurasi server web <application>apache2</application> "
33753
#~ "dan membuatnya siap untuk aplikasi Wiki anda, maka langkah selanjutnya anda "
33754
#~ "harus start ulang. Anda dapat menjalankan perintah ini untuk start ulang "
33755
#~ "server server<application>apache2</application>."
33756
33757
#~ msgid "MediaWiki"
33758
#~ msgstr "MediaWiki"
33759
33760
#~ msgid ""
33761
#~ "MediaWiki is an web based Wiki software written in the PHP language. It can "
33762
#~ "either use <application>MySQL</application> or "
33763
#~ "<application>PostgreSQL</application> Database Management System."
33764
#~ msgstr ""
33765
#~ "MediaWiki adalah perangkat lunak web berbasis Wiki yang ditulis menggunakan "
33766
#~ "bahasa PHP. MediaWiki dapat menggunakan Sistem Manajemen Basisdata "
33767
#~ "<application>MySQL</application> atau <application>PostgreSQL</application>."
33768
33769
#~ msgid ""
33770
#~ "To install <application>MediaWiki</application>, run the following command "
33771
#~ "in the command prompt:"
33772
#~ msgstr ""
33773
#~ "Untuk menginstal <application>MediaWiki</application>, jalankan perintah "
33774
#~ "berikut ini pada baris perintah :"
33775
33776
#~ msgid "sudo apt-get install mediawiki php5-gd"
33777
#~ msgstr "sudo apt-get install mediawiki php5-gd"
33778
33779
#, no-wrap
33780
#~ msgid ""
33781
#~ "\n"
33782
#~ "http://localhost/mediawiki/config/index.php\n"
33783
#~ msgstr ""
33784
#~ "\n"
33785
#~ "http://localhost/mediawiki/config/index.php\n"
33786
33787
#~ msgid ""
33788
#~ "Please read the <quote>Checking environment...</quote> section in this page. "
33789
#~ "You should be able to fix many issues by carefully reading this section."
33790
#~ msgstr ""
33791
#~ "Mohon baca sesi <quote>Checking environment...</quote> di halaman ini. Anda "
33792
#~ "dapat membenarkan beberapa permasalahan dengan membaca dengan hari-hati pada "
33793
#~ "sesi ini"
33794
33795
#~ msgid ""
33796
#~ "For more details, please refer to the <ulink "
33797
#~ "url=\"http://www.mediawiki.org\">MediaWiki</ulink> web site."
33798
#~ msgstr ""
33799
#~ "Untuk detail lebih lanjut, silakan merujuk ke website <ulink "
33800
#~ "url=\"http://www.mediawiki.org\">MediaWiki</ulink>"
33801
33802
#~ msgid "Installing from CD"
33803
#~ msgstr "Instalasi dari CD"
33804
33805
#~ msgid "sudo apt-get install nfs-kernel-server"
33806
#~ msgstr "sudo apt-get install nfs-kernel-server"
33807
33808
#~ msgid "sudo apt-get install bind9"
33809
#~ msgstr "sudo apt-get install bind9"
33810
33811
#~ msgid "sudo apt-get install postgresql"
33812
#~ msgstr "sudo apt-get install postgresql"
33813
33814
#~ msgid ""
33815
#~ "The main Samba configuration file is located in "
33816
#~ "<filename>/etc/samba/smb.conf</filename>. The default configuration file has "
33817
#~ "a significant amount of comments in order to document various configuration "
33818
#~ "directives."
33819
#~ msgstr ""
33820
#~ "Berkas konfigurasi utama Samba terletak di "
33821
#~ "<filename>/etc/samba/smb.conf</filename>. Pada berkas konfigurasi default "
33822
#~ "memiliki sejumlah besar komentar untuk mendokumentasikan berbagai perintah "
33823
#~ "konfigurasi."
33824
33825
#~ msgid ""
33826
#~ "The server will be configured to share files with any client on the network "
33827
#~ "without prompting for a password. If your environment requires stricter "
33828
#~ "Access Controls see <xref linkend=\"samba-fileprint-security\"/>"
33829
#~ msgstr ""
33830
#~ "Server akan dikonfigurasi untuk dapat berbagi file dengan klien pada "
33831
#~ "jaringan tersebut tanpa meminta kata sandi. Jika sistem anda memerlukan "
33832
#~ "Kontrol Akses yang lebih ketat lihat <xref linkend=\"samba-fileprint-"
33833
#~ "security\"/>"
33834
33835
#~ msgid "sudo restart smbd"
33836
#~ msgstr "sudo restart smbd"
33837
33838
#~ msgid "sudo restart nmbd"
33839
#~ msgstr "sudo restart nmbd"
33840
33841
#~ msgid ""
33842
#~ "First, install the <application>libpam-smbpass</application> package which "
33843
#~ "will sync the system users to the Samba user database:"
33844
#~ msgstr ""
33845
#~ "Pertama, instal paket <application>libpam-smbpass</application> yang akan "
33846
#~ "melakukan sinkronisasi antara pengguna sistem dengan database Samba:"
33847
33848
#~ msgid "sudo apt-get install apparmor-profiles apparmor-utils"
33849
#~ msgstr "sudo apt-get install apparmor-profiles apparmor-utils"
33850
33851
#~ msgid ""
33852
#~ "First, install Samba, and <application>libpam-smbpass</application> to sync "
33853
#~ "the user accounts, by entering the following in a terminal prompt:"
33854
#~ msgstr ""
33855
#~ "Pertama, install Samba dan <application>libpam-smbpass</application> untuk "
33856
#~ "melakukan sinkronisasi account pengguna dengan memasukkan perintah berikut "
33857
#~ "di terminal:"
Loggerhead is a web-based interface for Breezy
Version: 2.0.1