Þ ü p! q! s! ! ! ž! Í! ã! ' ö! 1 " 8 P" " & ¡" È" é" 7 # 9# Y# n# 3 # * ¿# B ê# ) -$ ) W$ % $ §$ È$ à$ ÷$ % %% # D% % h% % # % Ñ% ë% & $& C& \& v& # & * Ž& & ß& ; ' ' B' P j' T »' R ( c( ( # ( ! Ä( æ( % ) ( ') P) 3 i) 2 ) 7 Ð) A * 9 J* 7 * ! Œ* Þ* , e+ + 0 ¥+ Ö+ â+ P û+ $ L, ( q, , , º, + ç, . - 2 B- , u- 3 ¢- Ö- # ó- . $. " B. 6 e. $ . * Á. ì. /
/ :/ X/ / r/ " ¢/ ) Å/ ! ï/ 0 )0 , ?0 l0 v0
0 6 0 Ë0
â0 í0 ü0 * 1 ) .1 X1 t1 1 °1 Ð1 ß1 ø1 2 R #2 U v2 < Ì2 B 3 G L3 F 3 . Û3 F
4 8 Q4 Z 4 E å4 ; +5 7 g5 5 º5
Î5 Ù5 F ì5 36 4 E6 V z6 ; Ñ6 0
7 >7 ( _7 ' 7 ( °7 ' Ù7 ! 8
#8 18 L8 b8 {8 8 š8 É8 å8 9 "9 =9 \9 k9 9 ) 9 * Å9 : ð9 % +: * Q: $ |: 5 ¡: 0 ×: + ; # 4; X; > l; «; . Ë; ' ú; "< 3< ?< Z< & i< < 9 < Ú< ê< & = ) -= ? W= < = ) Ô= ' þ=
&> 4> N> / j> > - ©> M ×> M %? K s? ¿? * Ò? , ý? 7 *@ ( b@ ! @ @ É@ à@ ú@ A 0 )A ZA vA =
A A ÃA ? B EB VB oB + B ( ŽB
ÝB èB ÿB & C 0 GC * xC £C ( ¹C âC = D 5 >D 1 tD ŠD " œD $ àD E $ #E HE H cE ¬E ( ËE ôE
F #F :F
SF aF $ wF 7 F 7 ÔF % G 0 2G cG E tG ºG $ ÑG öG
H (H 7 AH & yH 7 H ØH . èH & I ! >I ! `I ) I $ ¬I ÑI çI J J 2J PJ 3 gJ ( J + ÄJ ! ðJ K 'K ?K WK 9 mK I §K ñK
L &L 5L RL pL L ¥L ÄL âL / ûL +M @M ! TM vM 2 M < ÀM ýM K N X ]N / ¶N 1 æN O +O GO [O . oO = O L ÜO 3 )P " ]P C P B ÄP 8 Q / @Q & pQ % Q . œQ . ìQ ; R > WR # R I ºR ' S ( ,S ' US + }S * ©S ! ÔS
öS > T 8 CT 7 |T 3 ŽT èT ûT 2 U % IU 1 oU 5 ¡U / ×U ' V 5 /V eV ' yV D ¡V æV ( ùV @ "W D cW E šW i îW 8 XX D X 6 ÖX A
Y OY ; oY = «Y @ éY A *Z K lZ > žZ T ÷Z C L[ 5 [ Æ[ B ç[ ' *\ R\ q\ \ \ ¿\ + Ñ\ $ ý\ $ "] G] $ f] ] ] ¶] Ê] á] ö] ^ *^ >^ R^ " j^ Ð ^ ^` `` ~` 9 ` Ù` ö`
a > -a K la _ ža $ b > =b / |b ¬b K Êb ) c 3 @c 2 tc H §c E ðc W 6d 8 d < Çd W e & \e e e že Òe $ ñe 3 f 0 Jf - {f , ©f ! Öf * øf ! #g # Eg ! ig * g 0 ¶g W çg L ?h C h l Ðh I =i i j ºj 7 Xk = k E Îk ? l + Tl - l - ®l ! Ül c þl c bm j Æm v 1n j šn n o 7 o × ºo H p Ûp @ öp 7q & Mq ~ tq N óq , Br , or ? r H Ür 0 %s : Vs < s 7 Îs 3 t B :t }t 9 t - Ït c ýt ? au 3 ¡u : Õu g v 7 xv : °v X ëv ! Dw 0 fw - w $ Åw # êw H x Wx ^x
nx _ yx Ùx øx y 'y O 4y , y - ±y - ßy 0
z - >z lz $ z ! °z ( Òz r ûz Z n{ i É{ T 3| A | S Ê| ? } 9 ^} H } [ á} O =~ Q ~ V ß~ * 6 % a t ž * - < X e ) H 6 Ø F C V C C Þ 3 " V ) j * < ¿ $ ü * ! & L ' s 9 ! Õ ' ÷ 6
V
$ i
*
W ¹
< 6 N 3
¹ Ï & ë 1 " M p ` å B ? G ! © ¿ Û , û ( ^ > ³ $ É - î l _ B é < , i * * Q Ø * X E £ £ B æ ( m ° F 9 e B 3 â , * C 3 n * ¢ * Í B ø ( ; d G x c À ` $
1 £ ' Õ f ý M d ² $ Ä - é 3 R K - Ì 9 í 0 ' > X T T ì & A ? h E š # î % 8 g Y 0 Á @ ò 3 J i / ž Ð / ì X Q u 5 Ç N ý L [ m É ( â $ * - O < } 6 º < ñ . K A B 6 Ð ' < / 4 l 4 ¡ 4 Ö 4 4 @ 4 u 4 ª - ß +
0 9 0 j 4 ( Ð 4 ù * . i Y x à & <¡ # c¡ ¡ $ ¡ % Ÿ¡ ) ä¡ ! ¢ & 0¢ % W¢ & }¢ N €¢ ó¢ £ < £ X£ D w£ ? Œ£ ü£ R € X c€ 7 Œ€ H ô€ =¥ ! S¥ u¥ ! ¥ 8 ¶¥ K ï¥ W ;Š ? Š , ÓŠ K § ` L§ E § U ó§ - Iš : wš B ²š B õš @ 8© : y© Ž© Z Щ 8 +ª U dª U ºª U « U f« E Œ«
¬ U ¬ C f¬ N ª¬ W ù¬ ' Q y X 6 î M %® V s® Q Ê® 6 ¯ _ S¯ + ³¯ 9 ߯ ° ±° , Ê° d ÷° @ \± B ± } à± J ^² k ©² P ³ a f³ / ȳ J ø³ u CŽ c ¹Ž Z µ H xµ ` Áµ W "¶ ` z¶ N Û¶ ? *· Z j· D Å·
ž 'ž 7ž Ož lž ) {ž " ¥ž " Èž ëž " ¹ +¹ ;¹ P¹ a¹ u¹ ¹ ¹ µ¹ ƹ ×¹ ì¹ L G ð ' q ù É ¥ n ¶ Ï P t W 6 = Ë Š " € î
A Ò M > ž ý ö % ( 0 p f , I û K B þ ( F % } Â ` p ¡ Û R ï £ s y Ø 2 = » + ñ Æ S Q
^ 1 À ç S Å ± Ù 4 ^ ³ š T à q Ö [ W H © j u s w v * ® ë i L r 6 m e Ä æ X ü 7 y - M i N H / B F Œ E 9 5 e 1 :
x â $ Ê z ä I ª ? ~ k ¯ à O Ç k ² | µ w b P Ó ? 3 A G å a D d x è u O / Z } ] 2 # Y N & # g ) { l ; Á
E m ¹ c ú X º Ž : Ú @ { | ) . Ì C 4 õ Q 8 Ü " ¿ a Î ; - t T Ð & 9 Ñ @ z Z ø ß < c D Ý ã
J Y 8 o V Ô ' v ¬ Þ ! d Í h f ê œ Ÿ ! U á «
í ó \ < C > $ _ l V È ° 3 \ Õ 0 K 5 _ R § n ` ] b ÿ [ ô é * ÷ ~ + J r g ì j 7 o · h U ò ¢ . , ×
%1$sIs a member of:
%1$sMember groups: %1$s must be run as root
%1$s%2$sGroup: %3$s
%1$sGID number: %2$d
%1$sMember users: , your cached password will expire at: A group with the same name or GID already exists
A user or group with the same name or ID already exists
Access control provider Active Directory backup server address Active Directory client hostname Active Directory domain Active Directory primary group attribute for ID-mapping Active Directory server address Add debug timestamps Address of backup IPA server An error occurred, but no description can be found. An open file descriptor for the debug logs Attribute indicating that server side password policies are active Attribute listing authorized PAM services Attribute listing authorized server hosts Authenticated with cached credentials Authentication is denied until: Authentication provider Authentication timeout Autofs provider Automatic full refresh period Automatic smart refresh period Automounter map entry key attribute Automounter map entry value attribute Automounter map name attribute Base DN for automounter map lookups Base DN for group lookups Base DN for netgroup lookups Base DN for service lookups Base DN for sudo rules lookups Base DN for user lookups Base for home directories Become a daemon (default) Cache credentials for offline login Cannot create user's home directory: %1$s
Cannot create user's mail spool: %1$s
Cannot determine if the user was logged in on this platform Cannot find group %1$s in local domain
Cannot find group %1$s in local domain, only groups in local domain are allowed
Cannot find group in local domain, modifying groups is allowed only in local domain
Cannot find user in local domain, modifying users is allowed only in local domain
Cannot get info about the user
Cannot remove homedir: %1$s
Cannot reset SELinux login context
Cannot set SELinux login context
Cannot set default values
Comma separated list of allowed users Comma separated list of prohibited users Command to start service Could not allocate ID for the group - domain full?
Could not allocate ID for the user - domain full?
Could not modify group - check if groupname is correct
Could not modify group - check if member group names are correct
Could not modify user - check if group names are correct
Could not modify user - user already member of groups?
Could not open available domains
Could not open domain %1$s. If the domain is a subdomain (trusted domain), use fully qualified name instead of --domain/-d parameter.
Create user's directory if it does not exist Current Password: DNS service name for LDAP password change server Debug level Default shell, /bin/bash Directory on the filesystem where SSSD should store Kerberos replay cache files. Directory to store credential caches Disable Active Directory range retrieval Disable the LDAP paging control Display users/groups in fully-qualified form Do not remove home directory and mail spool Domain of the information provider (mandatory) Domain to add to names without a domain component. Don't include group members in group lookups Enable DNS sites - location based service discovery Enable credential validation Enable enumerating all users/groups Enables FAST Enables enterprise principals Enables principal canonicalization Entry cache background update timeout length (seconds) Entry cache timeout length (seconds) Enumeration cache timeout length (seconds) Error initializing the tools
Error initializing the tools - no local domain
Error looking up public keys
Error setting the locale
Error while checking if the user was logged in
File that contains CA certificates File that contains the client certificate File that contains the client key Filter for user lookups Follow LDAP referrals Force removal of files not owned by the user Full Name GECOS attribute GID attribute Group %1$s is outside the defined ID range for domain
Group member attribute Group name Group password Groups Groups must be in the same domain as user
Groups that SSSD should explicitly ignore Groups to add this group to Groups to add this user to Groups to remove this group from Groups to remove this user from Home directory Home directory attribute Host identity provider Host not specified
Hostnames and/or fully qualified domain names of this machine to filter sudo rules How long (minutes) to deny login after offline_failed_login_attempts has been reached How long to allow cached logins between online logins (days) How long to keep cached entries after last successful login (days) How long to retain a connection to the LDAP server before disconnecting How long to wait for replies from DNS when resolving servers (seconds) How long will be in-memory cache records valid How many days before password expiration a warning should be displayed How many failed logins attempts are allowed when offline How many seconds to keep a host in the known_hosts file after its host keys were requested How many seconds to keep identity information cached for PAM requests How often should expired entries be refreshed in background How often to periodically update the client's DNS entry How to dereference aliases IPA client hostname IPA domain IPA server address IPv4 or IPv6 addresses or network of this machine to filter sudo rules Identity provider Idle time before automatic disconnection of a client If a shell stored in central directory is allowed but not available, use this fallback If set to false, host argument given by PAM will be ignored Include microseconds in timestamps in debug logs Include timestamps in debug logs Internal error while parsing parameters
Internal error. Could not print group.
Internal error. Could not remove group.
Internal error. Could not remove user.
Invalid domain specified in FQDN
Invalid port
Invalidate all autofs maps Invalidate all groups Invalidate all netgroups Invalidate all services Invalidate all users Invalidate particular autofs map Invalidate particular group Invalidate particular netgroup Invalidate particular service Invalidate particular user Kerberos backup server address Kerberos realm Kerberos server address Kerberos service keytab Kill users' processes before removing him LDAP filter to determine access privileges Length of time between attempts to reconnect while offline Length of time between cache cleanups Length of time between enumeration updates Length of time to attempt connection Length of time to attempt synchronous LDAP operations Length of time to wait for a enumeration request Length of time to wait for a search request Lifetime of TGT for LDAP connection Lifetime of the TGT List of UIDs or user names allowed to access the PAC responder List of possible ciphers suites Location of the keytab to validate credentials Location of the user's credential cache Lock the account Login shell Lower bound for ID-mapping Magic Private Maximum nesting level SSSd will follow Maximum user ID Member groups must be in the same domain as parent group
Minimum user ID Modification time attribute Modification time attribute for groups Modification time attribute for netgroups NSS request failed (%1$d). Entry might remain in memory cache.
Name '%1$s' does not seem to be FQDN ('%2$s = TRUE' is set)
Name of the default domain for ID-mapping Negative cache timeout length (seconds) Netgroup name Netgroup triple attribute Netgroups members attribute Never create user's directory, overrides config New Password: No cache object matched the specified search
No such group in local domain. Printing groups only allowed in local domain.
No such group in local domain. Removing groups only allowed in local domain.
No such user in local domain. Removing users only allowed in local domain.
Not enough memory
Not removing home dir - not owned by user
Number of IDs for each slice when ID-mapping Number of times to attempt connection to Data Providers Object class for automounter map entries Object class for automounter maps Object class for sudo rules Objectclass for groups Objectclass for netgroups Objectclass for services Objectclass for users Only invalidate entries from a particular domain Only one argument expected
Out of memory
Override GID value from the identity provider with this value Override homedir value from the identity provider with this value Override shell value from the identity provider with this value PAM stack to use Password change failed. Password change provider Password expired. Change your password now. Password reset by root is not supported. Password: Passwords do not match Path to CA certificate directory Ping timeout before restarting service Please select at least one object to invalidate
Policy to evaluate the password expiration Primary GID attribute Print indirect group members recursively Print version number and exit Printf-compatible format for displaying fully-qualified names Privileged socket has wrong ownership or permissions. Public socket has wrong ownership or permissions. Reenter new Password: Regex to parse username and domain Remove home directory and mail spool Renewable lifetime of the TGT Require TLS certificate verification Require TLS for ID lookups Restrict or prefer a specific address family when performing DNS lookups Run interactive (not a daemon) SID of the default domain for ID-mapping SSH public key attribute SSSD Domains to start SSSD Services to start SSSD is not run by root. SUDO provider Scope of user lookups Search base for HBAC related objects Search base for object containing info about IPA domain Search base for objects containing info about ID ranges Selects the principal to use for FAST Send the debug output to files instead of stderr Server message: Server where the change password service is running if not on the KDC Service name attribute Service name for DNS service lookups Service port attribute Service protocol attribute Session-loading provider Set lower boundary for allowed IDs from the LDAP server Set the verbosity of the debug logging Set upper boundary for allowed IDs from the LDAP server Shell attribute Shell to use if the provider does not list one Should filtered users appear in groups Show timestamps with microseconds Specify a non-default config file Specify an alternative skeleton directory Specify debug level you want to set
Specify group to add
Specify group to add to
Specify group to delete
Specify group to modify
Specify group to remove from
Specify group to show
Specify the minimal SSF for LDAP sasl authorization Specify the sasl authorization id to use Specify the sasl authorization realm to use Specify the sasl mechanism to use Specify user to add
Specify user to delete
Specify user to modify
Store password hashes Store password if offline for later online authentication Substitute empty homedir value from the identity provider with this value Sudo rule command attribute Sudo rule host attribute Sudo rule name Sudo rule notafter attribute Sudo rule notbefore attribute Sudo rule option attribute Sudo rule order attribute Sudo rule runasgroup attribute Sudo rule runasuser attribute Sudo rule user attribute System is offline, password change not possible The GID of the group The GID of the user The SELinux user for user's login The SSSD domain to use The Schema Type in use on the LDAP server, rfc2307 The TTL to apply to the client's DNS entry after updating it The UID of the user The amount of time between lookups of the HBAC rules against the IPA server The amount of time in seconds between lookups of the SELinux maps against the IPA server The authentication token of the default bind DN The automounter location this IPA client is using The comment string The debug level to run with The default base DN The default bind DN The domain part of service discovery DNS query The interface whose IP should be used for dynamic DNS updates The list of shells that will be vetoed, and replaced with the fallback shell The list of shells users are allowed to log in with The name of the NSS library to use The number of file descriptors that may be opened by this responder The number of members that must be missing to trigger a full deref The number of records to retrieve in a single LDAP query The path to the proxy command must be absolute
The port to use to connect to the host The post-delete command failed: %1$s
The selected GID is outside the allowed range
The selected UID is outside the allowed range
The type of the authentication token of the default bind DN The value of the password field the NSS provider should return Time between two checks for renewal Timeout between three failed ping checks and forcibly killing the service Timeout for messages sent over the SBUS Transaction error. Could not add group.
Transaction error. Could not add user.
Transaction error. Could not modify group.
Transaction error. Could not modify user.
Treat usernames as case sensitive UID attribute URI of a backup LDAP server where password changes are allowed URI of an LDAP server where password changes are allowed Unexpected error while looking for an error description Unexpected format of the server credential message. Unlock the account Upper bound for ID-mapping Use ID-mapping of objectSID instead of pre-set IDs Use Kerberos auth for LDAP connection Use LDAP_MATCHING_RULE_IN_CHAIN for group lookups Use LDAP_MATCHING_RULE_IN_CHAIN for initgroup lookups Use autorid-compatible algorithm for ID-mapping Use only the upper case for realm names User %1$s is outside the defined ID range for domain
User not specified
User principal attribute (for Kerberos) User's home directory already exists, not copying data from skeldir
Username attribute Users that SSSD should explicitly ignore WARNING: The user (uid %1$lu) was still logged in when deleted.
What kind of authentication should be used to perform the DNS update What kind of messages are displayed to the user during authentication Whether the LDAP library should perform a reverse lookup to canonicalize the host name during a SASL bind Whether the nsupdate utility should default to using TCP Whether the provider should explicitly update the PTR record as well Whether to automatically update the client's DNS entry Whether to automatically update the client's DNS entry in FreeIPA Whether to create kdcinfo files Whether to evaluate the time-based attributes in sudo rules Whether to filter rules by hostname, IP addresses and network Whether to hash host names and addresses in the known_hosts file Whether to include rules that contains netgroup in host attribute Whether to include rules that contains regular expression in host attribute Whether to look up canonical group name from cache if possible Whether to update the ldap_user_shadow_last_change attribute after a password change Which attributes shall be used to evaluate if an account is expired Which rules should be used to evaluate access control Write debug messages to logfiles Your password has expired. You have %1$d grace login(s) remaining. Your password will expire in %1$d %2$s. accountExpires attribute of AD entryUSN attribute krbLastPwdChange attribute krbPasswordExpiration attribute lastUSN attribute ldap_backup_uri, The URI of the LDAP server ldap_uri, The URI of the LDAP server loginAllowedTimeMap attribute of NDS loginDisabled attribute of NDS loginExpirationTime attribute of NDS memberOf attribute nsAccountLock attribute objectSID attribute shadowExpire attribute shadowFlag attribute shadowInactive attribute shadowLastChange attribute shadowMax attribute shadowMin attribute shadowWarning attribute userAccountControl attribute of AD Project-Id-Version: PACKAGE VERSION
Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org
POT-Creation-Date: 2015-12-15 19:05+0100
PO-Revision-Date: 2014-06-04 02:04-0400
Last-Translator: jhrozek
Language-Team: Japanese (http://www.transifex.com/projects/p/sssd/language/ja/)
Language: ja
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Plural-Forms: nplurals=1; plural=0;
X-Generator: Zanata 3.7.3
%1$s ã¯æ¬¡ã®ã¡ã³ããŒ:
%1$s ã¡ã³ããŒã°ã«ãŒã: %1$s 㯠root ãšããŠå®è¡ããå¿
èŠããããŸã
%1$s%2$s ã°ã«ãŒã: %3$s
%1$s GID çªå·: %2$d
%1$s ã¡ã³ããŒãŠãŒã¶ãŒ: ããã£ãã·ã¥ããããã¹ã¯ãŒãã倱å¹ããŸã: åãååãŸã㯠GID ãæã€ã°ã«ãŒãããã§ã«ååšããŸã
åãååãŸã㯠ID ãæã€ãŠãŒã¶ãŒãŸãã¯ã°ã«ãŒãããã§ã«ååšããŸã
ã¢ã¯ã»ã¹å¶åŸ¡ãããã€ã㌠Active Directory ããã¯ã¢ãããµãŒããŒã®ã¢ãã¬ã¹ Active Directory ã¯ã©ã€ã¢ã³ããã¹ãå Active Directory ãã¡ã€ã³ ID ãããã³ã°ã® Active Directory ãã©ã€ããªãŒã°ã«ãŒãå±æ§ Active Directory ãµãŒããŒã¢ãã¬ã¹ ãããã°ã®ã¿ã€ã ã¹ã¿ã³ããè¿œå ãã ããã¯ã¢ãã IPA ãµãŒããŒã®ã¢ãã¬ã¹ ãšã©ãŒãçºçããŸãããã説æããããŸããã§ããã ãããã°ãã°ã®ãªãŒãã³ãã¡ã€ã«ãã£ã¹ã¯ãªãã¿ãŒ ãµãŒããŒåŽãã¹ã¯ãŒãããªã·ãŒãæå¹ã§ããããšãæå³ããå±æ§ èªå¯ããã PAM ãµãŒãã¹ãäžèŠ§åããå±æ§ èªå¯ããããµãŒããŒãã¹ããäžèŠ§åããå±æ§ ãã£ãã·ã¥ãããŠããã¯ã¬ãã£ã³ã·ã£ã«ãçšããŠèªèšŒãããŸãã 次ãŸã§èªèšŒãæåŠãããŸã: èªèšŒãããã€ã㌠èªèšŒã®ã¿ã€ã ã¢ãŠã Autofs ãããã€ã㌠èªåçãªå®å
šæŽæ°éé èªåçãªã¹ããŒãæŽæ°éé automounter ããããšã³ããªãŒã®ããŒå±æ§ automounter ããããšã³ããªãŒã®å€å±æ§ ãªãŒãããŠã³ãã®ãããåã®å±æ§ automonter ã®ãããæ€çŽ¢ã®ããŒã¹ DN ã°ã«ãŒãæ€çŽ¢ã®ããŒã¹ DN ãããã°ã«ãŒãæ€çŽ¢ã®ããŒã¹ DN ãµãŒãã¹æ€çŽ¢ã®ããŒã¹ DN sudo ã«ãŒã«æ€çŽ¢ã®ããŒã¹ DN ãŠãŒã¶ãŒæ€çŽ¢ã®ããŒã¹ DN ããŒã ãã£ã¬ã¯ããªãŒã®ããŒã¹ ããŒã¢ã³ãšããŠå®è¡ïŒããã©ã«ãïŒ ãªãã©ã€ã³ãã°ã€ã³ã®ããã«ã¯ã¬ãã£ã³ã·ã£ã«ããã£ãã·ã¥ãã ãŠãŒã¶ãŒã®ããŒã ãã£ã¬ã¯ããªãŒãäœæã§ããŸãã: %1$s
ãŠãŒã¶ãŒã®ã¡ãŒã«ã¹ããŒã«ãäœæã§ããŸãã: %1$s
ãŠãŒã¶ãŒããã®ãã©ãããã©ãŒã ã«ãã°ã€ã³ããŠãããã確èªã§ããŸããã§ãã ããŒã«ã«ãã¡ã€ã³ã«ã°ã«ãŒã %1$s ãèŠã€ããããŸãã
ããŒã«ã«ãã¡ã€ã³ã«ã°ã«ãŒã %1$s ãèŠã€ãããŸãããããŒã«ã«ãã¡ã€ã³ã«ããã°ã«ãŒãã®ã¿ãèš±å¯ãããŸã
ããŒã«ã«ãã¡ã€ã³ã«ã°ã«ãŒããèŠã€ãããŸããã§ãããã°ã«ãŒãã®å€æŽã¯ããŒã«ã«ãã¡ã€ã³ã«ãããŠã®ã¿èš±å¯ãããŸã
ããŒã«ã«ãã¡ã€ã³ã«ãŠãŒã¶ãŒãèŠã€ããããŸããããŠãŒã¶ãŒã®å€æŽã¯ããŒã«ã«ãã¡ã€ã³ã«ãããŠã®ã¿èš±å¯ãããŸãã
ãŠãŒã¶ãŒã«é¢ããæ
å ±ãååŸã§ããŸãã
ããŒã ãã£ã¬ã¯ããªãŒãåé€ã§ããŸãã: %1$s
SELinux ãã°ã€ã³ã³ã³ããã¹ãããªã»ããã§ããŸãã
SELinux ãã°ã€ã³ã³ã³ããã¹ããèšå®ã§ããŸãã
ããã©ã«ãå€ãèšå®ã§ããŸãã
èš±å¯ãŠãŒã¶ãŒã®ã«ã³ãåºåãäžèŠ§ çŠæ¢ãŠãŒã¶ãŒã®ã«ã³ãåºåãäžèŠ§ ãµãŒãã¹éå§ã®ã³ãã³ã ã°ã«ãŒãã« ID ãå²ãåœãŠãããŸããã§ãã - ãã¡ã€ã³ããã£ã±ãã§ãã?
ãŠãŒã¶ãŒã« ID ãå²ãåœãŠãããŸããã§ãã - ãã¡ã€ã³ããã£ã±ãã§ãã?
ã°ã«ãŒããå€æŽã§ããŸããã§ãã - ã°ã«ãŒãåãæ£ãããã確èªããŠãã ãã
ã°ã«ãŒããå€æŽã§ããŸããã§ãã - ã¡ã³ããŒã°ã«ãŒãåãæ£ãããã確èªããŠãã ãã
ãŠãŒã¶ãŒãå€æŽã§ããŸããã§ãã - ã°ã«ãŒãåãæ£ãããã確èªããŠãã ãã
ãŠãŒã¶ãŒãå€æŽã§ããŸããã§ãã - ãŠãŒã¶ãŒã¯ãã§ã«ã°ã«ãŒãã®ã¡ã³ããŒã§ãã?
å©çšå¯èœãªãã¡ã€ã³ãéããŸããã§ãã
ãã¡ã€ã³ %1$s ãéããŸããã§ããããã¡ã€ã³ããµããã¡ã€ã³ (ä¿¡é Œæžã¿ãã¡ã€ã³) ã§ããã°ã--domain/-d ãã©ã¡ãŒã¿ãŒã®ä»£ããã«å®å
šä¿®é£Ÿåã䜿çšããŠãã ããã
ãŠãŒã¶ãŒã®ãã£ã¬ã¯ããªãŒãååšããªããã°äœæãã çŸåšã®ãã¹ã¯ãŒã: LDAP ãã¹ã¯ãŒãã®å€æŽãµãŒããŒã® DNS ãµãŒãã¹å ãããã°ã¬ãã« ããã©ã«ãã®ã·ã§ã«, /bin/bash SSSD ã Kerberos ãªãã¬ã€ãã£ãã·ã¥ãã¡ã€ã«ãä¿åãããã¡ã€ã«ã·ã¹ãã ã®ãã£ã¬ã¯ããªã§ãã ã¯ã¬ãã£ã³ã·ã£ã«ã®ãã£ãã·ã¥ãä¿åãããã£ã¬ã¯ããªãŒ Active Directory ç¯å²ã®ååŸã®ç¡å¹å LDAP ããŒãžã³ã°å¶åŸ¡ãç¡å¹åãã ãŠãŒã¶ãŒã»ã°ã«ãŒããå®å
šä¿®é£Ÿåœ¢åŒã§è¡šç€ºãã ããŒã ãã£ã¬ã¯ããªãŒãšã¡ãŒã«ã¹ããŒã«ãåé€ããªã æ
å ±ãããã€ããŒã®ãã¡ã€ã³ (å¿
é ) domain èŠçŽ ãªãã§è¿œå ãããã¡ã€ã³ã®ååã ã°ã«ãŒãæ€çŽ¢ã«ã°ã«ãŒãã¡ã³ããŒãå«ããªã DNS ãµã€ãã®æå¹å - äœçœ®ã«ãµãŒãã¹æ¢çŽ¢ ã¯ã¬ãã£ã³ã·ã£ã«ã®æ€èšŒãæå¹ã«ãã ãã¹ãŠã®ãŠãŒã¶ãŒã»ã°ã«ãŒãã®åæãæå¹ã«ãã FAST ãæå¹ã«ãã ãšã³ã¿ãŒãã©ã€ãºã»ããªã³ã·ãã«ã®æå¹å ããªã³ã·ãã«æ£èŠåãæå¹ã«ãã ãšã³ããªãŒãã£ãã·ã¥ã®ããã¯ã°ã©ãŠã³ãæŽæ°ã®ã¿ã€ã ã¢ãŠãæéïŒç§ïŒ ãšã³ããªãŒãã£ãã·ã¥ã®ã¿ã€ã ã¢ãŠãé·ïŒç§ïŒ åæãã£ãã·ã¥ã®ã¿ã€ã ã¢ãŠãïŒç§ïŒ ããŒã«ãåæåäžã«ãšã©ãŒãçºçããŸãã
ããŒã«ãåæåäžã«ãšã©ãŒãçºçããŸãã - ããŒã«ã«ãã¡ã€ã³ããããŸãã
å
¬ééµã®æ€çŽ¢äžã«ãšã©ãŒãçºçããŸãã
ãã±ãŒã«ã®èšå®äžã«ãšã©ãŒãçºçããŸãã
ãŠãŒã¶ãŒããã°ã€ã³ããŠãããã確èªäžã«ãšã©ãŒãçºçããŸãã
CA 蚌ææžãå«ããã¡ã€ã« ã¯ã©ã€ã¢ã³ã蚌ææžãå«ããã¡ã€ã« ã¯ã©ã€ã¢ã³ãã®éµãå«ããã¡ã€ã« ãŠãŒã¶ãŒæ€çŽ¢ã®ãã£ã«ã¿ãŒ LDAP ãªãã§ã©ã«ã«ãããã ãŠãŒã¶ãŒã«ããææãããŠããªããã¡ã€ã«ã®åŒ·å¶åé€ æ°å GECOS ã®å±æ§ GID å±æ§ ã°ã«ãŒã %1$s ã¯ãã¡ã€ã³ã«å¯ŸããŠå®çŸ©ããã ID ã®ç¯å²ãè¶ããŠããŸã
ã°ã«ãŒãã¡ã³ããŒå±æ§ ã°ã«ãŒãå ã°ã«ãŒãã®ãã¹ã¯ãŒã ã°ã«ãŒã ã°ã«ãŒãããŠãŒã¶ãŒãšåããã¡ã€ã³ã«ãªããã°ãããŸãã
SSSD ãæ瀺çã«ç¡èŠããã°ã«ãŒã ãã®ã°ã«ãŒãã«è¿œå ããã°ã«ãŒã ãã®ãŠãŒã¶ãŒãè¿œå ããã°ã«ãŒã ãã®ã°ã«ãŒãããåé€ããã°ã«ãŒã ãã®ãŠãŒã¶ãŒãåé€ããã°ã«ãŒã ããŒã ãã£ã¬ã¯ããªãŒ ããŒã ãã£ã¬ã¯ããªã®å±æ§ ãã¹ãèå¥ãããã€ã㌠ãã¹ããæå®ãããŠããŸãã
sudo ã«ãŒã«ããã£ã«ã¿ãŒãããã®ãã·ã³ã®ãã¹ãåããã³/ãŸãã¯å®å
šä¿®é£Ÿãã¡ã€ã³å offline_failed_login_attempts ã«éããåŸã«ãã°ã€ã³ãæåŠããæéïŒåïŒ ãªã³ã©ã€ã³ãã°ã€ã³äžã«ãã£ãã·ã¥ã«ãããã°ã€ã³ã蚱容ãããæéïŒæ¥æ°ïŒ æçµãã°ã€ã³æåæãããã£ãã·ã¥ãšã³ããªãŒãä¿æããæ¥æ° LDAP ãµãŒããŒãåæããåã«æ¥ç¶ãä¿æããæé ãµãŒããŒãåå解決ãããšãã« DNS ããå¿çãåŸ
ã€æéïŒç§ïŒ ã¡ã¢ãªãŒå
ã®ãã£ãã·ã¥ã¬ã³ãŒããæå¹ãªæé èŠåã衚瀺ããããã¹ã¯ãŒã倱å¹åã®æ¥æ° ãªãã©ã€ã³ã®ãšãã«èš±å®¹ããããã°ã€ã³è©Šè¡å€±æåæ° ãã¹ãéµãèŠæ±ãããåŸ known_hosts ãã¡ã€ã«ã«ãã¹ããä¿æããç§æ° PAM èŠæ±ã«å¯ŸããŠãã£ãã·ã¥ãããèªèšŒæ
å ±ãä¿æããç§æ° æéåãã®ãšã³ããªãŒãããã¯ã°ã©ãŠã³ãã§æŽæ°ãããé »åºŠ ã©ã®ãããå®æçã«ã¯ã©ã€ã¢ã³ãã® DNS ãšã³ããªãŒãæŽæ°ããã ãšã€ãªã¢ã¹ãåç
§è§£æ±ºããæ¹æ³ IPA ã¯ã©ã€ã¢ã³ãã®ãã¹ãå IPA ãã¡ã€ã³ IPA ãµãŒããŒã®ã¢ãã¬ã¹ sudo ã«ãŒã«ããã£ã«ã¿ãŒãããã®ãã·ã³ã® IPv4 ãŸã㯠IPv6 ã¢ãã¬ã¹ãŸãã¯ãããã¯ãŒã¯ ã¢ã€ãã³ãã£ãã£ãããã€ã㌠ã¯ã©ã€ã¢ã³ãã®èªååæãŸã§ã®ã¢ã€ãã«æé äžå€®ãã£ã¬ã¯ããªãŒã«ä¿åãããã·ã§ã«ãèš±å¯ãããããå©çšã§ããªãå Žåããã®ãã©ãŒã«ããã¯ã䜿çšãã ããåœã«èšå®ãããŠãããšã PAM ã«ããæž¡ããããã¹ãåŒæ°ã¯ç¡èŠãããŸã ãããã°ãã°ã«ããªç§åäœã®ã¿ã€ã ã¹ã¿ã³ããå«ãã ãããã°ãã°ã«ã¿ã€ã ã¹ã¿ã³ããå«ãã ãã©ã¡ãŒã¿ãŒã解æäžã«å
éšãšã©ãŒãçºçããŸãã
å
éšãšã©ãŒãã°ã«ãŒãã衚瀺ã§ããŸããã§ããã
å
éšãšã©ãŒãã°ã«ãŒããåé€ã§ããŸããã§ããã
å
éšãšã©ãŒããŠãŒã¶ãŒãåé€ã§ããŸããã§ããã
FQDN ã§æå®ããããã¡ã€ã³ãç¡å¹ã§ã
ç¡å¹ãªããŒã
ãã¹ãŠã® autofs ãããã®ç¡å¹å ãã¹ãŠã®ã°ã«ãŒããç¡å¹ã«ãã ãã¹ãŠã®ãããã¯ãŒã¯ã°ã«ãŒããç¡å¹ã«ãã ãã¹ãŠã®ãµãŒãã¹ã®ç¡å¹å ãã¹ãŠã®ãŠãŒã¶ãŒãç¡å¹ã«ãã ç¹å®ã® autofs ãããã®ç¡å¹å ç¹å®ã®ã°ã«ãŒããç¡å¹ã«ãã ç¹å®ã®ãããã¯ãŒã¯ã°ã«ãŒããç¡å¹ã«ãã ç¹å®ã®ãµãŒãã¹ã®ç¡å¹å ç¹å®ã®ãŠãŒã¶ãŒãç¡å¹ã«ãã Kerberos ããã¯ã¢ãããµãŒããŒã®ã¢ãã¬ã¹ Kerberos ã¬ã«ã Kerberos ãµãŒããŒã®ã¢ãã¬ã¹ Kerberos ãµãŒãã¹ã®ããŒããŒãã« ãŠãŒã¶ãŒãåé€ããåã«ãã®ãŠãŒã¶ãŒã®ããã»ã¹ã匷å¶åæ¢ãã ã¢ã¯ã»ã¹æš©éã決ããããã® LDAP ãã£ã«ã¿ãŒ ãªãã©ã€ã³ã®éã«åæ¥ç¶ãè©Šè¡ããæé ãã£ãã·ã¥ãã¯ãªãŒã³ã¢ããããéé åæã®æŽæ°éé æ¥ç¶ãè©Šè¡ããæé LDAP åææäœãè©Šè¡ããæé åæã®èŠæ±ãåŸ
ã€æé æ€çŽ¢èŠæ±ãåŸ
ã€æé LDAP æ¥ç¶ã® TGT ã®æå¹æé TGT ã®æå¹æé PAC ã¬ã¹ãã³ããŒãžã®ã¢ã¯ã»ã¹ãèš±å¯ããã UID ãŸãã¯ãŠãŒã¶ãŒåã®äžèŠ§ å©çšå¯èœãªæå·ã®äžèŠ§ ã¯ã¬ãã£ã³ã·ã£ã«ãæ€èšŒããããŒããŒãã«ã®å Žæ ãŠãŒã¶ãŒã®ã¯ã¬ãã£ã³ã·ã£ã«ãã£ãã·ã¥ã®äœçœ® ã¢ã«ãŠã³ããããã¯ãã ãã°ã€ã³ã·ã§ã« ID ãããã³ã°ã®äžé ããžãã¯ãã©ã€ããŒã SSSd ãããããæ倧å
¥ãåã¬ãã« æ倧ãŠãŒã¶ãŒ ID ã¡ã³ããŒã°ã«ãŒãã芪ã°ã«ãŒããšåããã¡ã€ã³ã«ããå¿
èŠããããŸã
æå°ãŠãŒã¶ãŒ ID å€æŽæ¥æã®å±æ§ ã°ã«ãŒãã®å€æŽæ¥æã®å±æ§ ãããã°ã«ãŒãã®å€æŽæ¥æã®å±æ§ NSS ãªã¯ãšã¹ãã«å€±æããŸãã (%1$d)ãé
ç®ã¯ã¡ã¢ãªãŒãã£ãã·ã¥ã«æ®ãããŸãã
åå '%1$s' ã FQDN ã§ããããã«èŠããŸãã ('%2$s = TRUE' ãèšå®ãããŸã)
ID ãããã³ã°ã«å¯Ÿããããã©ã«ããã¡ã€ã³ã®åå ãã¬ãã£ããã£ãã·ã¥ã®ã¿ã€ã ã¢ãŠãïŒç§ïŒ ãããã°ã«ãŒãå ãããã°ã«ãŒãã®äžã€çµã®å±æ§ ãããã°ã«ãŒãã¡ã³ããŒã®å±æ§ ãŠãŒã¶ãŒã®ãã£ã¬ã¯ããªãŒãäœæããªããèšå®ãäžæžããã æ°ãããã¹ã¯ãŒã: æå®ãããæ€çŽ¢ã«äžèŽãããã£ãã·ã¥ãªããžã§ã¯ãããããŸãã
ãã®ãããªã°ã«ãŒãã¯ããŒã«ã«ãã¡ã€ã³ã«ãããŸãããã°ã«ãŒãã®è¡šç€ºã¯ããŒã«ã«ãã¡ã€ã³ã«ãããŠã®ã¿èš±å¯ãããŸãã
ãã®ãããªã°ã«ãŒãã¯ããŒã«ã«ãã¡ã€ã³ã«ãããŸãããã°ã«ãŒãã®åé€ã¯ããŒã«ã«ãã¡ã€ã³ã«ãããŠã®ã¿èš±å¯ãããŸãã
ãã®ãããªãŠãŒã¶ãŒã¯ããŒã«ã«ãã¡ã€ã³ã«ããŸããããŠãŒã¶ãŒã®åé€ã¯ããŒã«ã«ãã¡ã€ã³ã«ãããŠã®ã¿èš±å¯ãããŸãã
ååãªã¡ã¢ãªãŒããããŸãã
ããŒã ãã£ã¬ã¯ããªãŒãåé€ããŠããŸãã - ãŠãŒã¶ãŒã«ããææãããŠããŸãã
ID ãããã³ã°ãããšããåã¹ã©ã€ã¹ã«å¯Ÿãã ID ã®æ° ããŒã¿ãããã€ããŒã®æ¥ç¶ãè©Šè¡ããåæ° automounter ããããšã³ããªãŒã®ãªããžã§ã¯ãã¯ã©ã¹ automounter ãããã®ãªããžã§ã¯ãã¯ã©ã¹ sudo ã«ãŒã«ã®ãªããžã§ã¯ãã¯ã©ã¹ ã°ã«ãŒãã®ãªããžã§ã¯ãã¯ã©ã¹ ãããã°ã«ãŒãã®ãªããžã§ã¯ãã¯ã©ã¹ ãµãŒãã¹ã®ãªããžã§ã¯ãã¯ã©ã¹ ãŠãŒã¶ãŒã®ãªããžã§ã¯ãã¯ã©ã¹ ç¹å®ã®ãã¡ã€ã³ã®ã¿ãããšã³ããªãŒãç¡å¹ã«ãã åŒæ°ãäžã€ã®ã¿æåŸ
ãããŸã
ã¡ã¢ãªãŒäžè¶³
èå¥ãããã€ããŒããã® GID å€ããã®å€ã§äžæžããã èå¥ãããã€ããŒããã®ããŒã ãã£ã¬ã¯ããªãŒã®å€ããã®å€ã§äžæžããã ã¢ã€ãã³ãã£ãã£ãããã€ããŒããã®ã·ã§ã«å€ããã®å€ã§äžæžãããŸã 䜿çšãã PAM ã¹ã¿ã㯠ãã¹ã¯ãŒãã®å€æŽã«å€±æããŸããã ãã¹ã¯ãŒãå€æŽãããã€ã㌠ãã¹ã¯ãŒãã®æéãåããŸãããããŸãããã¹ã¯ãŒããå€æŽããŠãã ããã root ã«ãããã¹ã¯ãŒãã®ãªã»ããã¯ãµããŒããããŸããã ãã¹ã¯ãŒã: ãã¹ã¯ãŒããäžèŽããŸãã CA 蚌ææžã®ãã£ã¬ã¯ããªãŒã®ãã¹ ãµãŒãã¹åèµ·ååã® Ping ã¿ã€ã ã¢ãŠã ç¡å¹åãããªããžã§ã¯ããå°ãªããšãäžã€éžæããŠãã ãã
ãã¹ã¯ãŒã倱å¹ã®è©äŸ¡ã®ããªã·ãŒ ãã©ã€ããªãŒ GID ã®å±æ§ éæ¥ã°ã«ãŒãã¡ã³ããŒãååž°çã«è¡šç€ºãã ããŒãžã§ã³çªå·ã衚瀺ããŠçµäºãã å®å
šä¿®é£Ÿåã衚瀺ããããã® printf äºæã®åœ¢åŒ ç¹æš©ãœã±ããã®ææè
ãŸãã¯ããŒããã·ã§ã³ã誀ã£ãŠããŸãã å
¬éãœã±ããã®ææè
ãŸãã¯ããŒããã·ã§ã³ã誀ã£ãŠããŸãã æ°ãããã¹ã¯ãŒãã®åå
¥å: ãŠãŒã¶ãŒåãšãã¡ã€ã³ãæ§æ解æããæ£èŠè¡šçŸ ããŒã ãã£ã¬ã¯ããªãŒãšã¡ãŒã«ã¹ããŒã«ãåé€ãã æŽæ°å¯èœãª TGT ã®æå¹æé TLS 蚌ææžã®æ€èšŒãèŠæ±ãã ID æ€çŽ¢ã« TLS ãèŠæ±ãã DNS æ€çŽ¢ãå®è¡ãããšãã«ç¹å®ã®ã¢ãã¬ã¹ãã¡ããªãŒãå¶éãŸãã¯åªå
ããŸã 察話çã«å®è¡ïŒããŒã¢ã³ã§ã¯ãªãïŒ ID ãããã³ã°ã«å¯Ÿããããã©ã«ããã¡ã€ã³ã® SID SSH å
¬ééµã®å±æ§ éå§ãã SSSD ãã¡ã€ã³ éå§ãã SSSD ãµãŒãã¹ SSSD 㯠root ã«ããå®è¡ãããŸããã SUDO ãããã€ã㌠ãŠãŒã¶ãŒæ€çŽ¢ã®ç¯å² HBAC é¢é£ãªããžã§ã¯ãã®æ€çŽ¢ããŒã¹ IPA ãã¡ã€ã³ã«é¢ããæ
å ±ãå«ããªããžã§ã¯ãã«å¯Ÿããæ€çŽ¢ããŒã¹ ID ç¯å²ã«é¢ããæ
å ±ãå«ããªããžã§ã¯ãã«å¯Ÿããæ€çŽ¢ããŒã¹ FAST ã«äœ¿çšããããªã³ã·ãã«ãéžæãã ãããã°åºåãæšæºãšã©ãŒã®ä»£ããã«ãã¡ã€ã«ã«éä¿¡ãã ãµãŒããŒã®ã¡ãã»ãŒãž: KDC ã«ãªããã°ããã¹ã¯ãŒãå€æŽãµãŒãã¹ãå®è¡ãããŠãããµãŒã㌠ãµãŒãã¹åã®å±æ§ DNS ãµãŒãã¹æ€çŽ¢ã®ãµãŒãã¹å ãµãŒãã¹ããŒãã®å±æ§ ãµãŒãã¹ãããã³ã«ã®å±æ§ ã»ãã·ã§ã³èªã¿èŸŒã¿ãããã€ã㌠LDAP ãµãŒããŒããèš±å¯ããã ID ã®äžéã®èšå® ãããã°ã®ãã®ã³ã°ã®åé·æ§ãèšå®ãã LDAP ãµãŒããŒããèš±å¯ããã ID ã®äžéã®èšå® ã·ã§ã«ã®å±æ§ ãããã€ããŒãäžèŠ§ã«æã£ãŠããªããšã䜿çšããã·ã§ã« ãã£ã«ã¿ãŒããããŠãŒã¶ãŒãã°ã«ãŒãã«è¡šç€ºãã ã¿ã€ã ã¹ã¿ã³ããããªç§åäœã§è¡šç€ºãã éæšæºã®èšå®ãã¡ã€ã«ã®æå® ä»£æ¿ã®ã¹ã±ã«ãã³ãã£ã¬ã¯ããªãŒãæå®ãã èšå®ããããããã°ã¬ãã«ãæå®ãã
è¿œå ããã°ã«ãŒããæå®ããŠãã ãã
è¿œå ããã°ã«ãŒããæå®ããŠãã ãã
åé€ããã°ã«ãŒããæå®ããŠãã ãã
å€æŽããã°ã«ãŒããæå®ããŠãã ãã
åé€ããã°ã«ãŒããæå®ããŠãã ãã
衚瀺ããã°ã«ãŒããæå®ããŠãã ãã
LDAP SASL èªå¯ã®æå° SSF ãæå®ãã 䜿çšãã SASL èªå¯ ID ãæå®ãã 䜿çšãã SASL èªå¯ã¬ã«ã ãæå®ãã 䜿çšãã SASL ã¡ã«ããºã ãæå®ãã è¿œå ãããŠãŒã¶ãŒãæå®ããŠãã ãã
åé€ãããŠãŒã¶ãŒãæå®ãã
å€æŽãããŠãŒã¶ãŒãæå®ããŠãã ãã
ãã¹ã¯ãŒãããã·ã¥ãä¿åãã åŸãããªã³ã©ã€ã³èªèšŒããããã«ãªãã©ã€ã³ã®å Žåã«ãã¹ã¯ãŒããä¿åããŸã ã¢ã€ãã³ãã£ãã£ãããã€ããŒããã®ç©ºã®ããŒã ãã£ã¬ã¯ããªãŒããã®å€ã§çœ®ãæããŸã sudo ã«ãŒã«ã®ã³ãã³ãã®å±æ§ sudo ã«ãŒã«ã®ãã¹ãã®å±æ§ sudo ã«ãŒã«å sudo ã«ãŒã«ã® notafter ã®å±æ§ sudo ã«ãŒã«ã® notbefore ã®å±æ§ sudo ã«ãŒã«ã®ãªãã·ã§ã³ã®å±æ§ sudo ã«ãŒã«ã® order ã®å±æ§ sudo ã«ãŒã«ã® runasgroup ã®å±æ§ sudo ã«ãŒã«ã® runasuser ã®å±æ§ sudo ã«ãŒã«ã®ãŠãŒã¶ãŒã®å±æ§ ã·ã¹ãã ããªãã©ã€ã³ã§ãããã¹ã¯ãŒãå€æŽãã§ããŸãã ã°ã«ãŒãã® GID ãŠãŒã¶ãŒã® GID ãŠãŒã¶ãŒã®ãã°ã€ã³ã«å¯Ÿãã SELinux ãŠãŒã¶ãŒ 䜿çšãã SSSD ãã¡ã€ã³ LDAP ãµãŒããŒã«ãããŠäœ¿çšäžã®ã¹ããŒã圢åŒ, rfc2307 ã¯ã©ã€ã¢ã³ãã® DNS é
ç®ãæŽæ°åŸãé©çšãã TTL ãŠãŒã¶ãŒã® UID IPA ãµãŒããŒã«å¯Ÿãã HBAC ã«ãŒã«ãæ€çŽ¢ããŠããéã®åèšæé IPA ãµãŒããŒã«å¯Ÿãã SELinux ãããã®æ€çŽ¢ã®éã®ç§åäœã®åèšæé ããã©ã«ãã®ãã€ã³ã DN ã®èªèšŒããŒã¯ã³ ãã® IPA ã¯ã©ã€ã¢ã³ãã䜿çšããŠãã automounter ã®å Žæ ã³ã¡ã³ãæåå å®è¡ãããããã°ã¬ãã« ããã©ã«ãã®ããŒã¹ DN ããã©ã«ãã®ãã€ã³ã DN ãµãŒãã¹æ€çŽ¢ DNS ã¯ãšãªãŒã®ãã¡ã€ã³éšå åç DNS æŽæ°ã®ããã«äœ¿çšããã IP ã®ã€ã³ã¿ãŒãã§ãŒã¹ æåŠãããŠãã©ãŒã«ããã¯ã·ã§ã«ã§çœ®ãæããããã·ã§ã«ã®äžèŠ§ ãŠãŒã¶ãŒããã°ã€ã³ãèš±å¯ãããã·ã§ã«ã®äžèŠ§ 䜿çšãã NSS ã©ã€ãã©ãªãŒã®åå ãã®ã¬ã¹ãã³ããŒã«ã«ããéããããã¡ã€ã«èšè¿°åã®æ° å®å
šãªåç
§è§£æ±ºãåŒãèµ·ããããã«æ¬ ããŠããå¿
èŠãããã¡ã³ããŒã®æ° åäžã® LDAP åãåããã«ãããŠååŸããã¬ã³ãŒãæ° ãããã·ãŒã³ãã³ããžã®ãã¹ã¯çµ¶å¯Ÿãã¹ã«ããå¿
èŠããããŸã
ãã¹ããžã®æ¥ç¶ã«äœ¿çšããããŒã åé€åŸã³ãã³ãã®å®è¡ã«å€±æããŸãã: %1$s
éžæããã GID ã¯èš±å®¹ãããç¯å²ãè¶ããŠããŸã
éžæããã UID ã¯èš±å®¹ãããç¯å²ãè¶ããŠããŸã
ããã©ã«ãã®ãã€ã³ã DN ã®èªèšŒããŒã¯ã³ã®çš®é¡ NSS ãããã€ããŒãè¿ããã¹ã¯ãŒãé
ç®ã®å€ æŽæ°ã確èªããéé 3 å ã® ping ãã§ãã¯å€±æãšãµãŒãã¹ã®åŒ·å¶åæ¢ã®ã¿ã€ã ã¢ãŠãéé SBUS çµç±ã®ã¡ãã»ãŒãžéä¿¡ã®ã¿ã€ã ã¢ãŠã ãã©ã³ã¶ã¯ã·ã§ã³ãšã©ãŒãã°ã«ãŒããè¿œå ã§ããŸããã§ããã
ãã©ã³ã¶ã¯ã·ã§ã³ãšã©ãŒããŠãŒã¶ãŒãè¿œå ã§ããŸããã§ããã
ãã©ã³ã¶ã¯ã·ã§ã³ãšã©ãŒãã°ã«ãŒããå€æŽã§ããŸããã§ããã
ãã©ã³ã¶ã¯ã·ã§ã³ãšã©ãŒããŠãŒã¶ãŒãå€æŽã§ããŸããã§ããã
ãŠãŒã¶ãŒåã倧æåå°æåãåºå¥ããããåãæ±ã UID ã®å±æ§ ãã¹ã¯ãŒãã®å€æŽãèš±å¯ãããããã¯ã¢ãã LDAP ãµãŒããŒã® URI ãã¹ã¯ãŒãã®å€æŽãèš±å¯ããã LDAP ãµãŒããŒã® URI ãšã©ãŒã®èª¬æãæ€çŽ¢äžã«äºæããªããšã©ãŒãçºçããŸãã ãµãŒããŒã®ã¯ã¬ãã£ã³ã·ã£ã«ã¡ãã»ãŒãžã®äºæããªã圢åŒã§ãã ã¢ã«ãŠã³ããããã¯è§£é€ãã ID ãããã³ã°ã®äžé äºåèšå®æžã¿ ID ã®ä»£ããã« objectSID ã® ID ãããã³ã°ã䜿çšããŸã LDAP æ¥ç¶ã«å¯Ÿã㊠Kerberos èªèšŒã䜿çšãã ã°ã«ãŒãæ€çŽ¢ã®ããã« LDAP_MATCHING_RULE_IN_CHAIN ã䜿çšããŸã åæã°ã«ãŒãã®æ€çŽ¢ã®ããã« LDAP_MATCHING_RULE_IN_CHAIN ã䜿çšããŸã ID ãããã³ã°ã«å¯Ÿãã autorid äºæã¢ã«ãŽãªãºã ã䜿çšããŸã ã¬ã«ã åã«å¯ŸããŠå€§æåã®ã¿ã䜿çšãã ãŠãŒã¶ãŒ %1$s ã¯ãã¡ã€ã³ã«å¯ŸããŠå®çŸ©ããã ID ã®ç¯å²ãè¶
ããŠããŸã
ãŠãŒã¶ãŒãæå®ãããŠããŸãã
ãŠãŒã¶ãŒããªã³ã·ãã«ã®å±æ§ïŒKerberos çšïŒ ãŠãŒã¶ãŒã®ããŒã ãã£ã¬ã¯ããªãŒããã§ã«ååšããŸããã¹ã±ã«ãã³ãã£ã¬ã¯ããªãŒããããŒã¿ãã³ããŒããŸãã
ãŠãŒã¶ãŒåã®å±æ§ SSSD ãæ瀺çã«ç¡èŠãããŠãŒã¶ãŒ èŠå: ãŠãŒã¶ãŒ (uid %1$lu) ãåé€ããããšãã«ãŸã ãã°ã€ã³ããŠããŸããã
DNS æŽæ°ãå®è¡ããããã«äœ¿çšãã¹ãèªèšŒã®çš®é¡ èªèšŒäžã«ãŠãŒã¶ãŒã«è¡šç€ºãããã¡ãã»ãŒãžã®çš®é¡ LDAP ã©ã€ãã©ãªãŒã SASL ãã€ã³ãäžã«ãã¹ãåãæ£èŠåããããã«éåŒããå®è¡ãããã©ãã nsupdate ãŠãŒãã£ãªãã£ãæšæºã§ TCP ã䜿çšãããã©ãã ãããã€ããŒãåãããã« PTR ã¬ã³ãŒããæ瀺çã«æŽæ°ããå¿
èŠããããã©ãã èªåçã«ã¯ã©ã€ã¢ã³ãã® DNS ãšã³ããªãŒãæŽæ°ãããã©ãã FreeIPA ã«ããã¯ã©ã€ã¢ã³ãã® DNS ãšã³ããªãŒãèªåçã«æŽæ°ãããã©ãã kdcinfo ãã¡ã€ã«ãäœæãããã©ãã sudo ã«ãŒã«ã«ãããŠæéã«ããå±æ§ãè©äŸ¡ãããã©ãã ãã¹ãåãIP ã¢ãã¬ã¹ããã³ãããã¯ãŒã¯ã«ãããã£ã«ã¿ãŒã«ãŒã«ã䜿çšãããã©ãã known_hosts ãã¡ã€ã«ã«ãããŠãã¹ãåãšã¢ãã¬ã¹ãããã·ã¥åãããã©ãã ãã¹ãå±æ§ã«ãããã¯ãŒã¯ã°ã«ãŒããå«ãã«ãŒã«ãå«ãããã©ãã ãã¹ãå±æ§ã«æ£èŠè¡šçŸãå«ãã«ãŒã«ãå«ãããã©ãã å¯èœãªãã°ãã£ãã·ã¥ããæ£èŠåãããã°ã«ãŒãåãæ€çŽ¢ãããã©ãã ãã¹ã¯ãŒãå€æŽåŸ ldap_user_shadow_last_change å±æ§ãæŽæ°ãããã©ãã ã©ã®å±æ§ãã¢ã«ãŠã³ãã倱å¹ããŠããããè©äŸ¡ããããã«äœ¿çšãããã ã©ã®ã«ãŒã«ãã¢ã¯ã»ã¹å¶åŸ¡ãè©äŸ¡ããããã«äœ¿çšãããã ãããã°ã¡ãã»ãŒãžããã°ãã¡ã€ã«ã«æžã蟌ã ãã¹ã¯ãŒãã®æéãåããŠããŸããããš %1$d åãã°ã€ã³ã§ããŸãã ããªãã®ãã¹ã¯ãŒã㯠%1$d %2$s ã«å±éºãåããŸãã AD ã® accountExpires å±æ§ entryUSN å±æ§ krbLastPwdChange å±æ§ krbPasswordExpiration å±æ§ lastUSN å±æ§ ldap_backup_uri, LDAP ãµãŒããŒã® URI ldap_uri, LDAP ãµãŒããŒã® URI NDS ã® loginAllowedTimeMap å±æ§ NDS ã® loginDisabled å±æ§ NDS ã® loginExpirationTime å±æ§ memberOf å±æ§ nsAccountLock å±æ§ objectSID å±æ§ shadowExpire å±æ§ shadowFlag å±æ§ shadowInactive å±æ§ shadowLastChange å±æ§ shadowMax å±æ§ shadowMin å±æ§ shadowWarning å±æ§ AD ã® userAccountControl å±æ§