11_network-services.po

#
# AUTHOR <EMAIL@ADDRESS>, YEAR.
#
msgid ""
msgstr ""
"Project-Id-Version: 0\n"
"POT-Creation-Date: 2013-12-30 17:37+0100\n"
"PO-Revision-Date: 2015-05-11 01:58+0100\n"
"Last-Translator: Marek Gubiec <mgubiec@gmail.com>\n"
"Language-Team: \n"
"Language: pl\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Generator: Poedit 1.7.5\n"
"Plural-Forms: nplurals=3; plural=(n==1 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n"

#. Tag: keyword
#, no-c-format
msgid "Postfix"
msgstr "Postfix"

#. Tag: keyword
#, no-c-format
msgid "Apache"
msgstr "Apache"

#. Tag: keyword
#, no-c-format
msgid "NFS"
msgstr "NFS"

#. Tag: keyword
#, no-c-format
msgid "Samba"
msgstr "Samba"

#. Tag: keyword
#, no-c-format
msgid "Squid"
msgstr "Squid"

#. Tag: keyword
#, no-c-format
msgid "OpenLDAP"
msgstr "OpenLDAP"

#. Tag: title
#, no-c-format
msgid "Network Services: Postfix, Apache, NFS, Samba, Squid, LDAP"
msgstr "Usługi sieciowe: Postfix, Apache, NFS, Samba, Squid, LDAP"

#. Tag: para
#, no-c-format
msgid "Network services are the programs that users interact with directly in their daily work. They're the tip of the information system iceberg, and this chapter focuses on them; the hidden parts they rely on are the infrastructure we already described."
msgstr "Usługi sieciowe to programy, z których użytkownicy korzystają na co dzień w swojej pracy. Znajdują się na szczycie góry lodowej systemu informacji, ten rozdział jest poświęcony właśnie im. Ukryte elementy, na których opierają się usługi sieciowe to infrastruktura, którą już wcześniej opisaliśmy."

#. Tag: title
#, no-c-format
msgid "Mail Server"
msgstr "Serwer pocztowy"

#. Tag: para
#, no-c-format
msgid "The Falcot Corp administrators selected Postfix for the electronic mail server, due to its reliability and its ease of configuration. Indeed, its design enforces that each task is implemented in a process with the minimum set of required permissions, which is a great mitigation measure against security problems."
msgstr "Administratorzy z Falcon Corp wybrali Postfiksa na serwer poczty elektronicznej ze względu na jego niezawodność i prostotę konfiguracji. Rzeczywiście, jego budowa wymusza by każde zadanie było wdrożone jako oddzielny proces z minimalnymi uprawnieniami, co stanowi świetny środek zmniejszenia problemów z bezpieczeństwem."

#. Tag: indexterm
#, no-c-format
msgid "<primary>email</primary><secondary>server</secondary>"
msgstr "<primary>email</primary><secondary>server</secondary>"

#. Tag: indexterm
#, no-c-format
msgid "<primary>mail server</primary>"
msgstr "<primary>serwer pocztowy</primary>"

#. Tag: indexterm
#, no-c-format
msgid "<primary>Postfix</primary>"
msgstr "<primary>Postfix</primary>"

#. Tag: title
#, no-c-format
msgid "<emphasis>ALTERNATIVE</emphasis> The Exim4 server"
msgstr "<emphasis>ALTERNATYWA</emphasis> Serwer Exim4"

#. Tag: indexterm
#, no-c-format
msgid "<primary>Exim</primary>"
msgstr "<primary>Exim</primary>"

#. Tag: para
#, no-c-format
msgid "Debian uses Exim4 as the default email server (which is why the initial installation includes Exim4). The configuration is provided by a separate package, <emphasis role=\"pkg\">exim4-config</emphasis>, and automatically customized based on the answers to a set of Debconf questions very similar to the questions asked by the <emphasis role=\"pkg\">postfix</emphasis> package."
msgstr "Debian używa Exim4 jako domyślnego serwera poczty elektronicznej (dlatego właśnie domyślna instalacja go zawiera). Jego konfigurację dostarcza osobny pakiet - <emphasis role=\"pkg\">exim4-config</emphasis> - który automatyczne dostosowuje ją, w zależności od odpowiedzi na pytania Debconf (bardzo podobne do pytań w pakiecie <emphasis role=\"pkg\">postfix</emphasis>)."

#. Tag: para
#, no-c-format
msgid "The configuration can be either in one single file (<filename>/etc/exim4/exim4.conf.template</filename>) or split across a number of configuration snippets stored under <filename>/etc/exim4/conf.d/</filename>. In both cases, the files are used by <command>update-exim4.conf</command> as templates to generate <filename>/var/lib/exim4/config.autogenerated</filename>. The latter is the file used by Exim4. Thanks to this mechanism, values obtained through Exim's debconf configuration — which are stored in <filename>/etc/exim4/update-exim4.conf.conf</filename> — can be injected in Exim's configuration file, even when the administrator or another package has altered the default Exim configuration."
msgstr "Konfiguracja może znajdować się albo w jednym pliku (<filename>/etc/exim4/exim4.conf.template</filename>) albo być rozłożona na wiele fragmentów konfiguracji przechowywanych w <filename>/etc/exim4/conf.d/</filename>. W obu przypadkach, pliki te są używane przez <command>update-exim4.conf</command> jako szablony do stworzenia <filename>/var/lib/exim4/config.autogenerated</filename>. Ten drugi plik jest właśnie używany przez Exim4. Dzięki temu mechanizmowi, wartości uzyskane przez konfigurację debconf Exima - przechowywane w <filename>/etc/exim4/update-exim4.conf.conf</filename> - mogą zostać wstrzyknięte do pliku konfiguracyjnego Exima nawet wtedy, gdy administrator lub inny pakiet zmienił domyślną konfigurację programu."

#. Tag: para
#, no-c-format
msgid "The Exim4 configuration file syntax has its peculiarities and its learning curve; however, once these peculiarities are understood, Exim4 is a very complete and powerful email server, as evidenced by the tens of pages of documentation. <ulink type=\"block\" url=\"http://www.exim.org/docs.html\" />"
msgstr "Składnia pliku konfiguracyjnego Exim4 ma swoją specyfikę i trudność nauczenia się jej; jednak, gdy tę specyfikę się zrozumie, Exim4 okazuje się być kompleksowym i potężnym serwerem pocztowym, czego dowodem mogą być dziesiątki stron dokumentacji. <ulink type=\"block\" url=\"http://www.exim.org/docs.html\" />"

#. Tag: title
#, no-c-format
msgid "Installing Postfix"
msgstr "Instalowanie Postfiksa"

#. Tag: para
#, no-c-format
msgid "The <emphasis role=\"pkg\">postfix</emphasis> package includes the main SMTP daemon. Other packages (such as <emphasis role=\"pkg\">postfix-ldap</emphasis> and <emphasis role=\"pkg\">postfix-pgsql</emphasis>) add extra functionality to Postfix, including access to mapping databases. You should only install them if you know that you need them."
msgstr "Pakiet <emphasis role=\"pkg\">postfix</emphasis> zawiera główny demon SMTP. Inne pakiety (takie jak <emphasis role=\"pkg\">postfix-ldap</emphasis> "

#. Tag: title
#, no-c-format
msgid "<emphasis>BACK TO BASICS</emphasis> SMTP"
msgstr "<emphasis>WRACAJĄC DO PODSTAW</emphasis> SMTP"

#. Tag: indexterm
#, no-c-format
msgid "<primary>SMTP</primary>"
msgstr "<primary>SMTP</primary>"

#. Tag: indexterm
#, no-c-format
msgid "<primary>Simple Mail Transfer Protocol</primary>"
msgstr "<primary>Simple Mail Transfer Protocol</primary>"

#. Tag: indexterm
#, no-c-format
msgid "<primary>server</primary><secondary>SMTP</secondary>"
msgstr "<primary>serwer</primary><secondary>SMTP</secondary>"

#. Tag: para
#, no-c-format
msgid "SMTP (<emphasis>Simple Mail Transfer Protocol</emphasis>) is the protocol used by mail servers to exchange and route emails."
msgstr "SMTP (<emphasis>Simple Mail Transfer Protocol</emphasis> to protokół używany przez serwery pocztowe do wymiany oraz trasowania poczty."

#. Tag: para
#, no-c-format
msgid "Several Debconf questions are asked during the installation of the package. The answers allow generating a first version of the <filename>/etc/postfix/main.cf</filename> configuration file."
msgstr "Kilka pytań Debconf jest zadawanych użytkownikowi podczas instalacji pakietu. Odpowiedzi umożliwiają wygenerowanie pierwszej wersji pliku konfiguracyjnego <filename>/etc/postfix/main.cf</filename>."

#. Tag: para
#, no-c-format
msgid "The first question deals with the type of setup. Only two of the proposed answers are relevant in case of an Internet-connected server, “Internet site” and “Internet with smarthost”. The former is appropriate for a server that receives incoming email and sends outgoing email directly to its recipients, and is therefore well-adapted to the Falcot Corp case. The latter is appropriate for a server receiving incoming email normally, but that sends outgoing email through an intermediate SMTP server — the “smarthost” — rather than directly to the recipient's server. This is mostly useful for individuals with a dynamic IP address, since many email servers reject messages coming straight from such an IP address. In this case, the smarthost will usually be the ISP's SMTP server, which is always configured to accept email coming from the ISP's customers and forward it appropriately. This setup (with a smarthost) is also relevant for servers that are not permanently connected to the internet, since it avoids having to manage a queue of undeliverable messages that need to be retried later."
msgstr "Pierwsze pytanie dotyczy typu konfiguracji. Jedynie dwa z przedstawionych w nim opcji mają zastosowanie w przypadku serwera podłączonego do Internetu: \"lokalizacja Internetowa\" i \"Internet z hostem inteligentnym\". Pierwsza jest odpowiednia w przypadku, gdy serwer otrzymuje pocztę przychodzącą i rozsyła wychodzącą bezpośrednio do obiorców, jest więc dobrze przystosowany do przypadku Falcon Corp. Druga opcja jest przeznaczona dla serwera, który otrzymuje pocztę przychodzącą normalnie, ale rozsyła pocztę wychodzącą poprzez pośredniczący serwer SMTP - \"host inteligentny\" - zamiast wysyłać ją bezpośrednio do serwera odbiorcy. Jest to rozwiązanie najczęściej przydatne u użytkowników z dynamicznym adresem IP, ponieważ wiele serwerów pocztowych odrzuca pocztę nadesłaną z takich adresów. W takim przypadku, hostem inteligentnym zazwyczaj będzie serwer SMTP dostawcy internetowego, który zawsze jest ustawiony tak, by przyjmował pocztę przychodzącą od klientów usług internetowych i odpowiednio dalej ją przekazywał. Takie ustawienie(z hostem inteligentnym) jest również odpowiednie dla serwerów, które nie mają stałego podłączenia do Internetu, ponieważ pozwala uniknąć sytuacji, gdy trzeba będzie zarządzać kolejką poczty niedostarczonej, którą trzeba będzie próbować wysłać ponownie."

#. Tag: title
#, no-c-format
msgid "<emphasis>VOCABULARY</emphasis> ISP"
msgstr "<emphasis>SŁOWNICZEK</emphasis> ISP"

#. Tag: indexterm
#, no-c-format
msgid "<primary>ISP, Internet Service Provider</primary>"
msgstr "<primary>ISP, Internet Service Provider</primary>"

#. Tag: para
#, no-c-format
msgid "ISP is the acronym for “Internet Service Provider”. It covers an entity, often a commercial company, that provides Internet connections and the associated basic services (email, news and so on)."
msgstr "ISP to skrót od \"Internet Service Provider\"(ang. Dostawca Usług Internetowych). Oznacza instytucję, najczęściej firmę komercyjną, która świadczy usługi połączenia internetowego oraz podstawowych usług powiązanych (poczty, wiadomości itp.)."

#. Tag: para
#, no-c-format
msgid "The second question deals with the full name of the machine, used to generate email addresses from a local user name; the full name of the machine ends up as the part after the at-sign (“@”). In the case of Falcot, the answer should be <literal>mail.falcot.com</literal>. This is the only question asked by default, but the configuration it leads to is not complete enough for the needs of Falcot, which is why the administrators run <command>dpkg-reconfigure postfix</command> so as to be able to customize more parameters."
msgstr "Drugie pytanie odnosi się do konfiguracji pełnej nazwy maszyny, która jest używana do tworzenia adresów email na podstawie nazwy użytkownika lokalnego; pełna nazwa maszyny staje się końcową częścią nazwy, po znaku małpy(\"@\", czytane \"at\", ang. na). W przypadku Falcot, taką nazwą będzie <literal>mail.falcot.com</literal>. To jedyne pytanie zadane domyślnie, ale konfiguracja uzyskana po odpowiedzi na nie nie byłaby wystarczająca dla potrzeb Falconu, dlatego też administratorzy uruchamiają <command>dpkg-reconfigure postfix</command>, aby móc dostosować więcej parametrów."

#. Tag: para
#, no-c-format
msgid "One of the extra questions asks for all the domain names related to this machine. The default list includes its full name as well as a few synonyms for <literal>localhost</literal>, but the main <literal>falcot.com</literal> domain needs to be added by hand. More generally, this question should usually be answered with all the domain names for which this machine should serve as an MX server; in other words, all the domain names for which the DNS says that this machine will accept email. This information ends up in the <literal>mydestination</literal> variable of the main Postfix configuration file — <filename>/etc/postfix/main.cf</filename>."
msgstr "Jedno z dodatkowych pytań wymaga podania wszystkich nazw domenowych powiązanych z maszyną. Domyślna lista zawiera pełną nazwę maszyny oraz kilka nazw synonimicznych do <literal>localhost</literal>, ale główna domena <literal>falcot.com</literal> musi zostać dodana ręcznie. Mówiąc bardziej ogólnikowo, w odpowiedzi na pytanie należy najczęściej wpisać wszystkie nazwy domenowe, dla których maszyna ma służyć jako serwer wymiany poczty elektronicznej; innymi słowy, wszystkie nazwy domenowe, dla których DNS zgłasza gotowość do przyjmowania poczty. Informacja ta wyląduje w zmiennej <literal>mydestination</literal> głównego pliku konfiguracyjnego Postfix — <filename>/etc/postfix/main.cf</filename>."

#. Tag: indexterm
#, no-c-format
msgid "<primary>server</primary><secondary>MX</secondary>"
msgstr "<primary>serwer</primary><secondary>MX</secondary>"

#. Tag: indexterm
#, no-c-format
msgid "<primary>MX</primary><secondary>server</secondary>"
msgstr "<primary>MX</primary><secondary>serwer</secondary>"

#. Tag: title
#, no-c-format
msgid "Role of the DNS <emphasis>MX</emphasis> record while sending a mail"
msgstr "Rola rekordu DNS <emphasis>MX</emphasis> przy wysyłce poczty elektronicznej"

#. Tag: title
#, no-c-format
msgid "<emphasis>EXTRA</emphasis> Querying the MX records"
msgstr "<emphasis>DODATEK</emphasis> Odpytywanie rekordów MX"

#. Tag: para
#, no-c-format
msgid "When the DNS does not have an MX record for a domain, the email server will try sending the messages to the host itself, by using the matching A record (or AAAA in IPv6)."
msgstr "Kiedy serwer DNS nie posiada rekordów MX ustawionych dla danej domeny, serwer pocztowy spróbuje wysłać wiadomości do samego hosta, używając pasującego rekordu A (lub AAAA w IPv6)."

#. Tag: para
#, no-c-format
msgid "In some cases, the installation can also ask what networks should be allowed to send email via the machine. In its default configuration, Postfix only accepts emails coming from the machine itself; the local network will usually be added. The Falcot Corp administrators added <literal>192.168.0.0/16</literal> to the default answer. If the question is not asked, the relevant variable in the configuration file is <literal>mynetworks</literal>, as seen in the example below."
msgstr "W niektórych przypadkach, instalator może także zapytań o to jakie sieci będą mogły wysyłać pocztę przez daną maszynę. W domyślnej konfiguracji, Postfix akceptuje jedynie pocztę pochodzącą z maszyny, na której działa (samego siebie) - zostanie dodana sieć lokalna. Administratorzy Falcot Corp dodali <literal>192.168.0.0./16</literal> do domyślnej odpowiedzi. Jeżeli nie zostanie wpisana własna odpowiedź, domyślnie odpowiednia zmienna w pliku konfiguracyjnym przyjmie wartość <literal>mynetworks</literal>, co widać w przykładzie poniżej."

#. Tag: para
#, no-c-format
msgid "Local email can also be delivered through <command>procmail</command>. This tool allows users to sort their incoming email according to rules stored in their <filename>~/.procmailrc</filename> file."
msgstr "Lokalna poczta może także być dostarczona przez <procmail</command>. Narzędzie to pozwala użytkownikom sortować ich pocztę przychodzącą zgodnie z regułami przechowywanymi w pliku <filename>~/.procmailrc</filename>."

#. Tag: indexterm
#, no-c-format
msgid "<primary><command>procmail</command></primary>"
msgstr "<primary><command>procmail</command></primary>"

#. Tag: indexterm
#, no-c-format
msgid "<primary>email</primary><secondary>filtering</secondary>"
msgstr "<secondary>filtrowanie</secondary><primary>poczty</primary>"

#. Tag: indexterm
#, no-c-format
msgid "<primary>filtering email</primary>"
msgstr "<primary>filtrowanie poczty</primary>"

#. Tag: para
#, no-c-format
msgid "After this first step, the administrators got the following configuration file; it will be used as a starting point for adding some extra functionality in the next sections."
msgstr "Po kroku pierwszym, administratorzy otrzymali pliku konfiguracyjny jak poniżej; zostanie on użyty jako punkt wyjścia do dodania kolejnych funkcji w kolejnych podrozdziałach."

#. Tag: title
#, no-c-format
msgid "Initial <filename>/etc/postfix/main.cf</filename> file"
msgstr "Początkowa wersja pliku <filename>/etc/postfix/main.cf</filename>"

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"# See /usr/share/postfix/main.cf.dist for a commented, more complete version\n"
"\n"
"\n"
"# Debian specific:  Specifying a file name will cause the first\n"
"# line of that file to be used as the name.  The Debian default\n"
"# is /etc/mailname.\n"
"#myorigin = /etc/mailname\n"
"\n"
"smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)\n"
"biff = no\n"
"\n"
"# appending .domain is the MUA's job.\n"
"append_dot_mydomain = no\n"
"\n"
"# Uncomment the next line to generate \"delayed mail\" warnings\n"
"#delay_warning_time = 4h\n"
"\n"
"readme_directory = no\n"
"\n"
"# TLS parameters\n"
"smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem\n"
"smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key\n"
"smtpd_use_tls=yes\n"
"smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache\n"
"smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache\n"
"\n"
"# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for\n"
"# information on enabling SSL in the smtp client.\n"
"\n"
"myhostname = mail.falcot.com\n"
"alias_maps = hash:/etc/aliases\n"
"alias_database = hash:/etc/aliases\n"
"myorigin = /etc/mailname\n"
"mydestination = mail.falcot.com, falcot.com, localhost.localdomain, localhost\n"
"relayhost = \n"
"mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.0.0/16\n"
"mailbox_command = procmail -a \"$EXTENSION\"\n"
"mailbox_size_limit = 0\n"
"recipient_delimiter = +\n"
"inet_interfaces = all\n"
"inet_protocols = all\n"
msgstr ""
"\n"
"# Zobacz /usr/share/postfix/main.cf.dist dla skomentowanej, bardziej szczegółowej wersji.\n"
"\n"
"\n"
"# Specyficzne dla Debiana: Określenie nazwy pliku spowoduje, że pierwsza\n"
"# linia w tym pliku zostanie użyta jako nazwa. Domyślna dla Debiana to\n"
"# /etc/mailname.n\n"
"#myorigin = /etc/mailname\n"
"\n"
"smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)\n"
"biff = no\n"
"\n"
"# dodawanie domen najwyższego poziomu (.domena) jest po stronie MUA.\n"
"append_dot_mydomain = no\n"
"\n"
"# Odkomentuj następną linię, aby generować ostrzeżenia o \"opóźnionej poczcie\"\n"
"#delay_warning_time = 4h\n"
"\n"
"readme_directory = no\n"
"\n"
"# Parametry TLS\n"
"smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem\n"
"smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key\n"
"smtpd_use_tls=yes\n"
"smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache\n"
"smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache\n"
"\n"
"# Zobacz /usr/share/doc/postfix/TLS_README.gz z pakietu postfix-doc dla\n"
"# informacji jak włączyć SSL w kliencie smtp.\n"
"\n"
"myhostname = mail.falcot.com\n"
"alias_maps = hash:/etc/aliases\n"
"alias_database = hash:/etc/aliases\n"
"myorigin = /etc/mailname\n"
"mydestination = mail.falcot.com, falcot.com, localhost.localdomain, localhost\n"
"relayhost = \n"
"mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.0.0/16\n"
"mailbox_command = procmail -a \"$EXTENSION\"\n"
"mailbox_size_limit = 0\n"
"recipient_delimiter = +\n"
"inet_interfaces = all\n"
"inet_protocols = all\n"

#. Tag: title
#, no-c-format
msgid "<emphasis>SECURITY</emphasis> <emphasis>Snake oil</emphasis> SSL certificates"
msgstr "<emphasis>BEZPIECZEŃSTWO</emphasis> Certyfikaty SSL z <emphasis>podpisem własnym</emphasis>"

#. Tag: para
#, no-c-format
msgid "The <emphasis>snake oil</emphasis> certificates, like the <emphasis>snake oil</emphasis> “medicine” sold by unscrupulous quacks in old times, have absolutely no value, since they are generated similarly on all Debian systems, with the same “private” part. They should only be used for testing purposes, and normal service must use real certificates; these can be generated with the procedure described in <xref linkend=\"sect.easy-rsa\" />."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Configuring Virtual Domains"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>domain</primary><secondary>virtual</secondary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>virtual domain</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The mail server can receive emails addressed to other domains besides the main domain; these are then known as virtual domains. In most cases where this happens, the emails are not ultimately destined to local users. Postfix provides two interesting features for handling virtual domains."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>CAUTION</emphasis> Virtual domains and canonical domains"
msgstr ""

#. Tag: para
#, no-c-format
msgid "None of the virtual domains must be referenced in the <literal>mydestination</literal> variable; this variable only contains the names of the “canonical” domains directly associated to the machine and its local users."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Virtual Alias Domains"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>alias</primary><secondary>virtual alias domain</secondary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>virtual domain</primary><secondary>virtual alias domain</secondary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "A virtual alias domain only contains aliases, i.e. addresses that only forward emails to other addresses."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Such a domain is enabled by adding its name to the <literal>virtual_alias_domains</literal> variable, and referencing an address mapping file in the <literal>virtual_alias_maps</literal> variable."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Directives to add in the <filename>/etc/postfix/main.cf</filename> file"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"virtual_alias_domains = falcotsbrand.com\n"
"virtual_alias_maps = hash:/etc/postfix/virtual\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <filename>/etc/postfix/virtual</filename> file describes mapping with a rather straightforward syntax: each line contains two fields separated by whitespace; the first field is the alias name, the second field is a list of email addresses where it redirects. The special <literal>@domain.com</literal> syntax covers all remaining aliases in a domain."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Example <filename>/etc/postfix/virtual</filename> file"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"webmaster@falcotsbrand.com  jean@falcot.com\n"
"contact@falcotsbrand.com    laure@falcot.com, sophie@falcot.com\n"
"# The alias below is generic and covers all addresses within \n"
"# the falcotsbrand.com domain not otherwise covered by this file.\n"
"# These addresses forward email to the same user name in the\n"
"# falcot.com domain.\n"
"@falcotsbrand.com           @falcot.com\n"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Virtual Mailbox Domains"
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>CAUTION</emphasis> Combined virtual domain?"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Postfix does not allow using the same domain in both <literal>virtual_alias_domains</literal> and <literal>virtual_mailbox_domains</literal>. However, every domain of <literal>virtual_mailbox_domains</literal> is implicitly included in <literal>virtual_alias_domains</literal>, which makes it possible to mix aliases and mailboxes within a virtual domain."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>mailbox, virtual domain</primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>virtual domain</primary><secondary>virtual mailbox domain</secondary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Messages addressed to a virtual mailbox domain are stored in mailboxes not assigned to a local system user."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Enabling a virtual mailbox domain requires naming this domain in the <literal>virtual_mailbox_domains</literal> variable, and referencing a mailbox mapping file in <literal>virtual_mailbox_maps</literal>. The <literal>virtual_mailbox_base</literal> parameter contains the directory under which the mailboxes will be stored."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <literal>virtual_uid_maps</literal> parameter (respectively <literal>virtual_gid_maps</literal>) references the file containing the mapping between the email address and the system user (respectively group) that “owns” the corresponding mailbox. To get all mailboxes owned by the same owner/group, the <literal>static:5000</literal> syntax assigns a fixed UID/GID (of value 5000 here)."
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"virtual_mailbox_domains = falcot.org\n"
"virtual_mailbox_maps = hash:/etc/postfix/vmailbox\n"
"virtual_mailbox_base = /var/mail/vhosts\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Again, the syntax of the <filename>/etc/postfix/vmailbox</filename> file is quite straightforward: two fields separated with whitespace. The first field is an email address within one of the virtual domains, and the second field is the location of the associated mailbox (relative to the directory specified in <emphasis>virtual_mailbox_base</emphasis>). If the mailbox name ends with a slash (<literal>/</literal>), the emails will be stored in the <emphasis>maildir</emphasis> format; otherwise, the traditional <emphasis>mbox</emphasis> format will be used. The <emphasis>maildir</emphasis> format uses a whole directory to store a mailbox, each individual message being stored in a separate file. In the <emphasis>mbox</emphasis> format, on the other hand, the whole mailbox is stored in one file, and each line starting with “<literal>From </literal>” (<literal>From</literal> followed by a space) signals the start of a new message."
msgstr ""

#. Tag: title
#, no-c-format
msgid "The <filename>/etc/postfix/vmailbox</filename> file"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"# Jean's email is stored as maildir, with\n"
"# one file per email in a dedicated directory\n"
"jean@falcot.org falcot.org/jean/\n"
"# Sophie's email is stored in a traditional \"mbox\" file,\n"
"# with all mails concatenated into one single file\n"
"sophie@falcot.org falcot.org/sophie\n"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Restrictions for Receiving and Sending"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The growing number of unsolicited bulk emails (<emphasis>spam</emphasis>) requires being increasingly strict when deciding which emails a server should accept. This section presents some of the strategies included in Postfix."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>CULTURE</emphasis> The spam problem"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>spam</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "“Spam” is a generic term used to designate all the unsolicited commercial emails (also known as UCEs) that flood our electronic mailboxes; the unscrupulous individuals sending them are known as spammers. They care little about the nuisance they cause, since sending an email costs very little, and only a very small percentage of recipients need to be attracted by the offers for the spamming operation to make more money than it costs. The process is mostly automated, and any email address made public (for instance, on a web forum, or on the archives of a mailing list, or on a blog, and so on) will be discovered by the spammers' robots, and subjected to a never-ending stream of unsolicited messages."
msgstr ""

#. Tag: para
#, no-c-format
msgid "All system administrators try to face this nuisance with spam filters, but of course spammers keep adjusting to try to work around these filters. Some even rent networks of machines compromised by a worm from various crime syndicates. Recent statistics estimate that up to 95% of all emails circulating on the Internet are spam!"
msgstr ""

#. Tag: title
#, no-c-format
msgid "IP-Based Access Restrictions"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <literal>smtpd_client_restrictions</literal> directive controls which machines are allowed to communicate with the email server."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Restrictions Based on Client Address"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"smtpd_client_restrictions = permit_mynetworks,\n"
"    warn_if_reject reject_unknown_client,\n"
"    check_client_access hash:/etc/postfix/access_clientip,\n"
"    reject_rbl_client sbl-xbl.spamhaus.org,\n"
"    reject_rbl_client list.dsbl.org\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "When a variable contains a list of rules, as in the example above, these rules are evaluated in order, from the first to the last. Each rule can accept the message, reject it, or leave the decision to a following rule. As a consequence, order matters, and simply switching two rules can lead to a widely different behavior."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <literal>permit_mynetworks</literal> directive, used as the first rule, accepts all emails coming from a machine in the local network (as defined by the <emphasis>mynetworks</emphasis> configuration variable)."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The second directive would normally reject emails coming from machines without a completely valid DNS configuration. Such a valid configuration means that the IP address can be resolved to a name, and that this name, in turn, resolves to the IP address. This restriction is often too strict, since many email servers do not have a reverse DNS for their IP address. This explains why the Falcot administrators prepended the <literal>warn_if_reject</literal> modifier to the <literal>reject_unknown_client</literal> directive: this modifier turns the rejection into a simple warning recorded in the logs. The administrators can then keep an eye on the number of messages that would be rejected if the rule were actually enforced, and make an informed decision later if they wish to enable such enforcement."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>TIP</emphasis> <emphasis>access</emphasis> tables"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The restriction criteria include administrator-modifiable tables listing combinations of senders, IP addresses, and allowed or forbidden hostnames. These tables can be created from an uncompressed copy of the <filename>/usr/share/doc/postfix-doc/examples/access.gz</filename> file. This model is self-documented in its comments, which means each table describes its own syntax."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <filename>/etc/postfix/access_clientip</filename> table lists IP addresses and networks; <filename>/etc/postfix/access_helo</filename> lists domain names; <filename>/etc/postfix/access_sender</filename> contains sender email addresses. All these files need to be turned into hash-tables (a format optimized for fast access) after each change, with the <command>postmap /etc/postfix/<replaceable>file</replaceable></command> command."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The third directive allows the administrator to set up a black list and a white list of email servers, stored in the <filename>/etc/postfix/access_clientip</filename> file. Servers in the white list are considered as trusted, and the emails coming from there therefore do not go through the following filtering rules."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The last two rules reject any message coming from a server listed in one of the indicated black lists. RBL is an acronym for <emphasis>Remote Black List</emphasis>; there are several such lists, but they all list badly configured servers that spammers use to relay their emails, as well as unexpected mail relays such as machines infected with worms or viruses."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>RBL</primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>Remote Black List</primary>"
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>TIP</emphasis> White list and RBLs"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Black lists sometimes include a legitimate server that has been suffering an incident. In these situations, all emails coming from one of these servers would be rejected unless the server is listed in a whitelist defined by <filename>/etc/postfix/access_clientip</filename>."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Prudence therefore recommends including in the white list all the trusted servers from which many emails are usually received."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Checking the Validity of the <literal>EHLO</literal> or <literal>HELO</literal> Commands"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Each SMTP exchange starts with a <literal>HELO</literal> (or <literal>EHLO</literal>) command, followed by the name of the sending email server; checking the validity of this name can be interesting."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><literal>HELO</literal></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><literal>EHLO</literal></primary>"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Restrictions on the name announced in <literal>EHLO</literal>"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"smtpd_helo_restrictions = permit_mynetworks,\n"
"    reject_invalid_hostname,\n"
"    check_helo_access hash:/etc/postfix/access_helo,\n"
"    reject_non_fqdn_hostname,\n"
"    warn_if_reject reject_unknown_hostname\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The first <literal>permit_mynetworks</literal> directive allows all machines on the local network to introduce themselves freely. This is important, because some email programs do not respect this part of the SMTP protocol adequately enough, and they can introduce themselves with nonsensical names."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <literal>reject_invalid_hostname</literal> rule rejects emails when the <literal>EHLO</literal> announce lists a syntactically incorrect hostname. The <literal>reject_non_fqdn_hostname</literal> rule rejects messages when the announced hostname is not a fully-qualified domain name (including a domain name as well as a host name). The <literal>reject_unknown_hostname</literal> rule rejects messages if the announced name does not exist in the DNS. Since this last rule unfortunately leads to too many rejections, the administrators turned its effect to a simple warning with the <literal>warn_if_reject</literal> modifier as a first step; they may decide to remove this modifier at a later stage, after auditing the results of this rule."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Using <literal>permit_mynetworks</literal> as the first rule has an interesting side effect: the following rules only apply to hosts outside the local network. This allows blacklisting all hosts that announce themselves as part of the <literal>falcot.com</literal>, for instance by adding a <literal>falcot.com REJECT You're not in our network!</literal> line to the <filename>/etc/postfix/access_helo</filename> file."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Accepting or Refusing Based on the Announced Sender"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Every message has a sender, announced by the <literal>MAIL FROM</literal> command of the SMTP protocol; again, this information can be validated in several different ways."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><literal>MAIL FROM</literal></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>email</primary><secondary>filtering on the sender</secondary>"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Sender checks"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"smtpd_sender_restrictions = \n"
"    check_sender_access hash:/etc/postfix/access_sender,\n"
"    reject_unknown_sender_domain, reject_unlisted_sender,\n"
"    reject_non_fqdn_sender\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <filename>/etc/postfix/access_sender</filename> table maps some special treatment to some senders. This usually means listing some senders into a white list or a black list."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <literal>reject_unknown_sender_domain</literal> rule requires a valid sender domain, since it is needed for a valid address. The <literal>reject_unlisted_sender</literal> rule rejects local senders if the address does not exist; this prevents emails from being sent from an invalid address in the <literal>falcot.com</literal> domain, and messages emanating from <literal>joe.bloggs@falcot.com</literal> are only accepted if such an address really exists."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Finally, the <literal>reject_non_fqdn_sender</literal> rule rejects emails purporting to come from addresses without a fully-qualified domain name. In practice, this means rejecting emails coming from <literal>user@machine</literal>: the address must be announced as either <literal>user@machine.example.com</literal> or <literal>user@example.com</literal>."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Accepting or Refusing Based on the Recipient"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Each email has at least one recipient, announced with the <literal>RCPT TO</literal> command in the SMTP protocol. These addresses also warrant validation, even if that may be less relevant than the checks made on the sender address."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>RCPT TO</primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>email</primary><secondary>filtering on the recipient</secondary>"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Recipient checks"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"smtpd_recipient_restrictions = permit_mynetworks, \n"
"    reject_unauth_destination, reject_unlisted_recipient, \n"
"    reject_non_fqdn_recipient\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "<literal>reject_unauth_destination</literal> is the basic rule that requires outside messages to be addressed to us; messages sent to an address not served by this server are rejected. Without this rule, a server becomes an open relay that allows spammers to sent unsolicited emails; this rule is therefore mandatory, and it will be best included near the beginning of the list, so that no other rules may authorize the message before its destination has been checked."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <literal>reject_unlisted_recipient</literal> rule rejects messages sent to non-existing local users, which makes sense. Finally, the <literal>reject_non_fqdn_recipient</literal> rule rejects non-fully-qualified addresses; this makes it impossible to send an email to <literal>jean</literal> or <literal>jean@machine</literal>, and requires using the full address instead, such as <literal>jean@machine.falcot.com</literal> or <literal>jean@falcot.com</literal>."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Restrictions Associated with the <literal>DATA</literal> Command"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <literal>DATA</literal> command of SMTP is emitted before the contents of the message. It doesn't provide any information per se, apart from announcing what comes next. It can still be subjected to checks."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><literal>DATA</literal></primary>"
msgstr ""

#. Tag: title
#, no-c-format
msgid "<literal>DATA</literal> checks"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"smtpd_data_restrictions = reject_unauth_pipelining\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <literal>reject_unauth_pipelining</literal> directives causes the message to be rejected if the sending party sends a command before the reply to the previous command has been sent. This guards against a common optimization used by spammer robots, since they usually don't care a fig about replies and only focus on sending as many emails as possible in as short a time as possible."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Applying Restrictions"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Although the above commands validate information at various stages of the SMTP exchange, Postfix only sends the actual rejection as a reply to the <literal>RCPT TO</literal> command."
msgstr ""

#. Tag: para
#, no-c-format
msgid "This means that even if the message is rejected due to an invalid <literal>EHLO</literal> command, Postfix knows the sender and the recipient when announcing the rejection. It can then log a more explicit message than it could if the transaction had been interrupted from the start. In addition, a number of SMTP clients do not expect failures on the early SMTP commands, and these clients will be less disturbed by this late rejection."
msgstr ""

#. Tag: para
#, no-c-format
msgid "A final advantage to this choice is that the rules can accumulate information during the various stages of the SMTP exchange; this allows defining more fine-grained permissions, such as rejecting a non-local connection if it announces itself with a local sender."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Filtering Based on the Message Contents"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The validation and restriction system would not be complete without a way to apply checks to the message contents. Postfix differentiates the checks applying on the email headers from those applying to the email body."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Enabling content-based filters"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"header_checks = regexp:/etc/postfix/header_checks\n"
"body_checks = regexp:/etc/postfix/body_checks\n"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>email</primary><secondary>filtering on contents</secondary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Both files contain a list of regular expressions (commonly known as <emphasis>regexps</emphasis> or <emphasis>regexes</emphasis>) and associated actions to be triggered when the email headers (or body) match the expression."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>QUICK LOOK</emphasis> Regexp tables"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <filename>/usr/share/doc/postfix-doc/examples/header_checks.gz</filename> file contains many explanatory comments and can be used as a starting point for creating the <filename>/etc/postfix/header_checks</filename> and <filename>/etc/postfix/body_checks</filename> files."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Example <filename>/etc/postfix/header_checks</filename> file"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"/^X-Mailer: GOTO Sarbacane/ REJECT I fight spam (GOTO Sarbacane)\n"
"/^Subject: *Your email contains VIRUSES/ DISCARD virus notification\n"
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>BACK TO BASICS</emphasis> Regular expression"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <emphasis>regular expression</emphasis> term (shortened to <emphasis>regexp</emphasis> or <emphasis>regex</emphasis>) references a generic notation for expressing a description of the contents and/or structure of a string of characters. Certain special characters allow defining alternatives (for instance, <literal>foo|bar</literal> matches either “foo” or “bar”), sets of allowed characters (for instance, <literal>[0-9]</literal> means any digit, and <literal>.</literal> — a dot — means any character), quantifications (<literal>s?</literal> matches either <literal>s</literal> or the empty string, in other words 0 or 1 occurrence of <literal>s</literal>; <literal>s+</literal> matches one or more consecutive <literal>s</literal> characters; and so on). Parentheses allow grouping search results."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The precise syntax of these expressions varies across the tools using them, but the basic features are similar. <ulink type=\"block\" url=\"http://en.wikipedia.org/wiki/Regular_expression\" />"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The first one checks the header mentioning the email software; if <literal>GOTO Sarbacane</literal> (a bulk email software) is found, the message is rejected. The second expression controls the message subject; if it mentions a virus notification, we can decide not to reject the message but to discard it immediately instead."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Using these filters is a double-edged sword, because it is easy to make the rules too generic and to lose legitimate emails as a consequence. In these cases, not only the messages will be lost, but their senders will get unwanted (and annoying) error messages."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Setting Up <foreignphrase>greylisting</foreignphrase>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>greylisting</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "“Greylisting” is a filtering technique according to which a message is initially rejected with a temporary error code, and only accepted on a further try after some delay. This filtering is particularly efficient against spam sent by the many machines infected by worms and viruses, since these software rarely act as full SMTP agents (by checking the error code and retrying failed messages later), especially since many of the harvested addresses are really invalid and retrying would only mean losing time."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Postfix doesn't provide greylisting natively, but there is a feature by which the decision to accept or reject a given message can be delegated to an external program. The <emphasis role=\"pkg\">postgrey</emphasis> package contains just such a program, designed to interface with this access policy delegation service."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Once <emphasis role=\"pkg\">postgrey</emphasis> is installed, it runs as a daemon and listens on port 10023. Postfix can then be configured to use it, by adding the <literal>check_policy_service</literal> parameter as an extra restriction:"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"smtpd_recipient_restrictions = permit_mynetworks,\n"
"    [...]\n"
"    check_policy_service inet:127.0.0.1:10023\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Each time Postfix reaches this rule in the ruleset, it will connect to the <command>postgrey</command> daemon and send it information concerning the relevant message. On its side, Postgrey considers the IP address/sender/recipient triplet and checks in its database whether that same triplet has been seen recently. If so, Postgrey replies that the message should be accepted; if not, the reply indicates that the message should be temporarily rejected, and the triplet gets recorded in the database."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The main disadvantage of greylisting is that legitimate messages get delayed, which is not always acceptable. It also increases the burden on servers that send many legitimate emails."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>IN PRACTICE</emphasis> Shortcomings of greylisting"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Theoretically, greylisting should only delay the first mail from a given sender to a given recipient, and the typical delay is in the order of minutes. Reality, however, can differ slightly. Some large ISPs use clusters of SMTP servers, and when a message is initially rejected, the server that retries the transmission may not be the same as the initial one. When that happens, the second server gets a temporary error message due to greylisting too, and so on; it may take several hours until transmission is attempted by a server that has already been involved, since SMTP servers usually increase the delay between retries at each failure."
msgstr ""

#. Tag: para
#, no-c-format
msgid "As a consequence, the incoming IP address may vary in time even for a single sender. But it goes further: even the sender address can change. For instance, many mailing-list servers encode extra information in the sender address so as to be able to handle error messages (known as <emphasis>bounces</emphasis>). Each new message sent to a mailing-list may then need to go through greylisting, which means it has to be stored (temporarily) on the sender's server. For very large mailing-lists (with tens of thousands of subscribers), this can soon become a problem."
msgstr ""

#. Tag: para
#, no-c-format
msgid "To mitigate these drawbacks, Postgrey manages a whitelist of such sites, and messages emanating from them are immediately accepted without going through greylisting. This list can easily be adapted to local needs, since it's stored in the <filename>/etc/postgrey/whitelist_clients</filename> file."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>GOING FURTHER</emphasis> Selective greylisting with <emphasis role=\"pkg\">milter-greylist</emphasis>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The drawbacks of greylisting can be mitigated by only using greylisting on the subset of clients that are already considered as probable sources of spam (because they are listed in a DNS black-list). This is not possible with <emphasis role=\"pkg\">postgrey</emphasis> but <emphasis role=\"pkg\">milter-greylist</emphasis> can be used in such a way."
msgstr ""

#. Tag: para
#, no-c-format
msgid "In that scenario, since DNS black-lists never triggers a definitive rejection, it becomes reasonable to use aggressive black-lists, including those listing all dynamic IP addresses from ISP clients (such as <literal>pbl.spamhaus.org</literal> or <literal>dul.dnsbl.sorbs.net</literal>)."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Since milter-greylist uses Sendmail's milter interface, the postfix side of its configuration is limited to “<literal>smtpd_milters = unix:/var/milter-greylist/milter-greylist.sock</literal>”. The <citerefentry><refentrytitle>greylist.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry> manual page documents <filename>/etc/milter-greylist/greylist.conf</filename> and the numerous ways to configure milter-greylist."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Customizing Filters Based On the Recipient"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The last two sections reviewed many of the possible restrictions. They all have their use in limiting the amount of received spam, but they also all have their drawbacks. It is therefore more and more common to customize the set of filters depending on the recipient. At Falcot Corp, greylisting is interesting for most users, but it hinders the work of some users who need low latency in their emails (such as the technical support service). Similarly, the commercial service sometimes has problems receiving emails from some Asian providers who may be listed in black-lists; this service asked for a non-filtered address so as to be able to correspond."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Postfix provides such a customization of filters with a “restriction class” concept. The classes are declared in the <literal>smtpd_restriction_classes</literal> parameter, and defined the same way as <literal>smtpd_recipient_restrictions</literal>. The <literal>check_recipient_access</literal> directive then defines a table mapping a given recipient to the appropriate set of restrictions."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Defining restriction classes in <filename>main.cf</filename>"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"smtpd_restriction_classes = greylisting, aggressive, permissive\n"
"\n"
"greylisting = check_policy_service inet:127.0.0.1:10023\n"
"aggressive = reject_rbl_client sbl-xbl.spamhaus.org,\n"
"        check_policy_service inet:127.0.0.1:10023\n"
"permissive = permit\n"
"\n"
"smtpd_recipient_restrictions = permit_mynetworks,\n"
"        reject_unauth_destination,\n"
"        check_recipient_access hash:/etc/postfix/recipient_access\n"
msgstr ""

#. Tag: title
#, no-c-format
msgid "The <filename>/etc/postfix/recipient_access</filename> file"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"# Unfiltered addresses\n"
"postmaster@falcot.com  permissive\n"
"support@falcot.com     permissive\n"
"sales-asia@falcot.com  permissive\n"
"\n"
"# Aggressive filtering for some privileged users\n"
"joe@falcot.com         aggressive\n"
"\n"
"# Special rule for the mailing-list manager\n"
"sympa@falcot.com       reject_unverified_sender\n"
"\n"
"# Greylisting by default\n"
"falcot.com             greylisting\n"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Integrating an Antivirus"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>antivirus</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The many viruses circulating as attachments to emails make it important to set up an antivirus at the entry point of the company network, since despite an awareness campaign, some users will still open attachments from obviously shady messages."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The Falcot administrators selected <command>clamav</command> for their free antivirus. The main package is <emphasis role=\"pkg\">clamav</emphasis>, but they also installed a few extra packages such as <emphasis role=\"pkg\">arj</emphasis>, <emphasis role=\"pkg\">unzoo</emphasis>, <emphasis role=\"pkg\">unrar</emphasis> and <emphasis role=\"pkg\">lha</emphasis>, since they are required for the antivirus to analyze attachments archived in one of these formats."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><command>clamav</command></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><command>clamav-milter</command></primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The task of interfacing between antivirus and the email server goes to <command>clamav-milter</command>. A <emphasis>milter</emphasis> (short for <emphasis>mail filter</emphasis>) is a filtering program specially designed to interface with email servers. A milter uses a standard application programming interface (API) that provides much better performance than filters external to the email servers. Milters were initially introduced by <emphasis>Sendmail</emphasis>, but <emphasis>Postfix</emphasis> soon followed suit."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>QUICK LOOK</emphasis> A milter for Spamassassin"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><emphasis role=\"pkg\">spamass-milter</emphasis></primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <emphasis role=\"pkg\">spamass-milter</emphasis> package provides a milter based on <emphasis>SpamAssassin</emphasis>, the famous unsolicited email detector. It can be used to flag messages as probable spams (by adding an extra header) and/or to reject the messages altogether if their “spamminess” score goes beyond a given threshold."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Once the <emphasis role=\"pkg\">clamav-milter</emphasis> package is installed, the milter should be reconfigured to run on a TCP port rather than on the default named socket. This can be achieved with <command>dpkg-reconfigure clamav-milter</command>. When prompted for the “Communication interface with Sendmail”, answer “<literal>inet:10002@127.0.0.1</literal>”."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>NOTE</emphasis> Real TCP port vs named socket"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The reason why we use a real TCP port rather than the named socket is that the postfix daemons often run chrooted and do not have access to the directory hosting the named socket. You could also decide to keep using a named socket and pick a location within the chroot (<filename>/var/spool/postfix/</filename>)."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The standard ClamAV configuration fits most situations, but some important parameters can still be customized with <command>dpkg-reconfigure clamav-base</command>."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The last step involves telling Postfix to use the recently-configured filter. This is a simple matter of adding the following directive to <filename>/etc/postfix/main.cf</filename>:"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"# Virus check with clamav-milter\n"
"smtpd_milters = inet:[127.0.0.1]:10002\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "If the antivirus causes problems, this line can be commented out, and <command>/etc/init.d/postfix reload</command> should be run so that this change is taken into account."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>IN PRACTICE</emphasis> Testing the antivirus"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Once the antivirus is set up, its correct behavior should be tested. The simplest way to do that is to send a test email with an attachment containing the <filename>eicar.com</filename> (or <filename>eicar.com.zip</filename>) file, which can be downloaded online: <ulink type=\"block\" url=\"http://www.eicar.org/anti_virus_test_file.htm\" />"
msgstr ""

#. Tag: para
#, no-c-format
msgid "This file is not a true virus, but a test file that all antivirus software on the market diagnose as a virus to allow checking installations."
msgstr ""

#. Tag: para
#, no-c-format
msgid "All messages handled by Postfix now go through the antivirus filter."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Authenticated SMTP"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Being able to send emails requires an SMTP server to be reachable; it also requires said SMTP server to send emails through it. For roaming users, that may need regularly changing the configuration of the SMTP client, since Falcot's SMTP server rejects messages coming from IP addresses apparently not belonging to the company. Two solutions exist: either the roaming user installs an SMTP server on their computer, or they still use the company server with some means of authenticating as an employee. The former solution is not recommended since the computer won't be permanently connected, and it won't be able to retry sending messages in case of problems; we will focus on the latter solution."
msgstr ""

#. Tag: para
#, no-c-format
msgid "SMTP authentication in Postfix relies on SASL (<emphasis>Simple Authentication and Security Layer</emphasis>). It requires installing the <emphasis role=\"pkg\">libsasl2-modules</emphasis> and <emphasis role=\"pkg\">sasl2-bin</emphasis> packages, then registering a password in the SASL database for each user that needs authenticating on the SMTP server. This is done with the <command>saslpasswd2</command> command, which takes several parameters. The <literal>-u</literal> option defines the authentication domain, which must match the <literal>smtpd_sasl_local_domain</literal> parameter in the Postfix configuration. The <literal>-c</literal> option allows creating a user, and <literal>-f</literal> allows specifying the file to use if the SASL database needs to be stored at a different location than the default (<filename>/etc/sasldb2</filename>)."
msgstr ""

#. Tag: screen
#, no-c-format
msgid ""
"\n"
"<computeroutput># </computeroutput><userinput>saslpasswd2 -u `postconf -h myhostname` -f /var/spool/postfix/etc/sasldb2 -c jean</userinput>\n"
"<computeroutput>[... type jean's password twice ...]</computeroutput>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Note that the SASL database was created in Postfix's directory. In order to ensure consistency, we also turn <filename>/etc/sasldb2</filename> into a symbolic link pointing at the database used by Postfix, with the <command>ln -sf /var/spool/postfix/etc/sasldb2 /etc/sasldb2</command> command."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Now we need to configure Postfix to use SASL. First the <literal>postfix</literal> user needs to be added to the <literal>sasl</literal> group, so that it can access the SASL account database. A few new parameters are also needed to enable SASL, and the <literal>smtpd_recipient_restrictions</literal> parameter needs to be configured to allow SASL-authenticated clients to send emails freely."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Enabling SASL in <filename>/etc/postfix/main.cf</filename>"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"# Enable SASL authentication\n"
"smtpd_sasl_auth_enable = yes\n"
"# Define the SASL authentication domain to use\n"
"smtpd_sasl_local_domain = $myhostname\n"
"[...]\n"
"# Adding permit_sasl_authenticated before reject_unauth_destination\n"
"# allows relaying mail sent by SASL-authenticated users\n"
"smtpd_recipient_restrictions = permit_mynetworks,\n"
"    permit_sasl_authenticated,\n"
"    reject_unauth_destination,\n"
"[...]\n"
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>EXTRA</emphasis> Authenticated SMTP client"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Most email clients are able to authenticate to an SMTP server before sending outgoing messages, and using that feature is a simple matter of configuring the appropriate parameters. If the client in use does not provide that feature, the workaround is to use a local Postfix server and configure it to relay email via the remote SMTP server. In this case, the local Postfix itself will be the client that authenticates with SASL. Here are the required parameters:"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"smtp_sasl_auth_enable = yes\n"
"smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd\n"
"relay_host = [mail.falcot.com]\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <filename>/etc/postfix/sasl_passwd</filename> file needs to contain the username and password to use for authenticating on the <literal>mail.falcot.com</literal> server. Here's an example:"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"[mail.falcot.com]   joe:LyinIsji\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "As for all Postfix maps, this file must be turned into <filename>/etc/postfix/sasl_passwd.db</filename> with the <command>postmap</command> command."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Web Server (HTTP)"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The Falcot Corp administrators decided to use the Apache HTTP server, included in Debian <emphasis role=\"distribution\">Wheezy</emphasis> at version 2.2.22."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><command>apache</command></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>server</primary><secondary>web</secondary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>web server</primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>server</primary><secondary>HTTP</secondary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>HTTP</primary><secondary>server</secondary>"
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>ALTERNATIVE</emphasis> Other web servers"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Apache is merely the most widely-known (and widely-used) web server, but there are others; they can offer better performance under certain workloads, but this has its counterpart in the smaller number of available features and modules. However, when the prospective web server is built to serve static files or to act as a proxy, the alternatives, such as <emphasis role=\"pkg\">nginx</emphasis> and <emphasis role=\"pkg\">lighttpd</emphasis>, are worth investigating."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><emphasis role=\"pkg\">nginx</emphasis></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><emphasis role=\"pkg\">lighttpd</emphasis></primary>"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Installing Apache"
msgstr ""

#. Tag: para
#, no-c-format
msgid "By default, installing the <emphasis role=\"pkg\">apache2</emphasis> package causes the <emphasis role=\"pkg\">apache2-mpm-worker</emphasis> version of Apache to be installed too. The <emphasis role=\"pkg\">apache2</emphasis> package is an empty shell, and it only serves to ensure that one of the Apache versions is actually installed."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The differences between the variants of Apache 2 are concentrated in the policy used to handle parallel processing of many requests; this policy is implemented by an MPM (short for <emphasis>Multi-Processing Module</emphasis>). Among the available MPMs, <emphasis role=\"pkg\">apache2-mpm-worker</emphasis> uses <emphasis>threads</emphasis> (lightweight processes), whereas <emphasis role=\"pkg\">apache2-mpm-prefork</emphasis> uses a pool of processes created in advance (the traditional way, and the only one available in Apache 1.3). <emphasis role=\"pkg\">apache2-mpm-event</emphasis> also uses threads, but they are terminated earlier, when the incoming connection is only kept open by the HTTP <emphasis>keep-alive</emphasis> feature."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The Falcot administrators also install <emphasis role=\"pkg\">libapache2-mod-php5</emphasis> so as to include the PHP support in Apache. This causes <emphasis role=\"pkg\">apache2-mpm-worker</emphasis> to be removed, and <emphasis role=\"pkg\">apache2-mpm-prefork</emphasis> to be installed instead, since PHP only works under that particular MPM."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>SECURITY</emphasis> Execution under the <literal>www-data</literal> user"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><literal>www-data</literal></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>suexec</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "By default, Apache handles incoming requests under the identity of the <literal>www-data</literal> user. This means that a security vulnerability in a CGI script executed by Apache (for a dynamic page) won't compromise the whole system, but only the files owned by this particular user."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Using the <emphasis>suexec</emphasis> modules allows bypassing this rule so that some CGI scripts are executed under the identity of another user. This is configured with a <literal>SuexecUserGroup <replaceable>user</replaceable><replaceable>group</replaceable></literal> directive in the Apache configuration."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><emphasis role=\"pkg\">apache2-mpm-itk</emphasis></primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Another possibility is to use a dedicated MPM, such as the one provided by <emphasis role=\"pkg\">apache2-mpm-itk</emphasis>. This particular one has a slightly different behavior: it allows “isolating” virtual hosts so that they each run as a different user. A vulnerability in one website therefore cannot compromise files belonging to the owner of another website."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>QUICK LOOK</emphasis> List of modules"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The full list of Apache standard modules can be found online. <ulink type=\"block\" url=\"http://httpd.apache.org/docs/2.2/mod/index.html\" />"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Apache is a modular server, and many features are implemented by external modules that the main program loads during its initialization. The default configuration only enables the most common modules, but enabling new modules is a simple matter of running <command>a2enmod <replaceable>module</replaceable></command>; to disable a module, the command is <command>a2dismod <replaceable>module</replaceable></command>. These programs actually only create (or delete) symbolic links in <filename>/etc/apache2/mods-enabled/</filename>, pointing at the actual files (stored in <filename>/etc/apache2/mods-available/</filename>)."
msgstr ""

#. Tag: para
#, no-c-format
msgid "With its default configuration, the web server listens on port 80 (as configured in <filename>/etc/apache2/ports.conf</filename>), and serves pages from the <filename>/var/www/</filename> directory (as configured in <filename>/etc/apache2/sites-enabled/000-default</filename>)."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>GOING FURTHER</emphasis> Adding support for SSL"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>HTTPS</primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>HTTP</primary><secondary>secure</secondary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Apache 2.2 includes the SSL module required for secure HTTP (HTTPS) out of the box. It just needs to be enabled with <command>a2enmod ssl</command>, then the required directives have to be added to the configuration files. A configuration example is provided in <filename>/usr/share/doc/apache2.2-common/examples/apache2/extra/httpd-ssl.conf.gz</filename>. <ulink type=\"block\" url=\"http://httpd.apache.org/docs/2.2/mod/mod_ssl.html\" />"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Some extra care must be taken if you want to favor SSL connections with <emphasis>Perfect Forward Secrecy</emphasis> (those connections use ephemeral session keys ensuring that a compromission of the server's secret key does not result in the compromission of old encrypted traffic that could have been stored while sniffing on the network). Have a look at Mozilla's recommandations in particular: <ulink type=\"block\" url=\"https://wiki.mozilla.org/Security/Server_Side_TLS#Apache\" />"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><emphasis>Perfect Forward Secrecy</emphasis></primary>"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Configuring Virtual Hosts"
msgstr ""

#. Tag: para
#, no-c-format
msgid "A virtual host is an extra identity for the web server."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>virtual host</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Apache considers two different kinds of virtual hosts: those that are based on the IP address (or the port), and those that rely on the domain name of the web server. The first method requires allocating a different IP address (or port) for each site, whereas the second one can work on a single IP address (and port), and the sites are differentiated by the hostname sent by the HTTP client (which only works in version 1.1 of the HTTP protocol — fortunately that version is old enough that all clients use it already)."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The (increasing) scarcity of IPv4 addresses usually favors the second method; however, it is made more complex if the virtual hosts need to provide HTTPS too, since the SSL protocol hasn't always provided for name-based virtual hosting; the SNI extension (<emphasis>Server Name Indication</emphasis>) that allows such a combination is not handled by all browsers. When several HTTPS sites need to run on the same server, they will usually be differentiated either by running on a different port or on a different IP address (IPv6 can help there)."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The default configuration for Apache 2 enables name-based virtual hosts (with the <literal>NameVirtualHost *:80</literal> directive in the <filename>/etc/apache2/ports.conf</filename> file). In addition, a default virtual host is defined in the <literal>/etc/apache2/sites-enabled/000-default</literal> file; this virtual host will be used if no host matching the request sent by the client is found."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>CAUTION</emphasis> First virtual host"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Requests concerning unknown virtual hosts will always be served by the first defined virtual host, which is why we defined <literal>www.falcot.com</literal> first here."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>QUICK LOOK</emphasis> Apache supports SNI"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>Server Name Indication</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The Apache server supports an SSL protocol extension called <emphasis>Server Name Indication</emphasis> (SNI). This extension allows the browser to send the hostname of the web server during the establishment of the SSL connection, much earlier than the HTTP request itself, which was previously used to identify the requested virtual host among those hosted on the same server (with the same IP address and port). This allows Apache to select the most appropriate SSL certificate for the transaction to proceed."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Before SNI, Apache would always use the certificate defined in the default virtual host. Clients trying to access another virtual host would then display warnings, since the certificate they received didn't match the website they were trying to access. Fortunately, most browsers now work with SNI; this includes Microsoft Internet Explorer starting with version 7.0 (starting on Vista), Mozilla Firefox starting with version 2.0, Apple Safari since version 3.2.1, and all versions of Google Chrome."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The Apache package provided in Debian is built with support for SNI; no particular configuration is therefore needed, apart from enabling name-based virtual hosting on port 443 (SSL) as well as the usual port 80. This is a simple matter of editing <filename>/etc/apache2/ports.conf</filename> so it includes the following:"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"&lt;IfModule mod_ssl.c&gt;\n"
"    NameVirtualHost *:443\n"
"    Listen 443\n"
"&lt;/IfModule&gt;\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Care should also be taken to ensure that the configuration for the first virtual host (the one used by default) does enable TLSv1, since Apache uses the parameters of this first virtual host to establish secure connections, and they had better allow them!"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Each extra virtual host is then described by a file stored in <filename>/etc/apache2/sites-available/</filename>. Setting up a website for the <literal>falcot.org</literal> domain is therefore a simple matter of creating the following file, then enabling the virtual host with <command>a2ensite www.falcot.org</command>."
msgstr ""

#. Tag: title
#, no-c-format
msgid "The <filename>/etc/apache2/sites-available/www.falcot.org</filename> file"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"&lt;VirtualHost *:80&gt;\n"
"ServerName www.falcot.org\n"
"ServerAlias falcot.org\n"
"DocumentRoot /srv/www/www.falcot.org\n"
"&lt;/VirtualHost&gt;\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The Apache server, as configured so far, uses the same log files for all virtual hosts (although this could be changed by adding <literal>CustomLog</literal> directives in the definitions of the virtual hosts). It therefore makes good sense to customize the format of this log file to have it include the name of the virtual host. This can be done by creating a <filename>/etc/apache2/conf.d/customlog</filename> file that defines a new format for all log files (with the <literal>LogFormat</literal> directive). The <literal>CustomLog</literal> line must also be removed (or commented out) from the <filename>/etc/apache2/sites-available/default</filename> file."
msgstr ""

#. Tag: title
#, no-c-format
msgid "The <filename>/etc/apache2/conf.d/customlog</filename> file"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"# New log format including (virtual) host name\n"
"LogFormat \"%v %h %l %u %t \\\"%r\\\" %&gt;s %b \\\"%{Referer}i\\\" \\\"%{User-Agent}i\\\"\" vhost\n"
"\n"
"# Now let's use this \"vhost\" format by default\n"
"CustomLog /var/log/apache2/access.log vhost\n"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Common Directives"
msgstr ""

#. Tag: para
#, no-c-format
msgid "This section briefly reviews some of the commonly-used Apache configuration directives."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>Apache directives</primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>directives, Apache</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The main configuration file usually includes several <literal>Directory</literal> blocks; they allow specifying different behaviors for the server depending on the location of the file being served. Such a block commonly includes <literal>Options</literal> and <literal>AllowOverride</literal> directives."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><literal>Options</literal>, Apache directive</primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><literal>AllowOverride</literal>, Apache directive</primary>"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Directory block"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"&lt;Directory /var/www&gt;\n"
"Options Includes FollowSymlinks\n"
"AllowOverride All\n"
"DirectoryIndex index.php index.html index.htm\n"
"&lt;/Directory&gt;\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <literal>DirectoryIndex</literal> directive contains a list of files to try when the client request matches a directory. The first existing file in the list is used and sent as a response."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><literal>DirectoryIndex</literal>, Apache directive</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <literal>Options</literal> directive is followed by a list of options to enable. The <literal>None</literal> value disables all options; correspondingly, <literal>All</literal> enables them all except <literal>MultiViews</literal>. Available options include:"
msgstr ""

#. Tag: para
#, no-c-format
msgid "<literal>ExecCGI</literal> indicates that CGI scripts can be executed. <indexterm><primary><literal>ExecCGI</literal>, Apache directive</primary></indexterm>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "<literal>FollowSymlinks</literal> tells the server that symbolic links can be followed, and that the response should contain the contents of the target of such links. <indexterm><primary><literal>FollowSymlinks</literal>, Apache directive</primary></indexterm>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "<literal>SymlinksIfOwnerMatch</literal> also tells the server to follow symbolic links, but only when the link and the its target have the same owner. <indexterm><primary><literal>SymlinksIfOwnerMatch</literal>, Apache directive</primary></indexterm>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "<literal>Includes</literal> enables <emphasis>Server Side Includes</emphasis> (<emphasis>SSI</emphasis> for short). These are directives embedded in HTML pages and executed on the fly for each request. <indexterm><primary><literal>Includes</literal>, Apache directive</primary></indexterm>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "<literal>Indexes</literal> tells the server to list the contents of a directory if the HTTP request sent by the client points at a directory without an index file (ie, when no files mentioned by the <literal>DirectoryIndex</literal> directive exists in this directory). <indexterm><primary><literal>Indexes</literal>, Apache directive</primary></indexterm>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "<literal>MultiViews</literal> enables content negotiation; this can be used by the server to return a web page matching the preferred language as configured in the browser. <indexterm><primary><literal>MultiViews</literal>, Apache directive</primary></indexterm>"
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>BACK TO BASICS</emphasis> <filename>.htaccess</filename> file"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <filename>.htaccess</filename> file contains Apache configuration directives enforced each time a request concerns an element of the directory where it is stored. The scope of these directives also recurses to all the subdirectories within."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><filename>.htaccess</filename></primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Most of the directives that can occur in a <literal>Directory</literal> block are also legal in a <filename>.htaccess</filename> file."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <literal>AllowOverride</literal> directive lists all the options that can be enabled or disabled by way of a <filename>.htaccess</filename> file. A common use of this option is to restrict <literal>ExecCGI</literal>, so that the administrator chooses which users are allowed to run programs under the web server's identity (the <literal>www-data</literal> user)."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Requiring Authentication"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>web authentication</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "In some circumstances, access to part of a website needs to be restricted, so only legitimate users who provide a username and a password are granted access to the contents."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<filename>.htaccess</filename> file requiring authentication"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"Require valid-user\n"
"AuthName \"Private directory\"\n"
"AuthType Basic\n"
"AuthUserFile /etc/apache2/authfiles/htpasswd-private\n"
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>SECURITY</emphasis> No security"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The authentication system used in the above example (<literal>Basic</literal>) has minimal security as the password is sent in clear text (it is only encoded as <emphasis>base64</emphasis>, which is a simple encoding rather than an encryption method). It should also be noted that the documents “protected” by this mechanism also go over the network in the clear. If security is important, the whole HTTP connection should be encrypted with SSL."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <filename>/etc/apache2/authfiles/htpasswd-private</filename> file contains a list of users and passwords; it is commonly manipulated with the <command>htpasswd</command> command. For example, the following command is used to add a user or change their password: <indexterm><primary><command>htpasswd</command></primary></indexterm>"
msgstr ""

#. Tag: screen
#, no-c-format
msgid ""
"\n"
"<computeroutput># </computeroutput><userinput>htpasswd /etc/apache2/authfiles/htpasswd-private <replaceable>user</replaceable>\n"
"</userinput><computeroutput>New password:\n"
"Re-type new password:\n"
"Adding password for user <replaceable>user</replaceable>\n"
"</computeroutput>"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Restricting Access"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>web access restriction</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <literal>Allow from</literal> and <literal>Deny from</literal> directives control access restrictions for a directory (and its subdirectories, recursively)."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><literal>Allow from</literal>, Apache directive</primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><literal>Deny from</literal>, Apache directive</primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><literal>Order</literal>, Apache directive</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <literal>Order</literal> directive tells the server of the order in which the <literal>Allow from</literal> and <literal>Deny from</literal> directives are applied; the last one that matches takes precedence. In concrete terms, <literal>Order deny,allow</literal> allows access if no <literal>Deny from</literal> applies, or if an <literal>Allow from</literal> directive does. Conversely, <literal>Order allow,deny</literal> rejects access if no <literal>Allow from</literal> directive matches (or if a <literal>Deny from</literal> directive applies)."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <literal>Allow from</literal> and <literal>Deny from</literal> directives can be followed by an IP address, a network (such as <literal>192.168.0.0/255.255.255.0</literal>, <literal>192.168.0.0/24</literal> or even <literal>192.168.0</literal>), a hostname or a domain name, or the <literal>all</literal> keyword, designating everyone."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Reject by default but allow from the local network"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"Order deny,allow\n"
"Allow from 192.168.0.0/16\n"
"Deny from all\n"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Log Analyzers"
msgstr ""

#. Tag: para
#, no-c-format
msgid "A log analyzer is frequently installed on a web server; since the former provides the administrators with a precise idea of the usage patterns of the latter."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The Falcot Corp administrators selected <emphasis>AWStats</emphasis> (<emphasis>Advanced Web Statistics</emphasis>) to analyze their Apache log files."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><emphasis>AWStats</emphasis></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>web logs analyzer</primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>logs</primary><secondary>web logs analyzer</secondary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>analyzer of web logs</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The first configuration step is the customization of the <filename>/etc/awstats/awstats.conf</filename> file. The Falcot administrators keep it unchanged apart from the following parameters:"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"LogFile=\"/var/log/apache2/access.log\"\n"
"LogFormat = \"%virtualname %host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot\"\n"
"SiteDomain=\"www.falcot.com\"\n"
"HostAliases=\"falcot.com REGEX[^.*\\.falcot\\.com$]\"\n"
"DNSLookup=1\n"
"LoadPlugin=\"tooltips\"\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "All these parameters are documented by comments in the template file. In particular, the <varname>LogFile</varname> and <varname>LogFormat</varname> parameters describe the location and format of the log file and the information it contains; <varname>SiteDomain</varname> and <varname>HostAliases</varname> list the various names under which the main web site is known."
msgstr ""

#. Tag: para
#, no-c-format
msgid "For high traffic sites, <varname>DNSLookup</varname> should usually not be set to <literal>1</literal>; for smaller sites, such as the Falcot one described above, this setting allows getting more readable reports that include full machine names instead of raw IP addresses."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>SECURITY</emphasis> Access to statistics"
msgstr ""

#. Tag: para
#, no-c-format
msgid "AWStats makes its statistics available on the website with no restrictions by default, but restrictions can be set up so that only a few (probably internal) IP addresses can access them; the list of allowed IP addresses needs to be defined in the <varname>AllowAccessFromWebToFollowingIPAddresses</varname> parameter"
msgstr ""

#. Tag: para
#, no-c-format
msgid "AWStats will also be enabled for other virtual hosts; each virtual host needs its own configuration file, such as <filename>/etc/awstats/awstats.www.falcot.org.conf</filename>."
msgstr ""

#. Tag: title
#, no-c-format
msgid "AWStats configuration file for a virtual host"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"Include \"/etc/awstats/awstats.conf\"\n"
"SiteDomain=\"www.falcot.org\"\n"
"HostAliases=\"falcot.org\"\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "AWStats uses many icons stored in the <filename>/usr/share/awstats/icon/</filename> directory. In order for these icons to be available on the web site, the Apache configuration needs to be adapted to include the following directive:"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"Alias /awstats-icon/ /usr/share/awstats/icon/\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "After a few minutes (and once the script has been run a few times), the results are available online: <ulink type=\"block\" url=\"http://www.falcot.com/cgi-bin/awstats.pl\" /><ulink type=\"block\" url=\"http://www.falcot.org/cgi-bin/awstats.pl\" />"
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>CAUTION</emphasis> Log file rotation"
msgstr ""

#. Tag: para
#, no-c-format
msgid "In order for the statistics to take all the logs into account, <emphasis>AWStats</emphasis> needs to be run right before the Apache log files are rotated. Looking at the <literal>prerotate</literal> directive of <filename>/etc/logrotate.d/apache2</filename> file, this can be solved by putting a symlink to <filename>/usr/share/awstats/tools/update.sh</filename> in <filename>/etc/logrotate.d/httpd-prerotate</filename>:"
msgstr ""

#. Tag: screen
#, no-c-format
msgid ""
"\n"
"$ <userinput>cat /etc/logrotate.d/apache2</userinput>\n"
"/var/log/apache2/*.log {\n"
"  weekly\n"
"  missingok\n"
"  rotate 52\n"
"  compress\n"
"  delaycompress\n"
"  notifempty\n"
"  create 644 root adm\n"
"  sharedscripts\n"
"  postrotate\n"
"    /etc/init.d/apache2 reload &gt; /dev/null\n"
"  endscript\n"
"  prerotate\n"
"    if [ -d /etc/logrotate.d/httpd-prerotate ]; then \\\n"
"      run-parts /etc/logrotate.d/httpd-prerotate; \\\n"
"    fi; \\\n"
"  endscript\n"
"}\n"
"$ <userinput>sudo mkdir -p /etc/logrotate.d/httpd-prerotate</userinput>\n"
"$ <userinput>sudo ln -sf /usr/share/awstats/tools/update.sh \\\n"
"  /etc/logrotate.d/httpd-prerotate/awstats</userinput>\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Note also that the log files created by <command>logrotate</command> need to be readable by everyone, especially AWStats. In the above example, this is ensured by the <literal>create 644 root adm</literal> line (instead of the default <literal>640</literal> permissions)."
msgstr ""

#. Tag: title
#, no-c-format
msgid "FTP File Server"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>FTP (<emphasis>File Transfer Protocol</emphasis>)</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "FTP (<emphasis>File Transfer Protocol</emphasis>) is one of the first protocols of the Internet (RFC 959 was issued in 1985!). It was used to distribute files before the Web was even born (the HTTP protocol was created in 1990, and formally defined in its 1.0 version by RFC 1945, issued in 1996)."
msgstr ""

#. Tag: para
#, no-c-format
msgid "This protocol allows both file uploads and file downloads; for this reason, it is still widely used to deploy updates to a website hosted by one's Internet service provider (or any other entity hosting websites). In these cases, secure access is enforced with a user identifier and password; on successful authentication, the FTP server grants read-write access to that user's home directory."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Other FTP servers are mainly used to distribute files for public downloading; Debian packages are a good example. The contents of these servers is fetched from other, geographically remote, servers; it is then made available to less distant users. This means that client authentication is not required; as a consequence, this operating mode is known as “anonymous FTP”. To be perfectly correct, the clients do authenticate with the <literal>anonymous</literal> username; the password is often, by convention, the user's email address, but the server ignores it."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Many FTP servers are available in Debian (<emphasis role=\"pkg\">ftpd</emphasis>, <emphasis role=\"pkg\">proftpd-basic</emphasis>, <emphasis role=\"pkg\">pyftpd</emphasis> and so on). The Falcot Corp administrators picked <emphasis role=\"pkg\">vsftpd</emphasis> because they only use the FTP server to distribute a few files (including a Debian package repository); since they don't need advanced features, they chose to focus on the security aspects."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><emphasis role=\"pkg\">vsftpd</emphasis></primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Installing the package creates an <literal>ftp</literal> system user. This account is always used for anonymous FTP connections, and its home directory (<filename>/srv/ftp/</filename>) is the root of the tree made available to users connecting to this service. The default configuration (in <filename>/etc/vsftpd.conf</filename>) is very restrictive: it only allows read-only anonymous access (since the <literal>write_enable</literal> and <literal>anon_upload_enable</literal> options are disabled), and local users cannot connect with their usual username and password and access their own files (<literal>local_enable</literal> option). However, this default configuration is well-suited to the needs at Falcot Corp."
msgstr ""

#. Tag: title
#, no-c-format
msgid "NFS File Server"
msgstr ""

#. Tag: para
#, no-c-format
msgid "NFS (<emphasis>Network File System</emphasis>) is a protocol allowing remote access to a filesystem through the network. All Unix systems can work with this protocol; when Windows systems are involved, Samba must be used instead."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>NFS</primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><emphasis>Network</emphasis></primary><secondary><emphasis>File System</emphasis></secondary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>filesystem</primary><secondary>network</secondary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>file</primary><secondary>server</secondary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>server</primary><secondary>file</secondary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "NFS is a very useful tool, but its shortcomings must be kept in mind especially where security matters are concerned: all data goes over the network in the clear (a <emphasis>sniffer</emphasis> can intercept it); the server enforces access restrictions based on the client's IP address (which can be spoofed); and finally, when a client machine is granted access to a misconfigured NFS share, the client's root user can access all the files on the share (even those belonging to other users) since the server trusts the username it receives from the client (this is a historical limitation of the protocol)."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>DOCUMENTATION</emphasis> NFS HOWTO"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Even though it is relatively old, the NFS HOWTO is full of interesting information, including methods for optimizing performance. It also describes a way to secure NFS transfers with an SSH tunnel; however, that technique precludes the use of <command>lockd</command>. <ulink type=\"block\" url=\"http://nfs.sourceforge.net/nfs-howto/\" />"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Securing NFS"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>NFS</primary><secondary>security</secondary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Since NFS trusts the information it receives from the network, it is vital to ensure that only the machines allowed to use it can connect to the various required RPC servers. The firewall must also block <emphasis>IP spoofing</emphasis> so as to prevent an outside machine from acting as an inside one, and access to the appropriate ports must be restricted to the machines meant to access the NFS shares."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>BACK TO BASICS</emphasis> RPC"
msgstr ""

#. Tag: para
#, no-c-format
msgid "RPC (<emphasis>Remote Procedure Call</emphasis>) is a Unix standard for remote services. NFS is one such service."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>RPC</primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><emphasis>Remote Procedure Call</emphasis></primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "RPC services register to a directory known as the <emphasis>portmapper</emphasis>. A client wishing to perform an NFS query first addresses the <emphasis>portmapper</emphasis> (on port 111, either TCP or UDP), and asks for the NFS server; the reply usually mentions port 2049 (the default for NFS). Not all RPC services necessarily use a fixed port."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Other RPC services may be required for NFS to work optimally, including <command>rpc.mountd</command>, <command>rpc.statd</command> and <command>lockd</command>. However, these services use a random port (assigned by the <emphasis>portmapper</emphasis>) by default, which makes it difficult to filter traffic targeting these services. The Falcot Corp administrators found a work-around for this problem, described below."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><command>rpc.mountd</command></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><command>rpc.statd</command></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><command>lockd</command></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><command>portmapper</command></primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The first two services mentioned above are implemented by user-space programs, started respectively by <filename>/etc/init.d/nfs-kernel-server</filename> and <filename>/etc/init.d/nfs-common</filename>. They provide configuration options to force ports; the relevant files to modify to always use these options are <filename>/etc/default/nfs-kernel-server</filename> and <filename>/etc/default/nfs-common</filename>."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><emphasis>nfs-kernel-server</emphasis></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><filename>/etc/default/nfs-kernel-server</filename></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><filename>nfs-common</filename></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><filename>/etc/default/nfs-common</filename></primary>"
msgstr ""

#. Tag: title
#, no-c-format
msgid "The <filename>/etc/default/nfs-kernel-server</filename> file"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"# Number of servers to start up\n"
"RPCNFSDCOUNT=8\n"
"\n"
"# Runtime priority of server (see nice(1))\n"
"RPCNFSDPRIORITY=0\n"
"\n"
"# Options for rpc.mountd.\n"
"# If you have a port-based firewall, you might want to set up\n"
"# a fixed port here using the --port option. For more information, \n"
"# see rpc.mountd(8) or http://wiki.debian.org/SecuringNFS\n"
"# To disable NFSv4 on the server, specify '--no-nfs-version 4' here\n"
"RPCMOUNTDOPTS=\"--manage-gids --port 2048\"\n"
"\n"
"# Do you want to start the svcgssd daemon? It is only required for Kerberos\n"
"# exports. Valid alternatives are \"yes\" and \"no\"; the default is \"no\".\n"
"NEED_SVCGSSD=\n"
"\n"
"# Options for rpc.svcgssd.\n"
"RPCSVCGSSDOPTS=\n"
msgstr ""

#. Tag: title
#, no-c-format
msgid "The <filename>/etc/default/nfs-common</filename> file"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"# If you do not set values for the NEED_ options, they will be attempted\n"
"# autodetected; this should be sufficient for most people. Valid alternatives\n"
"# for the NEED_ options are \"yes\" and \"no\".\n"
"\n"
"# Do you want to start the statd daemon? It is not needed for NFSv4.\n"
"NEED_STATD=\n"
"\n"
"# Options for rpc.statd.\n"
"#   Should rpc.statd listen on a specific port? This is especially useful\n"
"#   when you have a port-based firewall. To use a fixed port, set this\n"
"#   this variable to a statd argument like: \"--port 4000 --outgoing-port 4001\".\n"
"#   For more information, see rpc.statd(8) or http://wiki.debian.org/SecuringNFS\n"
"STATDOPTS=\"--port 2046 --outgoing-port 2047\"\n"
"\n"
"# Do you want to start the idmapd daemon? It is only needed for NFSv4.\n"
"NEED_IDMAPD=\n"
"\n"
"# Do you want to start the gssd daemon? It is required for Kerberos mounts.\n"
"NEED_GSSD=\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Once these changes are made and the services are restarted, <command>rpc.mountd</command> uses port 2048; <command>rpc.statd</command> listens on port 2046 and uses port 2047 for outgoing connections."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <command>lockd</command> service is handled by a kernel <emphasis>thread</emphasis> (lightweight process); this feature is built as a module on Debian kernels. The module has two options allowing to always choose the same port, <literal>nlm_udpport</literal> and <literal>nlm_tcpport</literal>. In order for these options to be systematically used, there needs to be a <filename>/etc/modprobe.d/lockd</filename> file such as the following:"
msgstr ""

#. Tag: title
#, no-c-format
msgid "The <filename>/etc/modprobe.d/lockd</filename> file"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"options lockd nlm_udpport=2045 nlm_tcpport=2045\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Once these parameters are set, it becomes easier to control access to the NFS service from the firewall in a fine-grained way by filtering access to ports 111 and 2045 through 2049 (both UDP and TCP)."
msgstr ""

#. Tag: title
#, no-c-format
msgid "NFS Server"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The NFS server is part of the Linux kernel; in kernels provided by Debian it is built as a kernel module. If the NFS server is to be run automatically on boot, the <emphasis role=\"pkg\">nfs-kernel-server</emphasis> package should be installed; it contains the relevant start-up scripts."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The NFS server configuration file, <filename>/etc/exports</filename>, lists the directories that are made available over the network (<emphasis>exported</emphasis>). For each NFS share, only the given list of machines is granted access. More fine-grained access control can be obtained with a few options. The syntax for this file is quite simple:"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><filename>exports</filename></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><filename>/etc/exports</filename></primary>"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"/directory/to/share machine1(option1,option2,...) machine2(...) ...\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Each machine can be identified either by its DNS name or its IP address. Whole sets of machines can also be specified using either a syntax such as <literal>*.falcot.com</literal> or an IP address range such as <literal>192.168.0.0/255.255.255.0</literal> or <literal>192.168.0.0/24</literal>."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Directories are made available as read-only by default (or with the <literal>ro</literal> option). The <literal>rw</literal> option allows read-write access. NFS clients typically connect from a port restricted to root (in other words, below 1024); this restriction can be lifted by the <literal>insecure</literal> option (the <literal>secure</literal> option is implicit, but it can be made explicit if needed for clarity)."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>NFS</primary><secondary>options</secondary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "By default, the server only answers an NFS query when the current disk operation is complete (<literal>sync</literal> option); this can be disabled with the <literal>async</literal> option. Asynchronous writes increase performance a bit, but they decrease reliability since there's a data loss risk in case of the server crashing between the acknowledgment of the write and the actual write on disk. Since the default value changed recently (as compared to the historical value of NFS), an explicit setting is recommended."
msgstr ""

#. Tag: para
#, no-c-format
msgid "In order to not give root access to the filesystem to any NFS client, all queries appearing to come from a root user are considered by the server as coming from the <literal>nobody</literal> user. This behavior corresponds to the <literal>root_squash</literal> option, and is enabled by default. The <literal>no_root_squash</literal> option, which disables this behavior, is risky and should only be used in controlled environments. The <literal>anonuid=<replaceable>uid</replaceable></literal> and <literal>anongid=<replaceable>gid</replaceable></literal> options allow specifying another fake user to be used instead of UID/GID 65534 (which corresponds to user <literal>nobody</literal> and group <literal>nogroup</literal>)."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Other options are available; they are documented in the <citerefentry><refentrytitle>exports</refentrytitle> <manvolnum>5</manvolnum></citerefentry> manual page."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>CAUTION</emphasis> First installation"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <filename>/etc/init.d/nfs-kernel-server</filename> boot script only starts the server if the <filename>/etc/exports</filename> lists one or more valid NFS shares. On initial configuration, once this file has been edited to contain valid entries, the NFS server must therefore be started with the following command:"
msgstr ""

#. Tag: screen
#, no-c-format
msgid ""
"\n"
"<computeroutput># </computeroutput><userinput>/etc/init.d/nfs-kernel-server start</userinput>\n"
msgstr ""

#. Tag: title
#, no-c-format
msgid "NFS Client"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>client</primary><secondary>NFS</secondary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>NFS</primary><secondary>client</secondary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "As with other filesystems, integrating an NFS share into the system hierarchy requires mounting. Since this filesystem has its peculiarities, a few adjustments were required in the syntaxes of the <command>mount</command> command and the <filename>/etc/fstab</filename> file."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Manually mounting with the <command>mount</command> command"
msgstr ""

#. Tag: screen
#, no-c-format
msgid ""
"\n"
"<computeroutput># </computeroutput><userinput>mount -t nfs -o rw,nosuid arrakis.internal.falcot.com:/srv/shared /shared</userinput>"
msgstr ""

#. Tag: title
#, no-c-format
msgid "NFS entry in the <filename>/etc/fstab</filename> file"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"arrakis.internal.falcot.com:/srv/shared /shared nfs rw,nosuid 0 0\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The entry described above mounts, at system startup, the <filename>/srv/shared/</filename> NFS directory from the <literal>arrakis</literal> server into the local <filename>/shared/</filename> directory. Read-write access is requested (hence the <literal>rw</literal> parameter). The <literal>nosuid</literal> option is a protection measure that wipes any <literal>setuid</literal> or <literal>setgid</literal> bit from programs stored on the share. If the NFS share is only meant to store documents, another recommended option is <literal>noexec</literal>, which prevents executing programs stored on the share."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <citerefentry><refentrytitle>nfs</refentrytitle> <manvolnum>5</manvolnum></citerefentry> manual page describes all the options in some detail."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Setting Up Windows Shares with Samba"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Samba is a suite of tools handling the SMB protocol (also known as “CIFS”) on Linux. This protocol is used by Windows for network shares and shared printers."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>Windows share</primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>Samba</primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>SMB</primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>CIFS</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Samba can also act as an Windows domain controller. This is an outstanding tool for ensuring seamless integration of Linux servers and the office desktop machines still running Windows."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Samba Server"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <emphasis role=\"pkg\">samba</emphasis> package contains the main two servers of Samba 3, <command>smbd</command> and <command>nmbd</command>."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><command>smbd</command></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><command>nmbd</command></primary>"
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>TOOL</emphasis> Administrating Samba with SWAT"
msgstr ""

#. Tag: para
#, no-c-format
msgid "SWAT (<emphasis>Samba Web Administration Tool</emphasis>) is a web interface that allows configuring the Samba service. Since the <emphasis role=\"pkg\">swat</emphasis> package does not enable its configuration interface by default, it must be enabled manually with <command>update-inetd --enable swat</command>."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>SWAT</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "<emphasis>SWAT</emphasis> then becomes available at the <literal>http://localhost:901</literal> URL. Accessing it means using the root account (and its usual password). Note that SWAT rewrites the <filename>smb.conf</filename> in its own idiom, so it makes sense to make a backup copy beforehand if you're only interested in testing this tool."
msgstr ""

#. Tag: para
#, no-c-format
msgid "SWAT is very user-friendly; its interface includes an assistant that allows defining the server's role in three questions. All global options can still be configured, as well as those for all the existing shares, and of course new shares can be added. Each option comes with a link to the relevant documentation."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Unfortunately SWAT is no longer actively maintained and will be dropped from the next version of Debian, known as <emphasis role=\"distribution\">Jessie</emphasis>."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>DOCUMENTATION</emphasis> Going further"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The Samba server is extremely configurable and versatile, and can address a great many different use cases matching very different requirements and network architectures. This book only focuses on the use case where Samba is used as main domain controller, but it can also be a simple server on the domain and delegate authentication to the main controller (which could be a Windows server)."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>domain controller</primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>Windows domain</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The documentation available in the <emphasis role=\"pkg\">samba-doc</emphasis> package is very well written. In particular, the <citetitle><foreignphrase>Samba 3 By Example</foreignphrase></citetitle> document (available as <filename>/usr/share/doc/samba-doc/htmldocs/Samba3-ByExample/index.html</filename>) deals with a concrete use case that evolves alongside the growing company."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>TOOL</emphasis> Authenticating with a Windows Server"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Winbind gives system administrators the option of using a Windows server as an authentication server. Winbind also integrates cleanly with PAM and NSS. This allows setting up Linux machines where all users of a Windows domain automatically get an account."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>Winbind</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "More information can be found in the <filename>/usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/winbind.html</filename> file."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Configuring with <command>debconf</command>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The package sets up a minimal configuration based on the answers to a few Debconf questions asked during the initial installation; this configuration step can be replayed later with <command>dpkg-reconfigure samba-common samba</command>."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The first piece of required information is the name of the workgroup where the Samba server will belong (the answer is <literal>FALCOTNET</literal> in our case). Another question asks whether passwords should be encrypted. The answer is that they should, because it's a requirement for the most recent Windows clients; besides, this increases security. The counterpart is that this required managing Samba passwords separately from the Unix passwords."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The package also proposes identifying the WINS server from the information provided by the DHCP daemon. The Falcot Corp administrators rejected this option, since they intend to use the Samba server itself as the WINS server."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>WINS</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The last question is about whether servers should be started by <command>inetd</command> or as stand-alone daemons. Using <command>inetd</command> is only interesting when Samba is rarely used; the Falcot administrators therefore picked stand-alone daemons."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Configuring Manually"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Changes to <filename>smb.conf</filename>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The requirements at Falcot require other options to be modified in the <filename>/etc/samba/smb.conf</filename> configuration file. The following excerpts summarize the changes that were effected in the <literal>[global]</literal> section."
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"[global]\n"
"\n"
"## Browsing/Identification ###\n"
"\n"
"# Change this to the workgroup/NT-domain name your Samba server will part of\n"
"   workgroup = FALCOTNET\n"
"\n"
"# server string is the equivalent of the NT Description field\n"
"   server string = %h server (Samba %v)\n"
"\n"
"# Windows Internet Name Serving Support Section:\n"
"# WINS Support - Tells the NMBD component of Samba to enable its WINS Server\n"
"   wins support = yes <co id=\"smb.conf.wins\"></co>\n"
"\n"
"[...]\n"
"\n"
"####### Authentication #######\n"
"\n"
"# \"security = user\" is always a good idea. This will require a Unix account\n"
"# in this server for every user accessing the server. See\n"
"# /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/ServerType.html \n"
"# in the samba-doc package for details.\n"
"   security = user <co id=\"smb.conf.security\"></co>\n"
"\n"
"# You may wish to use password encryption.  See the section on\n"
"# 'encrypt passwords' in the smb.conf(5) manpage before enabling.\n"
"   encrypt passwords = true\n"
"\n"
"# If you are using encrypted passwords, Samba will need to know what\n"
"# password database type you are using.\n"
"   passdb backend = tdbsam\n"
"\n"
"[...]\n"
"\n"
"########## Printing ##########\n"
"\n"
"# If you want to automatically load your printer list rather\n"
"# than setting them up individually then you'll need this\n"
"   load printers = yes <co id=\"smb.conf.loadprinters\"></co>\n"
"\n"
"# lpr(ng) printing. You may wish to override the location of the\n"
"# printcap file\n"
";   printing = bsd\n"
";   printcap name = /etc/printcap\n"
"\n"
"# CUPS printing.  See also the cupsaddsmb(8) manpage in the\n"
"# cups-client package.\n"
"   printing = cups <co id=\"smb.conf.printing\"></co>\n"
"   printcap name = cups\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Indicates that Samba should act as a Netbios name server (WINS) for the local network."
msgstr ""

#. Tag: para
#, no-c-format
msgid "This is the default value for this parameter; however, since it is central to the Samba configuration, filling it explicitly is recommended. Each user must authenticate before accessing any share."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Tells Samba to automatically share all local printers that exist in the CUPS configuration. Restricting access to these printers is still possible, by adding appropriate sections."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Specifies the printing system in use; in our case, CUPS."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Adding Users"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Each Samba user needs an account on the server; the Unix accounts must be created first, then the user needs to be registered in Samba's database. The Unix step is done quite normally (using <command>adduser</command> for instance)."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Adding an existing user to the Samba database is a matter of running the <command>smbpasswd -a <replaceable>user</replaceable></command> command; this command asks for the password interactively."
msgstr ""

#. Tag: para
#, no-c-format
msgid "A user can be deleted with the <command>smbpasswd -x <replaceable>user</replaceable></command> command. A Samba account can also be temporarily disabled (with <command>smbpasswd -d <replaceable>user</replaceable></command>) and re-enabled later (with <command>smbpasswd -e <replaceable>user</replaceable></command>)."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Switching to Domain Controller"
msgstr ""

#. Tag: para
#, no-c-format
msgid "This section documents how the Falcot administrators went even further, by turning the Samba server into a domain controller providing roaming profiles (which allow users to find their desktop no matter what machine they connect to)."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>roaming profiles</primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>profiles, roaming</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "They first added a few extra directives in the <literal>[global]</literal> section of the configuration file:"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"domain logons = yes              <co id=\"smb.conf.domainlogons\"></co>\n"
"preferred master = yes           \n"
"logon path = \\\\%L\\profiles\\%U    <co id=\"smb.conf.logonpath\"></co>\n"
"logon script = scripts/logon.bat <co id=\"smb.conf.logonscript\"></co>\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Enables the domain controller functionality."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Specifies the location of the users' home directories. These are stored on a dedicated share, which allows enabling specific options (in particular, <literal>profile acls</literal>, a requirement for compatibility with Windows 2000, XP and Vista)."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Specifies the <emphasis>batch</emphasis> (non-interactive) script that is to be run on the client Windows machine every time a session is opened. In this case, <filename>/var/lib/samba/netlogon/scripts/logon.bat</filename>. The script needs to be in DOS format, where the lines are separated by a carriage-return character and a line-feed character; if the file was created on Linux, running <command>unix2dos</command> will convert it."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The commands used most widely in these scripts allow the automatic creation of network drives and synchronizing the system time."
msgstr ""

#. Tag: title
#, no-c-format
msgid "The <filename>logon.bat</filename> file"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"net time \\\\ARRAKIS /set /yes\n"
"net use H: /home\n"
"net use U: \\\\ARRAKIS\\utils\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Two extra shares, and their associated directories, were also created:"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"[netlogon]\n"
"comment = Network Logon Service\n"
"path = /var/lib/samba/netlogon\n"
"guest ok = yes\n"
"writable = no\n"
"share modes = no\n"
"\n"
"[profiles]\n"
"comment = Profile Share\n"
"path = /var/lib/samba/profiles\n"
"read only = No\n"
"profile acls = Yes\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The home directories for all users must also be created (as <filename>/var/lib/samba/profiles/<replaceable>user</replaceable></filename>), and each of them must be owned by the matching user."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Samba Client"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The client features in Samba allow a Linux machine to access Windows shares and shared printers. The required programs are available in the <emphasis role=\"pkg\">cifs-utils</emphasis> and <emphasis role=\"pkg\">smbclient</emphasis> packages."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><emphasis>smbclient</emphasis></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><emphasis>cifs-utils</emphasis></primary>"
msgstr ""

#. Tag: title
#, no-c-format
msgid "The <command>smbclient</command> Program"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <command>smbclient</command> program queries SMB servers. It accepts a <literal>-U <replaceable>user</replaceable></literal> option, for connecting to the server under a specific identity. <command>smbclient //<replaceable>server</replaceable>/<replaceable>share</replaceable></command> accesses the share in an interactive way similar to the command-line FTP client. <command>smbclient -L <replaceable>server</replaceable></command> lists all available (and visible) shares on a server."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Mounting Windows Shares"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <command>mount</command> command allows mounting a Windows share into the Linux filesystem hierarchy (with the help of <command>mount.cifs</command> provided by <emphasis role=\"pkg\">cifs-utils</emphasis>)."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><command>mount.cifs</command></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>Windows share, mounting</primary>"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Mounting a Windows share"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"mount -t cifs //arrakis/shared /shared \\\n"
"      -o credentials=/etc/smb-credentials\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <filename>/etc/smb-credentials</filename> file (which must not be readable by users) has the following format:"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"username = <replaceable>user</replaceable>\n"
"password = <replaceable>password</replaceable>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Other options can be specified on the command-line; their full list is available in the <citerefentry><refentrytitle>mount.cifs</refentrytitle> <manvolnum>1</manvolnum></citerefentry> manual page. Two options in particular can be interesting: <literal>uid</literal> and <literal>gid</literal> allow forcing the owner and group of files available on the mount, so as not to restrict access to root."
msgstr ""

#. Tag: para
#, no-c-format
msgid "A mount of a Windows share can also be configured in <filename>/etc/fstab</filename>:"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"//<replaceable>server</replaceable>/shared /shared cifs credentials=/etc/smb-credentials\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Unmounting a SMB/CIFS share is done with the standard <command>umount</command> command."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Printing on a Shared Printer"
msgstr ""

#. Tag: para
#, no-c-format
msgid "CUPS is an elegant solution for printing from a Linux workstation to a printer shared by a Windows machine. When the <emphasis role=\"pkg\">smbclient</emphasis> is installed, CUPS allows installing Windows shared printers automatically."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>printing</primary><secondary>network</secondary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Here are the required steps:"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Enter the CUPS configuration interface: <literal>http://localhost:631/admin</literal>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Click on “Add Printer”."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Choose the printer device, pick “Windows Printer via SAMBA”."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Enter the connection URI for the network printer. It should look like the following:"
msgstr ""

#. Tag: para
#, no-c-format
msgid "<literal>smb://<replaceable>user</replaceable>:<replaceable>password</replaceable>@<replaceable>server</replaceable>/<replaceable>printer</replaceable></literal>."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Enter the name that will uniquely identify this printer. Then enter the description and location of the printer. Those are the strings that will be shown to end users to help them identify the printers."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Indicate the manufacturer/model of the printer, or directly provide a working printer description file (PPD)."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Voilà, the printer is operational!"
msgstr ""

#. Tag: title
#, no-c-format
msgid "HTTP/FTP Proxy"
msgstr ""

#. Tag: para
#, no-c-format
msgid "An HTTP/FTP proxy acts as an intermediary for HTTP and/or FTP connections. Its role is twofold:"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Caching: recently downloaded documents are copied locally, which avoids multiple downloads."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Filtering server: if use of the proxy is mandated (and outgoing connections are blocked unless they go through the proxy), then the proxy can determine whether or not the request is to be granted."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>HTTP/FTP proxy</primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>proxy cache</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Falcot Corp selected Squid as their proxy server."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>Squid</primary>"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Installing"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <emphasis role=\"pkg\">squid</emphasis> Debian package only contains the modular (caching) proxy. Turning it into a filtering server requires installing the additional <emphasis role=\"pkg\">squidguard</emphasis> package. In addition, <emphasis role=\"pkg\">squid-cgi</emphasis> provides a querying and administration interface for a Squid proxy."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Prior to installing, care should be taken to check that the system can identify its own complete name: the <command>hostname -f</command> must return a fully-qualified name (including a domain). If it does not, then the <filename>/etc/hosts</filename> file should be edited to contain the full name of the system (for instance, <literal>arrakis.falcot.com</literal>). The official computer name should be validated with the network administrator in order to avoid potential name conflicts."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Configuring a Cache"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Enabling the caching server feature is a simple matter of editing the <filename>/etc/squid/squid.conf</filename> configuration file and allowing machines from the local network to run queries through the proxy. The following example shows the modifications made by the Falcot Corp administrators:"
msgstr ""

#. Tag: title
#, no-c-format
msgid "The <filename>/etc/squid/squid.conf</filename> file (excerpts)"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS\n"
"\n"
"# Example rule allowing access from your local networks. Adapt\n"
"# to list your (internal) IP networks from where browsing should\n"
"# be allowed\n"
"acl our_networks src 192.168.1.0/24 192.168.2.0/24\n"
"http_access allow our_networks\n"
"http_access allow localhost\n"
"# And finally deny all other access to this proxy\n"
"http_access deny all\n"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Configuring a Filter"
msgstr ""

#. Tag: para
#, no-c-format
msgid "<command>squid</command> itself does not perform the filtering; this action is delegated to <command>squidGuard</command>. The former must then be configured to interact with the latter. This involves adding the following directive to the <filename>/etc/squid/squid.conf</filename> file:"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><command>squidGuard</command></primary>"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"redirect_program /usr/bin/squidGuard -c /etc/squid/squidGuard.conf \n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <filename>/usr/lib/cgi-bin/squidGuard.cgi</filename> CGI program also needs to be installed, using <filename>/usr/share/doc/squidguard/examples/squidGuard.cgi.gz</filename> as a starting point. Required modifications to this script are the <varname>$proxy</varname> and <varname>$proxymaster</varname> variables (the name of the proxy and the administrator's contact e-mail, respectively). The <varname>$image</varname> and <varname>$redirect</varname> variables should point to existing images representing the rejection of a query."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The filter is enabled with the <command>/etc/init.d/squid reload</command> command. However, since the <emphasis role=\"pkg\">squidguard</emphasis> package does no filtering by default, it is the administrator's task to define the policy. This can be done by creating the <filename>/etc/squid/squidGuard.conf</filename> file (using <filename>/etc/squidguard/squidGuard.conf.default</filename> as template if required)."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The working database must be regenerated with <command>update-squidguard</command> after each change of the <command>squidGuard</command> configuration file (or one of the lists of domains or URLs it mentions). The configuration file syntax is documented on the following website: <ulink type=\"block\" url=\"http://www.squidguard.org/Doc/configure.html\" />"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><command>update-squidguard</command></primary>"
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>ALTERNATIVE</emphasis> DansGuardian"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><emphasis role=\"pkg\">dansguardian</emphasis></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>PICS</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <emphasis role=\"pkg\">dansguardian</emphasis> package is an alternative to <emphasis>squidguard</emphasis>. This software does not simply handle a black-list of forbidden URLs, but it can take advantage of the PICS system (<emphasis>Platform for Internet Content Selection</emphasis>) to decide whether a page is acceptable by dynamic analysis of its contents."
msgstr ""

#. Tag: title
#, no-c-format
msgid "LDAP Directory"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>LDAP</primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>OpenLDAP</primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>directory, LDAP</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "OpenLDAP is an implementation of the LDAP protocol; in other words, it's a special-purpose database designed for storing directories. In the most common use case, using an LDAP server allows centralizing management of user accounts and the related permissions. Moreover, an LDAP database is easily replicated, which allows setting up multiple synchronized LDAP servers. When the network and the user base grows quickly, the load can then be balanced across several servers."
msgstr ""

#. Tag: para
#, no-c-format
msgid "LDAP data is structured and hierarchical. The structure is defined by “schemas” which describe the kind of objects that the database can store, with a list of all their possible attributes. The syntax used to refer to a particular object in the database is based on this structure, which explains its complexity."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <emphasis role=\"pkg\">slapd</emphasis> package contains the OpenLDAP server. The <emphasis role=\"pkg\">ldap-utils</emphasis> package includes command-line tools for interacting with LDAP servers."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><emphasis>slapd</emphasis></primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Installing <emphasis role=\"pkg\">slapd</emphasis> is usually non-interactive unless you have configured debconf to display questions with lower priorities. Nevertheless, it is debconf-enabled, and thus a simple <command>dpkg-reconfigure slapd</command> can reconfigure the LDAP database:"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Omit OpenLDAP server configuration? No, of course, we want to configure this service."
msgstr ""

#. Tag: para
#, no-c-format
msgid "DNS domain name: “<literal>falcot.com</literal>”."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Organization name: “Falcot Corp”."
msgstr ""

#. Tag: para
#, no-c-format
msgid "An administrative passwords needs to be typed in."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Database backend to use: “HDB”."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Do you want the database to be removed when <emphasis role=\"pkg\">slapd</emphasis> is purged? No. No point in risking losing the database in case of a mistake."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Move old database? This question is only asked when the configuration is attempted while a database already exists. Only answer “yes” if you actually want to start again from a clean database, for instance if you run <command>dpkg-reconfigure slapd</command> right after the initial installation."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Allow LDAPv2 protocol? No, there's no point in that. All the tools we're going to use understand the LDAPv3 protocol."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>BACK TO BASICS</emphasis> LDIF format"
msgstr ""

#. Tag: para
#, no-c-format
msgid "An LDIF file (<emphasis>LDAP Data Interchange Format</emphasis>) is a portable text file describing the contents of an LDAP database (or a portion thereof); this can then be used to inject the data into any other LDAP server."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>LDIF</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "A minimal database is now configured, as demonstrated by the following query:"
msgstr ""

#. Tag: screen
#, no-c-format
msgid ""
"\n"
"<computeroutput>$ </computeroutput><userinput>ldapsearch -x -b dc=falcot,dc=com</userinput>\n"
"<computeroutput># extended LDIF\n"
"#\n"
"# LDAPv3\n"
"# base &lt;dc=falcot,dc=com&gt; with scope sub\n"
"# filter: (objectclass=*)\n"
"# requesting: ALL\n"
"#\n"
"\n"
"# falcot.com\n"
"dn: dc=falcot,dc=com\n"
"objectClass: top\n"
"objectClass: dcObject\n"
"objectClass: organization\n"
"o: Falcot Corp\n"
"dc: falcot\n"
"\n"
"# admin, falcot.com\n"
"dn: cn=admin,dc=falcot,dc=com\n"
"objectClass: simpleSecurityObject\n"
"objectClass: organizationalRole\n"
"cn: admin\n"
"description: LDAP administrator\n"
"\n"
"# search result\n"
"search: 2\n"
"result: 0 Success\n"
"\n"
"# numResponses: 3\n"
"# numEntries: 2\n"
"</computeroutput>\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The query returned two objects: the organization itself, and the administrative user."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Filling in the Directory"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Since an empty database is not particularly useful, we're going to inject into it all the existing directories; this includes the users, groups, services and hosts databases."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <emphasis role=\"pkg\">migrationtools</emphasis> package provides a set of scripts dedicated to extract data from the standard Unix directories (<filename>/etc/passwd</filename>, <filename>/etc/group</filename>, <filename>/etc/services</filename>, <filename>/etc/hosts</filename> and so on), convert this data, and inject it into the LDAP database."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><emphasis role=\"pkg\">migrationtools</emphasis></primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Once the package is installed, the <filename>/etc/migrationtools/migrate_common.ph</filename> must be edited; the <varname>IGNORE_UID_BELOW</varname> and <varname>IGNORE_GID_BELOW</varname> options need to be enabled (uncommenting them is enough), and <varname>DEFAULT_MAIL_DOMAIN</varname>/<varname>DEFAULT_BASE</varname> need to be updated."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The actual migration operation is handled by the <command>migrate_all_online.sh</command> command, as follows:"
msgstr ""

#. Tag: screen
#, no-c-format
msgid ""
"\n"
"<computeroutput># </computeroutput><userinput>cd /usr/share/migrationtools</userinput>\n"
"<computeroutput># </computeroutput><userinput>LDAPADD=\"/usr/bin/ldapadd -c\" ETC_ALIASES=/dev/null ./migrate_all_online.sh</userinput>\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <command>migrate_all_online.sh</command> asks a few questions about the LDAP database into which the data is to be migrated. <xref linkend=\"tab-migrate-all\" xrefstyle=\"select: label nopage\" /> summarizes the answers given in the Falcot use-case."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Answers to questions asked by the <command>migrate_all_online.sh</command> script"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "Question"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "Answer"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "X.500 naming context"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "<literal>dc=falcot,dc=com</literal>"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "LDAP server hostname"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "<literal>localhost</literal>"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "Manager DN"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "<literal>cn=admin,dc=falcot,dc=com</literal>"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "Bind credentials"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "the administrative password"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "Create DUAConfigProfile"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "no"
msgstr ""

#. Tag: para
#, no-c-format
msgid "We deliberately ignore migration of the <filename>/etc/aliases</filename> file, since the standard schema as provided by Debian does not include the structures that this script uses to describe email aliases. Should we want to integrate this data into the directory, the <filename>/etc/ldap/schema/misc.schema</filename> file should be added to the standard schema."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>TOOL</emphasis> Browsing an LDAP directory"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <command>jxplorer</command> command (in the package of the same name) is a graphical tool allowing to browse and edit an LDAP database. It's an interesting tool that provides an administrator with a good overview of the hierarchical structure of the LDAP data."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><command>jxplorer</command></primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Also note the use of the <literal>-c</literal> option to the <command>ldapadd</command> command; this option requests that processing doesn't stop in case of error. Using this option is required because converting the <filename>/etc/services</filename> often generates a few errors that can safely be ignored."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Managing Accounts with LDAP"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Now the LDAP database contains some useful information, the time has come to make use of this data. This section focuses on how to configure a Linux system so that the various system directories use the LDAP database."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Configuring NSS"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The NSS system (Name Service Switch, see sidebar <xref linkend=\"sidebar.intro-nss\" />) is a modular system designed to define or fetch information for system directories. Using LDAP as a source of data for NSS requires installing the <emphasis role=\"pkg\">libnss-ldap</emphasis> package. Its installation asks a few questions; the answers are summarized in <xref linkend=\"tab-libnss-ldap\" xrefstyle=\"select: label nopage\" />."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><emphasis>libnss-ldap</emphasis></primary>"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Configuring the <emphasis role=\"pkg\">libnss-ldap</emphasis> package"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "LDAP server Uniform Resource Identifier"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "<literal>ldap://ldap.falcot.com</literal>"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "Distinguished name of the search base"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "LDAP version to use"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "<literal>3</literal>"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "Does the LDAP database require login?"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "Special LDAP privileges for root"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "yes"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "Make the configuration file readable/writeable by its owner only"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "LDAP account for root"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "LDAP root account password"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <filename>/etc/nsswitch.conf</filename> file then needs to be modified, so as to configure NSS to use the freshly-installed <command>ldap</command> module."
msgstr ""

#. Tag: title
#, no-c-format
msgid "The <filename>/etc/nsswitch.conf</filename> file"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"# /etc/nsswitch.conf\n"
"#\n"
"# Example configuration of GNU Name Service Switch functionality.\n"
"# If you have the `glibc-doc' and `info' packages installed, try:\n"
"# `info libc \"Name Service Switch\"' for information about this file.\n"
"\n"
"passwd: ldap compat\n"
"group: ldap compat\n"
"shadow: ldap compat\n"
"\n"
"hosts: files dns ldap\n"
"networks: ldap files\n"
"\n"
"protocols: ldap db files\n"
"services: ldap db files\n"
"ethers: ldap db files\n"
"rpc: ldap db files\n"
"\n"
"netgroup: ldap files\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <command>ldap</command> module is usually inserted before others, and it will therefore be queried first. The notable exception is the <literal>hosts</literal> service since contacting the LDAP server requires consulting DNS first (to resolve <literal>ldap.falcot.com</literal>). Without this exception, a hostname query would try to ask the LDAP server; this would trigger a name resolution for the LDAP server, and so on in an infinite loop."
msgstr ""

#. Tag: para
#, no-c-format
msgid "If the LDAP server should be considered authoritative (and the local files used by the <command>files</command> module disregarded), services can be configured with the following syntax:"
msgstr ""

#. Tag: para
#, no-c-format
msgid "<literal><replaceable>service</replaceable>: ldap [NOTFOUND=return] files</literal>."
msgstr ""

#. Tag: para
#, no-c-format
msgid "If the requested entry does not exist in the LDAP database, the query will return a “not existing” reply even if the resource does exist in one of the local files; these local files will only be used when the LDAP service is down."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Configuring PAM"
msgstr ""

#. Tag: para
#, no-c-format
msgid "This section describes a PAM configuration (see sidebar <xref linkend=\"sidebar.intro-pam\" />) that will allow applications to perform the required authentications against the LDAP database."
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>CAUTION</emphasis> Broken authentication"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Changing the standard PAM configuration used by various programs is a sensitive operation. A mistake can lead to broken authentication, which could prevent logging in. Keeping a root shell open is therefore a good precaution. If configuration errors occur, they can be then fixed and the services restarted with minimal effort."
msgstr ""

#. Tag: para
#, no-c-format
msgid "The LDAP module for PAM is provided by the <emphasis role=\"pkg\">libpam-ldap</emphasis> package. Installing this package asks a few questions very similar to those in <emphasis role=\"pkg\">libnss-ldap</emphasis>; some configuration parameters (such as the URI for the LDAP server) are even actually shared with the <emphasis role=\"pkg\">libnss-ldap</emphasis> package. Answers are summarized in <xref linkend=\"tab-libpam-ldap\" xrefstyle=\"select: label nopage\" />."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><emphasis>libpam-ldap</emphasis></primary>"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Configuration of <emphasis>libpam-ldap</emphasis>"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "Allow LDAP admin account to behave like local root?"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "Yes. This allows using the usual <command>passwd</command> command for changing passwords stored in the LDAP database."
msgstr ""

#. Tag: entry
#, no-c-format
msgid "Does the LDAP database require logging in?"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "the LDAP database administrative password"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "Local encryption algorithm to use for passwords"
msgstr ""

#. Tag: entry
#, no-c-format
msgid "crypt"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Installing <emphasis role=\"pkg\">libpam-ldap</emphasis> automatically adapts the default PAM configuration defined in the <filename>/etc/pam.d/common-auth</filename>, <filename>/etc/pam.d/common-password</filename> and <filename>/etc/pam.d/common-account</filename> files. This mechanism uses the dedicated <command>pam-auth-update</command> tool (provided by the <emphasis role=\"pkg\">libpam-runtime</emphasis> package). This tool can also be run by the administrator should they wish to enable or disable PAM modules."
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><filename>common-auth</filename></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><filename>/etc/pam.d/common-auth</filename></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><filename>common-password</filename></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><filename>/etc/pam.d/common-password</filename></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><filename>common-account</filename></primary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><filename>/etc/pam.d/common-account</filename></primary>"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Securing LDAP Data Exchanges"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>LDAP</primary><secondary>secure</secondary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "By default, the LDAP protocol transits on the network as cleartext; this includes the (encrypted) passwords. Since the encrypted passwords can be extracted from the network, they can be vulnerable to dictionary-type attacks. This can be avoided by using an extra encryption layer; enabling this layer is the topic of this section."
msgstr ""

#. Tag: title
#, no-c-format
msgid "Configuring the Server"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><foreignphrase>OpenSSL</foreignphrase></primary><secondary>creating keys</secondary>"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary>key pair</primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The first step is to create a key pair (comprising a public key and a private key) for the LDAP server. The Falcot administrators reuse <emphasis>easy-rsa</emphasis> to generate it (see <xref linkend=\"sect.easy-rsa\" />). Running <command>./build-server-key ldap.falcot.com</command> asks a few mundane questions (location, organization name and so on). The answer to the “common name” question <emphasis>must</emphasis> be the fully-qualified hostname for the LDAP server; in our case, <literal>ldap.falcot.com</literal>."
msgstr ""

#. Tag: para
#, no-c-format
msgid "This command creates a certificate in the <filename>keys/ldap.falcot.com.crt</filename> file; the corresponding private key is stored in <filename>keys/ldap.falcot.com.key</filename>."
msgstr ""

#. Tag: para
#, no-c-format
msgid "Now these keys have to be installed in their standard location, and we must make sure that the private file is readable by the LDAP server which runs under the <literal>openldap</literal> user identity:"
msgstr ""

#. Tag: screen
#, no-c-format
msgid ""
"\n"
"# <userinput>adduser openldap ssl-cert</userinput>\n"
"Adding user `openldap' to group `ssl-cert' ...\n"
"Adding user openldap to group ssl-cert\n"
"Done.\n"
"# <userinput>mv keys/ldap.falcot.com.key /etc/ssl/private/ldap.falcot.com.key</userinput>\n"
"# <userinput>chown root:ssl-cert /etc/ssl/private/ldap.falcot.com.key</userinput>\n"
"# <userinput>chmod 0640 /etc/ssl/private/ldap.falcot.com.key</userinput>\n"
"# <userinput>mv newcert.pem /etc/ssl/certs/ldap.falcot.com.pem</userinput>\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The <command>slapd</command> daemon also needs to be told to use these keys for encryption. The LDAP server configuration is managed dynamically: the configuration can be updated with normal LDAP operations on the <literal>cn=config</literal> object hierarchy, and the server updates <filename>/etc/ldap/slapd.d</filename> in real time to make the configuration persistent. <command>ldapmodify</command> is thus the right tool to update the configuration:"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Configuring <command>slapd</command> for encryption"
msgstr ""

#. Tag: screen
#, no-c-format
msgid ""
"\n"
"# <userinput>cat &gt;ssl.ldif &lt;&lt;END\n"
"dn: cn=config\n"
"changetype: modify\n"
"add: olcTLSCertificateFile\n"
"olcTLSCertificateFile: /etc/ssl/certs/ldap.falcot.com.pem\n"
"-\n"
"add: olcTLSCertificateKeyFile\n"
"olcTLSCertificateKeyFile: /etc/ssl/private/ldap.falcot.com.key\n"
"-\n"
"END</userinput>\n"
"# <userinput>ldapmodify -Y EXTERNAL -H ldapi:/// -f ssl.ldif</userinput>\n"
"SASL/EXTERNAL authentication started\n"
"SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\n"
"SASL SSF: 0\n"
"modifying entry \"cn=config\"\n"
msgstr ""

#. Tag: title
#, no-c-format
msgid "<emphasis>TOOL</emphasis> <command>ldapvi</command> to edit an LDAP directory"
msgstr ""

#. Tag: indexterm
#, no-c-format
msgid "<primary><command>ldapvi</command></primary>"
msgstr ""

#. Tag: para
#, no-c-format
msgid "With <command>ldapvi</command>, you can display an LDIF output of any part of the LDAP directory, make some changes in the text editor, and let the tool do the corresponding LDAP operations for you."
msgstr ""

#. Tag: para
#, no-c-format
msgid "It is thus a convenient way to update the configuration of the LDAP server, simply by editing the <literal>cn=config</literal> hierarchy."
msgstr ""

#. Tag: screen
#, no-c-format
msgid ""
"\n"
"# <userinput>ldapvi -Y EXTERNAL -h ldapi:/// -b cn=config</userinput>\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "The last step for enabling encryption involves changing the <varname>SLAPD_SERVICES</varname> variable in the <filename>/etc/default/slapd</filename> file. We'll play it safe and disable unsecured LDAP altogether."
msgstr ""

#. Tag: title
#, no-c-format
msgid "The <filename>/etc/default/slapd</filename> file"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"\n"
"# Default location of the slapd.conf file or slapd.d cn=config directory. If\n"
"# empty, use the compiled-in default (/etc/ldap/slapd.d with a fallback to\n"
"# /etc/ldap/slapd.conf).\n"
"SLAPD_CONF=\n"
"\n"
"# System account to run the slapd server under. If empty the server\n"
"# will run as root.\n"
"SLAPD_USER=\"openldap\"\n"
"\n"
"# System group to run the slapd server under. If empty the server will\n"
"# run in the primary group of its user.\n"
"SLAPD_GROUP=\"openldap\"\n"
"\n"
"# Path to the pid file of the slapd server. If not set the init.d script\n"
"# will try to figure it out from $SLAPD_CONF (/etc/ldap/slapd.conf by\n"
"# default)\n"
"SLAPD_PIDFILE=\n"
"\n"
"# slapd normally serves ldap only on all TCP-ports 389. slapd can also\n"
"# service requests on TCP-port 636 (ldaps) and requests via unix\n"
"# sockets.\n"
"# Example usage:\n"
"# SLAPD_SERVICES=\"ldap://127.0.0.1:389/ ldaps:/// ldapi:///\"\n"
"SLAPD_SERVICES=\"ldaps:/// ldapi:///\"\n"
"\n"
"# If SLAPD_NO_START is set, the init script will not start or restart\n"
"# slapd (but stop will still work).  Uncomment this if you are\n"
"# starting slapd via some other means or if you don't want slapd normally\n"
"# started at boot.\n"
"#SLAPD_NO_START=1\n"
"\n"
"# If SLAPD_SENTINEL_FILE is set to path to a file and that file exists,\n"
"# the init script will not start or restart slapd (but stop will still\n"
"# work).  Use this for temporarily disabling startup of slapd (when doing\n"
"# maintenance, for example, or through a configuration management system)\n"
"# when you don't want to edit a configuration file.\n"
"SLAPD_SENTINEL_FILE=/etc/ldap/noslapd\n"
"\n"
"# For Kerberos authentication (via SASL), slapd by default uses the system\n"
"# keytab file (/etc/krb5.keytab).  To use a different keytab file,\n"
"# uncomment this line and change the path.\n"
"#export KRB5_KTNAME=/etc/krb5.keytab\n"
"\n"
"# Additional options to pass to slapd\n"
"SLAPD_OPTIONS=\"\"\n"
msgstr ""

#. Tag: title
#, no-c-format
msgid "Configuring the Client"
msgstr ""

#. Tag: para
#, no-c-format
msgid "On the client side, the configuration for the <emphasis>libpam-ldap</emphasis> and <emphasis>libnss-ldap</emphasis> modules needs to be modified to use an <literal>ldaps://</literal> URI."
msgstr ""

#. Tag: para
#, no-c-format
msgid "LDAP clients also need to be able to authenticate the server. In a X.509 public key infrastructure, public certificates are signed by the key of a certificate authority (CA). With <emphasis>easy-rsa</emphasis>, the Falcot administrators have created their own CA and they now need to configure the system to trust the signatures of Falcot's CA. This can be done by putting the CA certificate in <filename>/usr/local/share/ca-certificates</filename> and running <command>update-ca-certificates</command>."
msgstr ""

#. Tag: screen
#, no-c-format
msgid ""
"\n"
"# <userinput>cp keys/ca.crt /usr/local/share/ca-certificates/falcot.crt</userinput>\n"
"# <userinput>update-ca-certificates</userinput>\n"
"Updating certificates in /etc/ssl/certs... 1 added, 0 removed; done.\n"
"Running hooks in /etc/ca-certificates/update.d....\n"
"Adding debian:falcot.pem\n"
"done.\n"
"done.\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "Last but not least, the default LDAP URI and default base DN used by the various command line tools can be modified in <filename>/etc/ldap/ldap.conf</filename>. This will save quite some typing."
msgstr ""

#. Tag: title
#, no-c-format
msgid "The <filename>/etc/ldap/ldap.conf</filename> file"
msgstr ""

#. Tag: programlisting
#, no-c-format
msgid ""
"#\n"
"# LDAP Defaults\n"
"#\n"
"\n"
"# See ldap.conf(5) for details\n"
"# This file should be world readable but not world writable.\n"
"\n"
"BASE   dc=falcot,dc=com\n"
"URI    ldaps://ldap.falcot.com\n"
"\n"
"#SIZELIMIT      12\n"
"#TIMELIMIT      15\n"
"#DEREF          never\n"
"\n"
"# TLS certificates (needed for GnuTLS)\n"
"TLS_CACERT      /etc/ssl/certs/ca-certificates.crt\n"
msgstr ""

#. Tag: para
#, no-c-format
msgid "This chapter sampled only a fraction of the available server software; however, most of the common network services were described. Now it is time for an even more technical chapter: we'll go into deeper detail for some concepts, describe massive deployments and virtualization."
msgstr ""