Fedora Release Notes - en to zh_CN translation catalogue (44 entries)

note: Tag: title
en: Security
zh_CN: 安全性

note: Tag: para
en: This section describes the security changes and enhancements available in Fedora 15.
zh_CN: 该部分描述 Fedora 15 中在安全性方面的变化和改进。

note: Tag: title
en: Dynamic Firewall
zh_CN: 动态防火墙

note: Tag: indexterm
en: <primary>Dynamic Firewall</primary>
zh_CN: <primary>动态防火墙</primary>

note: Tag: para
en: Fedora 15 adds support for the optional firewall daemon (<package>FirewallD</package>), providing a dynamic firewall management with a D-Bus interface.
zh_CN: Fedora 15 添加选配防火墙守护进程(<package>FirewallD</package>)的支持，提供一个通过 D-Bus 接口进行管理操作的动态防火墙。

note: Tag: para
en: The previous firewall model with <package>system-config-firewall</package>, was static and required a full firewall restart for all changes, even simple ones. This resulted in termination of filtered connections. <package>Firewalld</package> can modify the firewall dynamically and no firewall recreation is needed. At this stage, it supports iptables, ip6tables and ebtables. In Fedora 15 a simple tray applet shows the firewall state, and firewall services can be enabled and disabled.
zh_CN: 先前的防火墙 <package>system-config-firewall</package> 模式是静态的，对于任何更改都需要防火墙全部重启，哪怕是最简单的更改。这将导致所有过滤连接的中断。<package>Firewalld</package> 可以动态调整防火墙从而不需要重新创建。在当前阶段，它支持 iptables、 ip6tables 和 ebtables。在 Fedora 15，中一个简单托盘小程序被用来显示防火墙状态，并且可以启用和禁用防火墙服务。

note: Tag: para
en: For more details, visit the Fedora wiki pages, <ulink url="https://fedoraproject.org/wiki/Features/DynamicFirewall">https://fedoraproject.org/wiki/Features/DynamicFirewall</ulink> and <ulink url="https://fedoraproject.org/wiki/Features/FirewallD/">https://fedoraproject.org/wiki/Features/FirewallD/ </ulink>.
zh_CN: 更多的详情，请访问 Fedora wiki 页面 <ulink url="https://fedoraproject.org/wiki/Features/DynamicFirewall">https://fedoraproject.org/wiki/Features/DynamicFirewall</ulink> 和 <ulink url="https://fedoraproject.org/wiki/Features/FirewallD/">https://fedoraproject.org/wiki/Features/FirewallD/ </ulink>.

note: Tag: para
en: FreeIPA is an integrated security information management solution combining Linux (Fedora), 389 (formerly known as Fedora Directory Server), MIT Kerberos, NTP, DNS. It consists of a web interface and command-line administration tools.
zh_CN: FreeIPA 是一个集成化安全信息管理解决方案，整合了 Linux (Fedora)、389 (此前称为 Fedora Directory Server)、 MIT Kerberos、NTP、和 DNS。它包含网页模式和命令行模式的管理工具。

note: Tag: para
en: Features of FreeIPA v2.0 include:
zh_CN: FreeIPA v2.0 的功能包括：

note: Tag: para
en: Centralized authentication via Kerberos or LDAP
zh_CN: 通过 Kerberos 或 LDAP 的集中化认证

note: Tag: para
en: Identity management for users, groups, hosts and services
zh_CN: 对于用户、群粗、主机和服务的身份管理

note: Tag: para
en: Pluggable and extensible framework for UI/CLI
zh_CN: 支持插件可扩展的图形化/命令行框架

note: Tag: para
en: Rich CLI
zh_CN: 丰富的命令行工具

note: Tag: para
en: Web-based User Interface
zh_CN: 基于网页的用户界面

note: Tag: para
en: Server X.509 v3 certificate provisioning capabilities
zh_CN: X.509 v3 服务证书预准备能力

note: Tag: para
en: Managing host identities including grouping hosts
zh_CN: 管理包括主机群在内的主机身份

note: Tag: para
en: Defining host-based access control rules that will be enforced on the client side by the IPA back end for SSSD
zh_CN: 基于主机定义的访问控制规则将会在客户端通过 IPA 强制执行，依靠 SSSD。

note: Tag: para
en: Serving netgroups based on user and host objects stored in IPA
zh_CN: 根据保存在 IPA 中的用户和主机对象为网络群组提供服务

note: Tag: para
en: Serving sets of automount maps to different clients
zh_CN: 为不同的客户端提供自动挂载映射配置

note: Tag: para
en: Finer-grained management delegation
zh_CN: 更精细的管理代表团

note: Tag: para
en: Group-based password policies
zh_CN: 基于群组的密码策略

note: Tag: para
en: Centrally-managed SUDO
zh_CN: 集中化管理的 SUDO

note: Tag: para
en: Automatic management of private groups
zh_CN: 自动管理私人组

note: Tag: para
en: Compatibility with broad set of clients
zh_CN: 兼容多种客户端

note: Tag: para
en: Painless password migration
zh_CN: 轻松密码迁移

note: Tag: para
en: Optional integrated DNS server managed by IPA
zh_CN: 可选将 DNS 服务器管理整合入 IPA

note: Tag: para
en: Optional integrated Certificate Authority to manage server certificates managed by IPA
zh_CN: 可选将证书授权整合入 IPA，实现服务器证书管理

note: Tag: para
en: Can act as NIS server for legacy systems
zh_CN: 可以如 NIS 服务器般运行，兼容遗留系统

note: Tag: para
en: Supports multi-server deployment based on the multi-master replication
zh_CN: 基于多主机复本的多服务器部署

note: Tag: para
en: User and group replication with MS Active Directory
zh_CN: 实现 MS 活动目录的用户和群组复本

note: Tag: para
en: For all details please refer to <ulink url="http://www.freeipa.org/">http://www.freeipa.org/</ulink>.
zh_CN: 完整的详细内容请参考 <ulink url="http://www.freeipa.org/">http://www.freeipa.org/</ulink>。

note: Tag: para
en: First introduced in Fedora 14, <package>OpenSCAP</package> is a set of open source libraries providing an easier path for integration of the SCAP line of standards, managed by NIST and created to provide a standardized approach to maintaining the security of enterprise systems, such as automatically verifying the presence of patches, checking system security configuration settings, and examining systems for signs of compromise.
zh_CN: 当首次在 Fedora 14 引入时， <package>OpenSCAP</package> 是一组开源的库文件，提供易于 SCAP 标准整合过程的方法，由 NIST 管理，并为了提供一个标准化的企业系统安全性而创建，如自动化查询补丁可用性、检测系统安全配置设定和检查系统入侵痕迹。

note: Tag: para
en: In Fedora 15, <package>openscap</package>, the set of open source libraries enabling integration of the SCAP line of standards, has been upgraded from version 0.6.3 to 0.6.8. During these development stage there has been introduced full support for perl regular expression by default, OVAL float type support, XSL transformation improvements and Dublin Core support, added OVAL schemas version 5.6 and improved XCCDF reporting.
zh_CN: 在 Fedora 15 中， <package>openscap</package>, 开源 SCAP 标准整合的库文件集合，由 0.6.3 升级至 0.6.8。 在开发过程中，引入了完整 perl 正则表达式默认支持、OVAL 浮点类型支持、改进 XSL 变换和 Dublin Core 支持、添加 OVAL 范例 5.6 版本并改进 XCCDF 报告。

note: Tag: para
en: <package>secstate</package>, the Security State Configuration Tool, has been rebuilt in Fedora 15 against version 0.4.1.
zh_CN: <package>secstate</package>, 安全状态配置工具，在 Fedora 15 按照版本 0.4.1 重建。

note: Tag: para
en: <package>firstaidkit</package>, the System Rescue Tool that automates simple and common system recovery tasks, has been upgraded from 0.2.17 to version 0.2.18.
zh_CN: <package>firstaidkit</package>, 自动化一般和常见系统恢复任务的系统救援工具，从 0.2.17 升级至 0.2.18 版本。

note: Tag: para
en: For more information visit this page: <ulink url="http://www.open-scap.org/page/Main_Page"> http://www.open-scap.org/page/Main_Page </ulink>.
zh_CN: 更多信息请访问此页面：<ulink url="http://www.open-scap.org/page/Main_Page"> http://www.open-scap.org/page/Main_Page </ulink>.

note: Tag: para
en: Fedora 15 brings in improved support for eCryptfs, a stacked cryptographic filesystem for Linux. Now when a <package>ecryptfs</package> user logs in, <application>authconfig</application> will automatically mount his private encrypted part of the home directory.
zh_CN: Fedora 15 改善了对 eCryptfs 支持，一个适用于 Linux 的堆加密文件系统。当一个 <package>ecryptfs</package> 用户登录时，<application>authconfig</application> 将自动挂在他主目录的加密部分。

note: Tag: para
en: For details please refer to the wiki page <ulink url="https://fedoraproject.org/wiki/Features/EcryptfsAuthConfig"> https://fedoraproject.org/wiki/Features/EcryptfsAuthConfig </ulink>.
zh_CN: 详情请参考 wiki 页面 <ulink url="https://fedoraproject.org/wiki/Features/EcryptfsAuthConfig"> https://fedoraproject.org/wiki/Features/EcryptfsAuthConfig </ulink>.

note: Tag: para
en: The user interface of <package>setroubleshoot</package> has been redesigned to make it easier to diagnose SELinux problems. In the current setroubleshooter the "best" match is returned for a solution to the customer. In the new redesign, all matches will be returned. For example if samba tried to read content that it is not allowed, we would like to tell the admin that he could label the content <command>samba_share_t</command> or he could set up SELinux to allow samba to share all content Read Only, or Read Write, or samba should not be trying to read this content, it could be a bug or an attack.
zh_CN: <package>setroubleshoot</package> 的用户界面被重新设计来简化 SELinux 问题的诊断。在当前 setroubleshooter 中“最佳”匹配会以解决方案的方式呈现给用户。在新设计中，所有匹配都会被呈现。例如如果 samba 想要访问未允许的内容时，我们希望告诉管理员他可以用<command>samba_share_t</command> 标识内容，或者设置 SELinux 允许所有 samba 以只读或读写方式共享所有内容，或者 samba 不应该尝试访问此内容，有可能是一个错误或攻击。

note: Tag: para
en: The interface has also been simplified with easier to explain definitions, like
zh_CN: 用户界面被简化，使得定义解释更简单，如

note: Tag: screen
en: 
    If you want samba to share the entire system read/only,  then 
    you need to tell SELinux system about this, by setting the 
    samba_export_all_ro boolean. 
    
    Execute the following command as root.
    
      setsebool -P samba_export_all_ro=1
zh_CN: 
    如果您想要 samba 以只读方式共享整个系统,  那么 
    你需要告诉 SELinux 系统，通过设定 
    samba_export_all_ro boolean. 
    
    以 root 身份执行下列命令。
    
      setsebool -P samba_export_all_ro=1

note: Tag: title
en: Remove setuid
zh_CN: 移除 setuid

note: Tag: para
en: Fedora 15 removes <command>setuid</command> applications and instead specifically assigns the capabilities required by an application, modifing the spec files of most applications that include a setuid application to remove the setuid flag and change to file capabilities.
zh_CN: Fedora 15 移除 <command>setuid</command> 程序，取而代之明确指派应用程序所需要的权限，修改大多数包括 setuid 的应用程序 spec 文件来移除  setuid 位并改为文件权限。

note: Tag: para
en: Please refer to <ulink url="https://fedoraproject.org/wiki/Features/RemoveSETUID">https://fedoraproject.org/wiki/Features/RemoveSETUID</ulink> for all details.
zh_CN: 请参考 <ulink url="https://fedoraproject.org/wiki/Features/RemoveSETUID">https://fedoraproject.org/wiki/Features/RemoveSETUID</ulink> 获得所有详情。
