path: root/ru_RU.KOI8-R/books/handbook/security/chapter.sgml

<!--
     The FreeBSD Documentation Project

     $FreeBSD$
     $FreeBSDru: frdp/doc/ru_RU.KOI8-R/books/handbook/security/chapter.sgml,v 1.54 2006/06/30 12:36:59 marck Exp $

     Original revision: 1.296
-->

<chapter id="security">
  <chapterinfo>
    <authorgroup>
      <author>
	<firstname>Matthew</firstname>
	<surname>Dillon</surname>
	<contrib>âÏÌØÛÁÑ ÞÁÓÔØ ÜÔÏÊ ÇÌÁ×Ù ÂÙÌÁ ×ÚÑÔÁ ÉÚ ÓÔÒÁÎÉÃÙ ÓÐÒÁ×ÏÞÎÉËÁ
	security(7) ËÏÔÏÒÕÀ ÎÁÐÉÓÁÌ </contrib>
      </author>
    </authorgroup>
    <authorgroup>
      <author>
	<firstname>äÅÎÉÓ</firstname>
	<surname>ðÅÐÌÉÎ</surname>
	<contrib>ðÅÒÅ×ÏÄ ÎÁ ÒÕÓÓËÉÊ ÑÚÙË: </contrib>
      </author>
    </authorgroup>
  </chapterinfo>

  <title>âÅÚÏÐÁÓÎÏÓÔØ</title>
  <indexterm><primary>ÂÅÚÏÐÁÓÎÏÓÔØ</primary></indexterm>

  <sect1 id="security-synopsis">
    <title>ëÒÁÔËÏÅ ÏÐÉÓÁÎÉÅ</title>

    <para>üÔÁ ÇÌÁ×Á ÐÒÅÄÓÔÁ×ÌÑÅÔ ××ÅÄÅÎÉÅ × ÏÓÎÏ×ÎÙÅ ËÏÎÃÅÐÃÉÉ ÂÅÚÏÐÁÓÎÏÓÔÉ
      ÓÉÓÔÅÍÙ, ÎÅËÏÔÏÒÙÅ ÜÍÐÉÒÉÞÅÓËÉÅ ÐÒÁ×ÉÌÁ É ÂÏÌÅÅ ÐÏÄÒÏÂÎÏ ÏÂÒÁÝÁÅÔÓÑ Ë
      ÏÔÄÅÌØÎÙÍ ÔÅÍÁÍ, ËÁÓÁÀÝÉÍÓÑ &os;.  âÏÌØÛÁÑ ÞÁÓÔØ ÚÁÔÒÁÇÉ×ÁÅÍÙÈ ÔÅÍ ÍÏÖÅÔ
      ÂÙÔØ ÐÒÉÍÅÎÅÎÁ Ë ÂÅÚÏÐÁÓÎÏÓÔÉ ÓÉÓÔÅÍÙ É ÂÅÚÏÐÁÓÎÏÓÔÉ × ÉÎÔÅÒÎÅÔ ×ÏÏÂÝÅ.
      éÎÔÅÒÎÅÔ ÂÏÌØÛÅ ÎÅ ÔÏ <quote>ÄÒÕÖÅÓÔ×ÅÎÎÏÅ</quote> ÍÅÓÔÏ, ÇÄÅ ËÁÖÄÙÊ
      ÈÏÞÅÔ ÂÙÔØ ×ÁÍ ÄÏÂÒÙÍ ÓÏÓÅÄÏÍ.  úÁÝÉÔÁ ÓÉÓÔÅÍÙ ÎÅÏÂÈÏÄÉÍÁ ÄÌÑ ÓÏÈÒÁÎÅÎÉÑ
      ×ÁÛÉÈ ÄÁÎÎÙÈ, ÉÎÔÅÌÌÅËÔÕÁÌØÎÏÊ ÓÏÂÓÔ×ÅÎÎÏÓÔÉ, ×ÒÅÍÅÎÉ É ×ÓÅÇÏ ÏÓÔÁÌØÎÏÇÏ
      ÏÔ ÈÁËÅÒÏ× É ÉÍ ÐÏÄÏÂÎÙÈ.</para>

    <para>&os; ÐÒÅÄÏÓÔÁ×ÌÑÅÔ ÍÁÓÓÕ ÕÔÉÌÉÔ É ÍÅÈÁÎÉÚÍÏ× ÄÌÑ ÏÂÅÓÐÅÞÅÎÉÑ
      ÃÅÌÏÓÔÎÏÓÔÉ É ÂÅÚÏÐÁÓÎÏÓÔÉ ÓÉÓÔÅÍÙ É ÓÅÔÉ.</para>

    <para>ðÏÓÌÅ ÐÒÏÞÔÅÎÉÑ ÜÔÏÊ ÇÌÁ×Ù ×Ù ÕÚÎÁÅÔÅ:</para>

    <itemizedlist>
      <listitem>
	<para>ïÓÎÏ×ÎÙÅ ËÏÎÃÅÐÃÉÉ ÂÅÚÏÐÁÓÎÏÓÔÉ ÓÉÓÔÅÍÙ, ÓÐÅÃÉÆÉËÕ &os;.</para>
      </listitem>

      <listitem>
	<para>ï ÒÁÚÌÉÞÎÙÈ ÍÅÈÁÎÉÚÍÁÈ ÛÉÆÒÏ×ÁÎÉÑ × &os;, ÔÁËÉÈ ËÁË
	  <acronym>DES</acronym> É <acronym>MD5</acronym>.</para>
      </listitem>

      <listitem>
	<para>ëÁË ÎÁÓÔÒÏÉÔØ ÁÕÔÅÎÔÉÆÉËÁÃÉÀ Ó ÉÓÐÏÌØÚÏ×ÁÎÉÅÍ ÏÄÎÏÒÁÚÏ×ÙÈ
	  ÐÁÒÏÌÅÊ.</para>
      </listitem>

      <listitem>
	<para>ëÁË ÎÁÓÔÒÏÉÔØ <acronym>TCP</acronym> Wrappers ÄÌÑ
	  ÉÓÐÏÌØÚÏ×ÁÎÉÑ Ó <command>inetd</command>.</para>
      </listitem>

      <listitem>
	<para>ëÁË ÎÁÓÔÒÏÉÔØ <application>KerberosIV</application> × ÒÅÌÉÚÁÈ
	  &os; ÄÏ 5.0.</para>
      </listitem>

      <listitem>
	<para>ëÁË ÎÁÓÔÒÏÉÔØ <application>Kerberos5</application> × &os;.</para>
      </listitem>

      <listitem>
	<para>ëÁË ÎÁÓÔÒÏÉÔØ IPsec É ÓÏÚÄÁÔØ <acronym>VPN</acronym> ÍÅÖÄÕ
	  ËÏÍÐØÀÔÅÒÁÍÉ ÎÁ &os;/&windows;.</para>
      </listitem>

      <listitem>
	<para>ëÁË ÎÁÓÔÒÏÉÔØ É ÉÓÐÏÌØÚÏ×ÁÔØ <application>OpenSSH</application>,
	  ÒÅÁÌÉÚÁÃÉÀ <acronym>SSH</acronym> × &os;.</para>
      </listitem>

      <listitem>
	<para>þÔÏ ÔÁËÏÅ <acronym>ACL</acronym> É ËÁË ÉÈ ÉÓÐÏÌØÚÏ×ÁÔØ.</para>
      </listitem>

      <listitem>
	<para>ëÁË ÉÓÐÏÌØÚÏ×ÁÔØ ÕÔÉÌÉÔÕ <application>Portaudit</application> ÄÌÑ
	  ÐÒÏ×ÅÒËÉ ÐÁËÅÔÏ× ÓÔÏÒÏÎÎÉÈ ÒÁÚÒÁÂÏÔÞÉËÏ×, ÕÓÔÁÎÏ×ÌÅÎÎÙÈ ÉÚ ëÏÌÌÅËÃÉÉ
	  ðÏÒÔÏ×.</para>
      </listitem>

      <listitem>
	<para>ëÁË ÒÁÂÏÔÁÔØ Ó ÓÏÏÂÝÅÎÉÑÍÉ ÂÅÚÏÐÁÓÎÏÓÔÉ &os;.</para>
      </listitem>

      <listitem>
	<para>þÔÏ ÔÁËÏÅ Process Accounting É ËÁË ÁËÔÉ×ÉÒÏ×ÁÔØ ÅÇÏ ×Ï
	  &os;.</para>
      </listitem>
    </itemizedlist>

    <para>ðÅÒÅÄ ÞÔÅÎÉÅÍ ÜÔÏÊ ÇÌÁ×Ù ×ÁÍ ÐÏÔÒÅÂÕÅÔÓÑ:</para>

    <itemizedlist>
      <listitem>
	<para>ðÏÎÉÍÁÎÉÅ ÏÓÎÏ×ÎÙÈ ËÏÎÃÅÐÃÉÊ &os; É ÉÎÔÅÒÎÅÔ.</para>
      </listitem>
    </itemizedlist>

    <para>÷ ÜÔÏÊ ËÎÉÇÅ ÒÁÓÓÍÏÔÒÅÎÙ É ÄÒÕÇÉÅ ×ÏÐÒÏÓÙ ÂÅÚÏÐÁÓÎÏÓÔÉ.
      îÁÐÒÉÍÅÒ, ÐÒÉÎÕÄÉÔÅÌØÎÙÊ ËÏÎÔÒÏÌØ ÄÏÓÔÕÐÁ (Mandatory Access
      Control) ÒÁÓÓÍÁÔÒÉ×ÁÅÔÓÑ × <xref
      linkend="mac">, Á ÂÒÁÎÄÍÁÕÜÒÙ × <xref
      linkend="firewalls">.</para>

  </sect1>

  <sect1 id="security-intro">
    <title>÷×ÅÄÅÎÉÅ</title>

    <para>âÅÚÏÐÁÓÎÏÓÔØ ÜÔÏ ÐÅÒ×ÁÑ É ÏÓÎÏ×ÎÁÑ ÆÕÎËÃÉÑ ÓÉÓÔÅÍÎÏÇÏ
      ÁÄÍÉÎÉÓÔÒÁÔÏÒÁ.  èÏÔÑ ×ÓÅ ÍÎÏÇÏÐÏÌØÚÏ×ÁÔÅÌØÓËÉÅ ÓÉÓÔÅÍÙ BSD &unix;
      ÕÖÅ ÓÎÁÂÖÅÎÙ ÎÅËÏÔÏÒÏÊ ÚÁÝÉÔÏÊ, ÒÁÂÏÔÁ ÐÏ ÓÏÚÄÁÎÉÀ É ÐÏÄÄÅÒÖËÅ
      ÄÏÐÏÌÎÉÔÅÌØÎÙÈ ÍÅÈÁÎÉÚÍÏ× ÂÅÚÏÐÁÓÎÏÓÔÉ, ÏÂÅÓÐÅÞÉ×ÁÀÝÉÈ ÚÁÝÉÝÅÎÎÕÀ ÒÁÂÏÔÕ
      ÐÏÌØÚÏ×ÁÔÅÌÅÊ, ÜÔÏ ÏÄÎÁ ÉÚ ÓÁÍÙÈ ÓÅÒØÅÚÎÙÈ ÚÁÄÁÞ ÓÉÓÔÅÍÎÏÇÏ
      ÁÄÍÉÎÉÓÔÒÁÔÏÒÁ.  ëÏÍÐØÀÔÅÒÙ ÂÅÚÏÐÁÓÎÙ ÎÁÓÔÏÌØËÏ, ÎÁÓËÏÌØËÏ ×Ù ÓÄÅÌÁÅÔÅ
      ÉÈ ÂÅÚÏÐÁÓÎÙÍÉ É ÔÒÅÂÏ×ÁÎÉÑ ÂÅÚÏÐÁÓÎÏÓÔÉ ×ÓÅÇÄÁ ÎÁÈÏÄÑÔÓÑ × ÐÒÏÔÉ×ÏÒÅÞÉÉ
      Ó ÕÄÏÂÓÔ×ÏÍ ÒÁÂÏÔÙ ÐÏÌØÚÏ×ÁÔÅÌÅÊ.  óÉÓÔÅÍÙ &unix; ÓÐÏÓÏÂÎÙ ÏÄÎÏ×ÒÅÍÅÎÎÏ
      ÒÁÂÏÔÁÔØ Ó ÏÇÒÏÍÎÙÍ ËÏÌÉÞÅÓÔ×ÏÍ ÐÒÏÃÅÓÓÏ× É ÍÎÏÇÉÅ ÉÚ ÜÔÉÈ ÐÒÏÃÅÓÓÏ×
      ÓÅÒ×ÅÒÎÙÅ &mdash; ÜÔÏ ÏÚÎÁÞÁÅÔ, ÞÔÏ Ó ÎÉÍÉ ÍÏÇÕÔ ×ÚÁÉÍÏÄÅÊÓÔ×Ï×ÁÔØ
      ×ÎÅÛÎÉÅ ÐÒÏÇÒÁÍÍÙ.  óÅÇÏÄÎÑ ÄÅÓËÔÏÐÙ ÚÁÍÅÎÉÌÉ ÍÉÎÉ-ËÏÍÐØÀÔÅÒÙ É
      ÍÜÊÎÆÒÜÊÍÙ, É ÐÏÓËÏÌØËÕ ËÏÍÐØÀÔÅÒÙ × ÎÁÛÉ ÄÎÉ ÐÏÄËÌÀÞÅÎÙ Ë ÓÅÔÉ
      ÉÎÔÅÒÎÅÔ, ÂÅÚÏÐÁÓÎÏÓÔØ ×ÁÖÎÁ ËÁË ÎÉËÏÇÄÁ.</para>

    <para>îÁÉÌÕÞÛÁÑ ÒÅÁÌÉÚÁÃÉÑ ÓÉÓÔÅÍÙ ÂÅÚÏÐÁÓÎÏÓÔÉ ÐÒÅÄÓÔÁ×ÉÍÁ × ×ÉÄÅ
      <quote>ÐÏÓÌÏÊÎÏÊ</quote> ÓÉÓÔÅÍÙ.  ÷ÏÏÂÝÅ ÇÏ×ÏÒÑ ×ÓÅ, ÞÔÏ ÎÕÖÎÏ ÓÄÅÌÁÔØ,
      ÜÔÏ ÓÏÚÄÁÔØ ÓÔÏÌØËÏ ÓÌÏÅ× ÂÅÚÏÐÁÓÎÏÓÔÉ, ÓËÏÌØËÏ ÎÅÏÂÈÏÄÉÍÏ É ÚÁÔÅÍ
      ×ÎÉÍÁÔÅÌØÎÏ ÓÌÅÄÉÔØ ÚÁ ×ÔÏÒÖÅÎÉÑÍÉ × ÓÉÓÔÅÍÕ.  îÅ ÐÅÒÅÕÓÅÒÄÓÔ×ÕÊÔÅ ×
      ÎÁÓÔÒÏÊËÅ ÓÉÓÔÅÍÙ ÂÅÚÏÐÁÓÎÏÓÔÉ, ÉÎÁÞÅ ÏÎÁ ÓÄÅÌÁÅÔ ÎÅ×ÏÚÍÏÖÎÏÊ
      ÏÂÎÁÒÕÖÅÎÉÅ ×ÔÏÒÖÅÎÉÊ, Ñ×ÌÑÀÝÅÅÓÑ ÏÄÎÉÍ ÉÚ ÎÁÉÂÏÌÅÅ ×ÁÖÎÙÈ ÁÓÐÅËÔÏ×
      ÍÅÈÁÎÉÚÍÁ ÂÅÚÏÐÁÓÎÏÓÔÉ.  îÁÐÒÉÍÅÒ, ÎÅÔ ÂÏÌØÛÏÇÏ ÓÍÙÓÌÁ × ÕÓÔÁÎÏ×ËÅ
      ÆÌÁÇÁ <literal>schg</literal> (&man.chflags.1;) ÎÁ ËÁÖÄÙÊ ÉÓÐÏÌÎÑÅÍÙÊ
      ÆÁÊÌ ÓÉÓÔÅÍÙ, ÐÏÓËÏÌØËÕ ÈÏÔÑ ÔÁËÉÍ ÓÐÏÓÏÂÏÍ ÍÏÖÎÏ ×ÒÅÍÅÎÎÏ ÚÁÝÉÔÉÔØ
      ÉÓÐÏÌÎÑÅÍÙÅ ÆÁÊÌÙ, ÜÔÏ ÐÏÍÅÛÁÅÔ ÏÂÎÁÒÕÖÅÎÉÀ ÆÁËÔÁ ×ÚÌÏÍÁ
      ÓÉÓÔÅÍÙ.</para>

    <para>âÅÚÏÐÁÓÎÏÓÔØ ÓÉÓÔÅÍÙ ÔÁËÖÅ ÏÔÎÏÓÉÔÓÑ Ë ÒÁÚÌÉÞÎÙÍ ÆÏÒÍÁÍ ÁÔÁË,
      ÉÍÅÀÝÉÈ Ó×ÏÅÊ ÃÅÌØÀ ×ÙÚ×ÁÔØ ËÒÁÈ ÓÉÓÔÅÍÙ, ÉÌÉ ÓÄÅÌÁÔØ ÓÉÓÔÅÍÕ
      ÎÅÄÏÓÔÕÐÎÏÊ ÄÒÕÇÉÍ ÓÐÏÓÏÂÏÍ, ÎÏ ÎÅ ÐÙÔÁÀÝÉÈÓÑ ÐÏÌÕÞÉÔØ ÄÏÓÔÕÐ Ë ÕÞ£ÔÎÏÊ
      ÚÁÐÉÓÉ <username>root</username> (<quote>break root</quote>).
      õÇÒÏÚÙ ÂÅÚÏÐÁÓÎÏÓÔÉ ÍÏÇÕÔ ÂÙÔØ ÐÏÄÅÌÅÎÙ ÎÁ ÎÅÓËÏÌØËÏ ËÁÔÅÇÏÒÉÊ:</para>

    <orderedlist>
      <listitem>
	<para>ïÔËÁÚ × ÏÂÓÌÕÖÉ×ÁÎÉÉ (Denial of service, DoS).</para>
      </listitem>

      <listitem>
	<para>÷ÚÌÏÍ ÐÏÌØÚÏ×ÁÔÅÌØÓËÉÈ ÕÞ£ÔÎÙÈ ÚÁÐÉÓÅÊ.</para>
      </listitem>

      <listitem>
	<para>÷ÚÌÏÍ ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ root ÞÅÒÅÚ ÄÏÓÔÕÐÎÙÅ ÓÅÒ×ÉÓÙ.</para>
      </listitem>

      <listitem>
	<para>÷ÚÌÏÍ ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ root ÞÅÒÅÚ ÕÞ£ÔÎÙÅ ÚÁÐÉÓÉ
	  ÐÏÌØÚÏ×ÁÔÅÌÅÊ.</para>
      </listitem>

      <listitem>
	<para>óÏÚÄÁÎÉÅ backdoor.</para>
      </listitem>
    </orderedlist>

    <indexterm>
      <primary>DoS ÁÔÁËÉ</primary>
      <see>ÏÔËÁÚ × ÏÂÓÌÕÖÉ×ÁÎÉÉ (Denial of Service, DoS)</see>
    </indexterm>
    <indexterm>
      <primary>ÂÅÚÏÐÁÓÎÏÓÔØ</primary>
      <secondary>DoS ÁÔÁËÉ</secondary>
      <see>ÏÔËÁÚ × ÏÂÓÌÕÖÉ×ÁÎÉÉ (Denial of Service, DoS)</see>
    </indexterm>
    <indexterm><primary>ïÔËÁÚ × ÏÂÓÌÕÖÉ×ÁÎÉÉ (Denial of Service, DoS)</primary></indexterm>

    <para>áÔÁËÁ <quote>ÏÔËÁÚ × ÏÂÓÌÕÖÉ×ÁÎÉÉ</quote> ÏÔÂÉÒÁÅÔ Õ ÍÁÛÉÎÙ
      ÎÅÏÂÈÏÄÉÍÙÅ ÒÅÓÕÒÓÙ.  ïÂÙÞÎÏ DoS ÁÔÁËÉ ÉÓÐÏÌØÚÕÀÔ ÇÒÕÂÕÀ ÓÉÌÕ, ÞÔÏÂÙ
      ÐÏÐÙÔÁÔØÓÑ ÏÂÒÕÛÉÔØ ÓÉÓÔÅÍÕ ÉÌÉ ÓÄÅÌÁÔØ ÅÅ ÎÅÄÏÓÔÕÐÎÏÊ ÄÒÕÇÉÍ ÓÐÏÓÏÂÏÍ,
      ÐÒÅ×ÙÓÉ× ÌÉÍÉÔÙ ÅÅ ÓÅÒ×ÉÓÏ× ÉÌÉ ÓÅÔÅ×ÏÇÏ ÓÔÅËÁ.  îÅËÏÔÏÒÙÅ DoS ÁÔÁËÉ
      ÐÙÔÁÀÔÓÑ ÉÓÐÏÌØÚÏ×ÁÔØ ÏÛÉÂËÉ × ÓÅÔÅ×ÏÍ ÓÔÅËÅ ÄÌÑ ÏÂÒÕÛÅÎÉÑ ÓÉÓÔÅÍÙ ÏÄÎÉÍ
      ÐÁËÅÔÏÍ.  üÔÕ ÐÒÏÂÌÅÍÕ ÍÏÖÎÏ ÒÅÛÉÔØ ÔÏÌØËÏ ÉÓÐÒÁ×É× ÑÄÒÏ ÓÉÓÔÅÍÙ.  áÔÁËÉ
      ÚÁÞÁÓÔÕÀ ÍÏÖÎÏ ÐÒÅÄÏÔ×ÒÁÔÉÔØ ÐÒÁ×ÉÌØÎÏÊ ÕÓÔÁÎÏ×ËÏÊ ÐÁÒÁÍÅÔÒÏ×,
      ÏÇÒÁÎÉÞÉ×ÁÀÝÉÈ ÎÁÇÒÕÚËÕ ÎÁ ÓÉÓÔÅÍÕ × ÎÅÂÌÁÇÏÐÒÉÑÔÎÙÈ ÕÓÌÏ×ÉÑÈ. ó
      ÁÔÁËÁÍÉ, ÉÓÐÏÌØÚÕÀÝÉÍÉ ÇÒÕÂÕÀ ÓÉÌÕ, ÂÏÒÏÔØÓÑ ÓÌÏÖÎÏ.  îÁÐÒÉÍÅÒ, ÁÔÁËÁ Ó
      ÉÓÐÏÌØÚÏ×ÁÎÉÅÍ ÐÁËÅÔÏ× Ó ÐÏÄÄÅÌØÎÙÍÉ ÁÄÒÅÓÁÍÉ, ËÏÔÏÒÕÀ ÐÏÞÔÉ ÎÅ×ÏÚÍÏÖÎÏ
      ÏÓÔÁÎÏ×ÉÔØ, ÍÏÖÅÔ ÂÙÓÔÒÏ ÏÔËÌÀÞÉÔØ ×ÁÛÕ ÓÉÓÔÅÍÕ ÏÔ ÉÎÔÅÒÎÅÔ.  ÷ÏÚÍÏÖÎÏ,
      ÏÎÁ ÎÅ ÐÒÉ×ÅÄÅÔ Ë ÏÔËÁÚÕ ÓÉÓÔÅÍÙ, ÎÏ ÓÍÏÖÅÔ ÐÅÒÅÐÏÌÎÉÔØ ÓÏÅÄÉÎÅÎÉÅ Ó
      ÉÎÔÅÒÎÅÔ.</para>

    <indexterm>
      <primary>ÂÅÚÏÐÁÓÎÏÓÔØ</primary>
      <secondary>×ÚÌÏÍ ÕÞ£ÔÎÙÈ ÚÁÐÉÓÅÊ</secondary>
    </indexterm>

    <para>÷ÚÌÏÍ ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ ÐÏÌØÚÏ×ÁÔÅÌÑ ÏÂÙÞÎÏ ×ÓÔÒÅÞÁÅÔÓÑ ÞÁÝÅ, ÞÅÍ DoS
      ÁÔÁËÉ.  íÎÏÇÉÅ ÓÉÓÔÅÍÎÙÅ ÁÄÍÉÎÉÓÔÒÁÔÏÒÙ ×ÓÅ ÅÝÅ ÉÓÐÏÌØÚÕÀÔ ÓÔÁÎÄÁÒÔÎÙÅ
      ÓÅÒ×ÉÓÙ <application>telnetd</application>,
      <application>rlogind</application> É <application>ftpd</application> ÎÁ
      Ó×ÏÉÈ ÓÅÒ×ÅÒÁÈ.  üÔÉ ÓÅÒ×ÉÓÙ ÐÏ ÕÍÏÌÞÁÎÉÀ ÎÅ ÒÁÂÏÔÁÀÔ Ó ÚÁÛÉÆÒÏ×ÁÎÎÙÍÉ
      ÓÏÅÄÉÎÅÎÉÑÍ.  ÷ ÒÅÚÕÌØÔÁÔÅ ÐÒÉ ÓÒÅÄÎÅÍ ËÏÌÉÞÅÓÔ×Å ÐÏÌØÚÏ×ÁÔÅÌÅÊ ÐÁÒÏÌØ
      ÏÄÎÏÇÏ ÉÌÉ ÎÅÓËÏÌØËÉÈ ÐÏÌØÚÏ×ÁÔÅÌÅÊ, ×ÈÏÄÑÝÉÈ × ÓÉÓÔÅÍÕ ÞÅÒÅÚ ×ÎÅÛÎÅÅ
      ÓÏÅÄÉÎÅÎÉÅ (ÜÔÏ ÏÂÙÞÎÙÊ É ÎÁÉÂÏÌÅÅ ÕÄÏÂÎÙÊ ÓÐÏÓÏ ×ÈÏÄÁ × ÓÉÓÔÅÍÕ),
      ÂÕÄÅÔ ÐÅÒÅÈ×ÁÞÅÎ.  ÷ÎÉÍÁÔÅÌØÎÙÊ ÓÉÓÔÅÍÎÙÊ ÁÄÍÉÎÉÓÔÒÁÔÏÒ ÄÏÌÖÅÎ
      ÁÎÁÌÉÚÉÒÏ×ÁÔØ ÌÏÇÉ ÕÄÁÌÅÎÎÏÇÏ ÄÏÓÔÕÐÁ ÎÁ ÐÒÅÄÍÅÔ ÐÏÄÏÚÒÉÔÅÌØÎÙÈ ÁÄÒÅÓÏ×
      ÐÏÌØÚÏ×ÁÔÅÌÅÊ ÄÁÖÅ × ÓÌÕÞÁÅ ÕÓÐÅÛÎÏÇÏ ×ÈÏÄÁ.</para>

    <para>ëÔÏ-ÔÏ ÍÏÖÅÔ ÐÒÅÄÐÏÌÏÖÉÔØ, ÞÔÏ ÁÔÁËÕÀÝÉÊ ÐÒÉ ÎÁÌÉÞÉÉ ÄÏÓÔÕÐÁ Ë
      ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ ÐÏÌØÚÏ×ÁÔÅÌÑ ÍÏÖÅÔ ×ÚÌÏÍÁÔØ ÕÞ£ÔÎÕÀ ÚÁÐÉÓØ
      <username>root</username>.  ïÄÎÁËÏ, ÒÅÁÌØÎÏÓÔØ ÔÁËÏ×Á, ÞÔÏ × ÈÏÒÏÛÏ
      ÚÁÝÉÝÅÎÎÏÊ É ÐÏÄÄÅÒÖÉ×ÁÅÍÏÊ ÓÉÓÔÅÍÅ ÄÏÓÔÕÐ Ë ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ ÐÏÌØÚÏ×ÁÔÅÌÑ
      ÎÅ ÏÂÑÚÁÔÅÌØÎÏ ÄÁÓÔ ÁÔÁËÕÀÝÅÍÕ ÄÏÓÔÕÐ Ë <username>root</username>.
      òÁÚÎÉÃÁ ÍÅÖÄÕ ÄÏÓÔÕÐÏÍ Ë ÏÂÙÞÎÏÊ ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ É Ë
      <username>root</username> ×ÁÖÎÁ, ÐÏÓËÏÌØËÕ ÂÅÚ ÄÏÓÔÕÐÁ Ë
      <username>root</username> ÁÔÁËÕÀÝÉÊ ÏÂÙÞÎÏ ÎÅ ÓÐÏÓÏÂÅÎ ÓËÒÙÔØ Ó×ÏÉ
      ÄÅÊÓÔ×ÉÑ, É × ÈÕÄÛÅÍ ÓÌÕÞÁÅ ÓÍÏÖÅÔ ÌÉÛØ ÉÓÐÏÒÔÉÔØ ÆÁÊÌÙ ÐÏÌØÚÏ×ÁÔÅÌÑ ÉÌÉ
      ×ÙÚ×ÁÔØ ËÒÁÈ ÓÉÓÔÅÍÙ.  ÷ÚÌÏÍ ÐÏÌØÚÏ×ÁÔÅÌØÓËÉÈ ÕÞ£ÔÎÙÈ ÚÁÐÉÓÅÊ
      ×ÓÔÒÅÞÁÅÔÓÑ ÏÞÅÎØ ÞÁÓÔÏ, ÐÏÓËÏÌØËÕ ÐÏÌØÚÏ×ÁÔÅÌÉ ÚÁÂÏÔÑÔÓÑ Ï ÂÅÚÏÐÁÓÎÏÓÔÉ
      ÔÁË, ËÁË ÓÉÓÔÅÍÎÙÅ ÁÄÍÉÎÉÓÔÒÁÔÏÒÙ.</para>

    <indexterm>
      <primary>ÂÅÚÏÐÁÓÎÏÓÔØ</primary>
      <secondary>backdoors</secondary>
    </indexterm>

    <para>óÉÓÔÅÍÎÙÅ ÁÄÍÉÎÉÓÔÒÁÔÏÒÙ ÄÏÌÖÎÙ ÐÏÍÎÉÔØ, ÞÔÏ ÓÕÝÅÓÔ×ÕÅÔ ÍÎÏÖÅÓÔ×Ï
      ÐÏÔÅÎÃÉÁÌØÎÙÈ ÓÐÏÓÏÂÏ× ×ÚÌÏÍÁ ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ <username>root</username>.
      áÔÁËÕÀÝÉÊ ÍÏÖÅÔ ÕÚÎÁÔØ ÐÁÒÏÌØ <username>root</username>, ÎÁÊÔÉ ÏÛÉÂËÕ ×
      ÓÅÒ×ÉÓÅ, ÒÁÂÏÔÁÀÝÅÍ Ó ÐÒÉ×ÉÌÅÇÉÑÍÉ É ×ÚÌÏÍÁÔØ ÕÞ£ÔÎÕÀ ÚÁÐÉÓØ
      <username>root</username> ÞÅÒÅÚ ÓÅÔÅ×ÏÅ ÓÏÅÄÉÎÅÎÉÅ Ó ÜÔÉÍ ÓÅÒ×ÉÓÏÍ, ÉÌÉ
      ÕÚÎÁÔØ Ï ÏÛÉÂËÅ × suid-root ÐÒÏÇÒÁÍÍÅ, ÐÏÚ×ÏÌÑÀÝÅÊ ÁÔÁËÕÀÝÅÍÕ ×ÚÌÏÍ
      <username>root</username> Ó ÐÏÍÏÝØÀ ×ÚÌÏÍÁÎÎÏÊ ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ
      ÐÏÌØÚÏ×ÁÔÅÌÑ.  åÓÌÉ ÁÔÁËÕÀÝÉÊ ÎÁÛÅÌ ÓÐÏÓÏ ×ÚÌÏÍÁ
      <username>root</username>, ÅÍÕ ÍÏÖÅÔ ÎÅ ÐÏÎÁÄÏÂÉÔØÓÑ ÕÓÔÁÎÏ×ËÁ backdoor.
      íÎÏÇÉÅ ÉÚ ÏÂÎÁÒÕÖÅÎÎÙÈ É ÚÁËÒÙÔÙÈ ÎÁ ÓÅÇÏÄÎÑÛÎÉÊ ÄÅÎØ ÂÒÅÛÅÊ
      × ÓÉÓÔÅÍÅ, ÐÏÚ×ÏÌÑÀÝÉÅ ×ÚÌÏÍ <username>root</username>, ÔÒÅÂÕÀÔ ÏÔ
      ÁÔÁËÕÀÝÅÇÏ ÓÅÒØÅÚÎÏÊ ÒÁÂÏÔÙ ÐÏ ÚÁÍÅÔÁÎÉÀ ÓÌÅÄÏ×, ÐÏÜÔÏÍÕ ÂÏÌØÛÉÎÓÔ×Ï
      ÁÔÁËÕÀÝÉÈ ÕÓÔÁÎÁ×ÌÉ×ÁÀÔ backdoor.  Backdoor ÐÒÅÄÏÓÔÁ×ÌÑÅÔ ÁÔÁËÕÀÝÅÍÕ
      ÐÒÏÓÔÏÊ ÓÐÏÓÏ ×ÏÓÓÔÁÎÏ×ÌÅÎÉÑ ÄÏÓÔÕÐÁ Ë ÓÉÓÔÅÍÅ Ó ÐÒÉ×ÉÌÅÇÉÑÍÉ
      <username>root</username>, ÎÏ ÔÁËÖÅ ÄÁÅÔ ÓÉÓÔÅÍÎÏÍÕ ÁÄÍÉÎÉÓÔÒÁÔÏÒÕ
      ÕÄÏÂÎÙÊ ÓÐÏÓÏ ÏÂÎÁÒÕÖÅÎÉÑ ×ÔÏÒÖÅÎÉÑ.  õÓÔÒÁÎÅÎÉÅ ×ÏÚÍÏÖÎÏÓÔÉ ÕÓÔÁÎÏ×ËÉ
      backdoor ×ÏÚÍÏÖÎÏ ÐÏ×ÒÅÄÉÔ ÂÅÚÏÐÁÓÎÏÓÔÉ ÓÉÓÔÅÍÙ, ÐÏÓËÏÌØËÕ ÜÔÏ
      ÎÅ ÕÓÔÒÁÎÉÔ ÂÒÅÛØ, ÐÏÚ×ÏÌÉ×ÛÕÀ ÐÒÏÎÉËÎÕÔØ ×
      ÓÉÓÔÅÍÕ.</para>

    <para>íÅÒÙ ÂÅÚÏÐÁÓÎÏÓÔÉ ×ÓÅÇÄÁ ÄÏÌÖÎÙ ÒÅÁÌÉÚÏ×Ù×ÁÔØÓÑ ÎÁ ÎÅÓËÏÌØËÉÈ
      ÕÒÏ×ÎÑÈ, ËÏÔÏÒÙÅ ÍÏÇÕÔ ÂÙÔØ ËÌÁÓÓÉÆÉÃÉÒÏ×ÁÎÙ ÓÌÅÄÕÀÝÉÍ ÏÂÒÁÚÏÍ:</para>

    <orderedlist>
      <listitem>
	<para>úÁÝÉÔÁ <username>root</username> É ÓÌÕÖÅÂÎÙÈ ÕÞ£ÔÎÙÈ
	  ÚÁÐÉÓÅÊ.</para>
      </listitem>

      <listitem>
	<para>úÁÝÉÔÁ ÒÁÂÏÔÁÀÝÉÈ ÐÏÄ <username>root</username>
	  ÓÅÒ×ÉÓÏ× É suid/sgid ÉÓÐÏÌÎÑÅÍÙÈ ÆÁÊÌÏ×.</para>
      </listitem>

      <listitem>
	<para>úÁÝÉÔÁ ÕÞ£ÔÎÙÈ ÚÁÐÉÓÅÊ ÐÏÌØÚÏ×ÁÔÅÌÅÊ.</para>
      </listitem>

      <listitem>
	<para>úÁÝÉÔÁ ÆÁÊÌÁ ÐÁÒÏÌÅÊ.</para>
      </listitem>

      <listitem>
	<para>úÁÝÉÔÁ ÑÄÒÁ, raw ÕÓÔÒÏÊÓÔ× É ÆÁÊÌÏ×ÙÈ
	  ÓÉÓÔÅÍ.</para>
      </listitem>

      <listitem>
	<para>âÙÓÔÒÏÅ ÏÂÎÁÒÕÖÅÎÉÅ ÎÅÓÁÎËÃÉÏÎÉÒÏ×ÁÎÎÙÈ ÉÚÍÅÎÅÎÉÊ ×
	  ÓÉÓÔÅÍÅ.</para>
      </listitem>

      <listitem>
	<para>ðÁÒÁÎÏÊÑ.</para>
      </listitem>
    </orderedlist>

    <para>÷ ÓÌÅÄÕÀÝÅÍ ÒÁÚÄÅÌÅ ÜÔÏÊ ÇÌÁ×Ù ÜÔÉ ÔÅÍÙ ÉÚÌÏÖÅÎÙ ÂÏÌÅÅ
      ÐÏÄÒÏÂÎÏ.</para>
  </sect1>

  <sect1 id="securing-freebsd">
    <title>úÁÝÉÔÁ &os;</title>
    <indexterm>
      <primary>ÂÅÚÏÐÁÓÎÏÓÔØ</primary>
      <secondary>ÚÁÝÉÔÁ &os;</secondary>
    </indexterm>

    <note>
      <title>ëÏÍÁÎÄÁ É ÐÒÏÔÏËÏÌ</title>
      <para>÷ ÜÔÏÍ ÄÏËÕÍÅÎÔÅ ÍÙ ÂÕÄÅÔ ÉÓÐÏÌØÚÏ×ÁÔØ
	<application>×ÙÄÅÌÅÎÎÙÊ</application> ÔÅËÓÔ, ÕÐÏÍÉÎÁÑ ÐÒÉÌÏÖÅÎÉÅ,
	É <command>ÍÏÎÏÛÉÒÉÎÎÙÊ</command> ÛÒÉÆÔ, ÕÐÏÍÉÎÁÑ ÏÐÒÅÄÅÌÅÎÎÙÅ
	ËÏÍÁÎÄÙ.  äÌÑ ÐÒÏÔÏËÏÌÏ× ÉÓÐÏÌØÚÕÅÔÓÑ ÏÂÙÞÎÙÊ ÛÒÉÆÔ.  üÔÏ
	ÔÉÐÏÇÒÁÆÉÞÅÓËÏÅ ÏÔÌÉÞÉÅ ÐÏÌÅÚÎÏ ÄÌÑ ÔÁËÉÈ ÓÌÕÞÁÅ×, ËÁË ssh, ÐÏÓËÏÌØËÕ
	ÜÔÏ É ËÏÍÁÎÄÁ É ÐÒÏÔÏËÏÌ.</para>
    </note>

    <para>÷ ÐÏÓÌÅÄÕÀÝÅÍ ÒÁÚÄÅÌÅ ÂÕÄÕÔ ÒÁÓÓÍÏÔÒÅÎÙ ÍÅÔÏÄÙ ÚÁÝÉÔÙ ÓÉÓÔÅÍÙ
      &os;, ÕÐÏÍÑÎÕÔÙÅ × <link
	linkend="security-intro">ÐÒÅÄÙÄÕÝÅÍ ÒÁÚÄÅÌÅ</link> ÜÔÏÊ ÇÌÁ×Ù.</para>

    <sect2 id="securing-root-and-staff">
      <title>úÁÝÉÔÁ ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ <username>root</username> É ÓÌÕÖÅÂÎÙÈ
	ÕÞ£ÔÎÙÈ ÚÁÐÉÓÅÊ</title>
      <indexterm>
	<primary><command>su</command></primary>
      </indexterm>

      <para>÷Ï-ÐÅÒ×ÙÈ, ÎÅ ÂÅÓÐÏËÏÊÔÅÓØ Ï ÚÁÝÉÔÅ ÓÌÕÖÅÂÎÙÈ ÕÞ£ÔÎÙÈ ÚÁÐÉÓÅÊ,
	ÅÓÌÉ ÎÅ ÚÁÝÉÝÅÎÁ ÕÞ£ÔÎÁÑ ÚÁÐÉÓØ <username>root</username>.  ÷
	ÂÏÌØÛÉÎÓÔ×Å ÓÉÓÔÅÍ Õ ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ <username>root</username> ÅÓÔØ
	ÐÁÒÏÌØ.  éÓÐÏÌØÚÏ×ÁÎÉÅ ÐÁÒÏÌÑ <username>root</username>
	ÏÐÁÓÎÏ <emphasis>×ÓÅÇÄÁ</emphasis>.  üÔÏ ÎÅ ÏÚÎÁÞÁÅÔ, ÞÔÏ ×Ù ÄÏÌÖÎÙ
	ÕÄÁÌÉÔØ ÐÁÒÏÌØ.  ðÁÒÏÌØ ÐÏÞÔÉ ×ÓÅÇÄÁ ÎÅÏÂÈÏÄÉÍ ÄÌÑ ÄÏÓÔÕÐÁ
	ÐÏ ËÏÎÓÏÌÉ.  îÏ ÜÔÏ ÏÚÎÁÞÁÅÔ, ÞÔÏ ×Ù ÄÏÌÖÎÙ ÓÄÅÌÁÔØ ÎÅ×ÏÚÍÏÖÎÙÍ
	ÉÓÐÏÌØÚÏ×ÁÎÉÅ ÐÁÒÏÌÑ ÎÅ ÉÚ ËÏÎÓÏÌÉ ÉÌÉ ÍÏÖÅÔ ÂÙÔØ ÄÁÖÅ Ó ÐÏÍÏÝØÀ
	ËÏÍÁÎÄÙ &man.su.1;.  îÁÐÒÉÍÅÒ, ÕÂÅÄÉÔÅÓØ, ÞÔÏ ÐÓÅ×ÄÏ-ÔÅÒÍÉÎÁÌÙ
	× ÆÁÊÌÅ <filename>/etc/ttys</filename> ÐÅÒÅÞÉÓÌÅÎÙ Ó ÐÁÒÁÍÅÔÒÏÍ
	<literal>insecure</literal>, ÞÔÏ ÄÅÌÁÅÔ ÎÅ×ÏÚÍÏÖÎÙÍ ×ÈÏÄ ÎÁ ÎÉÈ
	ÐÏÄ <username>root</username> ÎÁÐÒÑÍÕÀ Ó ÐÏÍÏÝØÀ
	<command>telnet</command> ÉÌÉ <command>rlogin</command>.  ðÒÉ
	ÉÓÐÏÌØÚÏ×ÁÎÉÉ ÄÒÕÇÉÈ ÓÒÅÄÓÔ× ×ÈÏÄÁ, ÔÁËÉÈ ËÁË
	<application>sshd</application>, ÕÂÅÄÉÔÅÓØ ÞÔÏ ×ÈÏÄ ÐÏÄ
	<username>root</username> ÎÁÐÒÑÍÕÀ ÏÔËÌÀÞÅÎ É × ÎÉÈ.  óÄÅÌÁÊÔÅ
	ÜÔÏ, ÏÔËÒÙ× ÆÁÊÌ <filename>/etc/ssh/sshd_config</filename>, É
	ÕÂÅÄÉ×ÛÉÓØ, ÞÔÏ ÐÁÒÁÍÅÔÒ <literal>PermitRootLogin</literal>
	ÕÓÔÁÎÏ×ÌÅÎ × <literal>NO</literal>.  ðÒÏ×ÅÒØÔÅ ËÁÖÄÙÊ ÍÅÔÏÄ ÄÏÓÔÕÐÁ
	&mdash; ÓÅÒ×ÉÓ FTP É ÅÍÕ ÐÏÄÏÂÎÙÅ ÞÁÓÔÏ ÐÏÄ×ÅÒÖÅÎÙ ×ÚÌÏÍÕ.  ðÒÑÍÏÊ
	×ÈÏÄ ÐÏÄ <username>root</username> ÄÏÌÖÅÎ ÂÙÔØ ÒÁÚÒÅÛÅÎ ÔÏÌØËÏ Ó
	ÓÉÓÔÅÍÎÏÊ ËÏÎÓÏÌÉ.</para>
      <indexterm>
	<primary><groupname>wheel</groupname></primary>
      </indexterm>

      <para>ëÏÎÅÞÎÏ, ËÁË ÓÉÓÔÅÍÎÙÊ ÁÄÍÉÎÉÓÔÒÁÔÏÒ ×Ù ÄÏÌÖÎÙ ÉÍÅÔØ ÄÏÓÔÕÐ
	<username>root</username>, ÐÏÜÔÏÍÕ ÐÏÔÒÅÂÕÅÔÓÑ ÏÔËÒÙÔØ ÎÅÓËÏÌØËÏ
	<quote>ÌÁÚÅÅË</quote>.  îÏ ÕÂÅÄÉÔÅÓØ, ÞÔÏ ÄÌÑ ÄÏÓÔÕÐÁ Ë ÎÉÍ ÎÅÏÂÈÏÄÉÍ
	ÄÏÐÏÌÎÉÔÅÌØÎÙÊ ÐÁÒÏÌØ.  ïÄÎÉÍ ÉÚ ÓÐÏÓÏÂÏ× ÄÏÓÔÕÐÁ Ë
	<username>root</username> Ñ×ÌÑÅÔÓÑ ÄÏÂÁ×ÌÅÎÉÅ ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÉÈ ÕÞ£ÔÎÙÈ
	ÚÁÐÉÓÅÊ Ë ÇÒÕÐÐÅ <groupname>wheel</groupname> (× ÆÁÊÌÅ
	<filename>/etc/group</filename>).  üÔÏ ÐÏÚ×ÏÌÑÅÔ ÉÓÐÏÌØÚÏ×ÁÔØ
	<command>su</command> ÄÌÑ ÄÏÓÔÕÐÁ Ë <username>root</username>.
	÷Ù ÎÉËÏÇÄÁ ÎÅ ÄÏÌÖÎÙ ÄÁ×ÁÔØ ÔÁËÉÍ ÕÞ£ÔÎÙÍ ÚÁÐÉÓÑÍ ÄÏÓÔÕÐ
	Ë <groupname>wheel</groupname> ÎÅÐÏÓÒÅÄÓÔ×ÅÎÎÏ, ÐÏÍÅÝÁÑ ÉÈ × ÇÒÕÐÐÕ
	<groupname>wheel</groupname> × ÆÁÊÌÅ ÐÁÒÏÌÅÊ.  óÌÕÖÅÂÎÙÅ ÕÞ£ÔÎÙÅ
	ÚÁÐÉÓÉ ÄÏÌÖÎÙ ÐÏÍÅÝÁÔØÓÑ × ÇÒÕÐÐÕ <groupname>staff</groupname>,
	Á ÚÁÔÅÍ ÄÏÂÁ×ÌÑÔØÓÑ Ë ÇÒÕÐÐÅ <groupname>wheel</groupname> × ÆÁÊÌÅ
	<filename>/etc/group</filename>.  ôÏÌØËÏ ÔÅ ÞÌÅÎÙ ÇÒÕÐÐÙ staff,
	ËÏÔÏÒÙÍ ÄÅÊÓÔ×ÉÔÅÌØÎÏ ÎÕÖÅÎ ÄÏÓÔÕÐ Ë <username>root</username>,
	ÄÏÌÖÎÙ ÂÙÔØ ÐÏÍÅÝÅÎÙ × ÇÒÕÐÐÕ <groupname>wheel</groupname>.
	ðÒÉ ÒÁÂÏÔÅ Ó ÔÁËÉÍÉ ÍÅÔÏÄÁÍÉ ÁÕÔÅÎÔÉÆÉËÁÃÉÉ ËÁË Kerberos, ×ÏÚÍÏÖÎÏ ÔÁËÖÅ
	ÉÓÐÏÌØÚÏ×ÁÎÉÅ ÆÁÊÌÁ <filename>.k5login</filename> × ËÁÔÁÌÏÇÅ
	ÐÏÌØÚÏ×ÁÔÅÌÑ <username>root</username> ÄÌÑ ÄÏÓÔÕÐÁ Ë ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ
	<username>root</username> Ó ÐÏÍÏÝØÀ &man.ksu.1; ÂÅÚ ÐÏÍÅÝÅÎÉÑ
	ËÏÇÏ-ÌÉÂÏ × ÇÒÕÐÐÕ <groupname>wheel</groupname>.  üÔÏ ÒÅÛÅÎÉÅ ×ÏÚÍÏÖÎÏ
	ÌÕÞÛÅ, ÐÏÓËÏÌØËÕ ÍÅÈÁÎÉÚÍ <groupname>wheel</groupname> ×ÓÅ ÅÝÅ
	ÐÏÚ×ÏÌÑÅÔ ×ÚÌÏÍ <username>root</username>, ÅÓÌÉ ÚÌÏÕÍÙÛÌÅÎÎÉË
	ÐÏÌÕÞÉÌ ËÏÐÉÀ ÆÁÊÌÁ ÐÁÒÏÌÅÊ É ÓÍÏÇ ×ÚÌÏÍÁÔØ ÓÌÕÖÅÂÎÕÀ ÕÞ£ÔÎÕÀ ÚÁÐÉÓØ.
	èÏÔÑ ÉÓÐÏÌØÚÏ×ÁÎÉÅ ÍÅÈÁÎÉÚÍÁ <groupname>wheel</groupname> ÌÕÞÛÅ,
	ÞÅÍ ÒÁÂÏÔÁ ÞÅÒÅÚ <username>root</username> ÎÁÐÒÑÍÕÀ, ÜÔÏ ÎÅ
	ÏÂÑÚÁÔÅÌØÎÏ ÓÁÍÙÊ ÂÅÚÏÐÁÓÎÙÊ ÓÐÏÓÏÂ.</para>

      <!-- XXX:
	This will need updating depending on the outcome of PR bin/71147.
	Personally I know what I'd like to see, which puts this in definite
	need of a rewrite, but we'll have to wait and see.  ceri@
      -->

      <para>îÅÐÒÑÍÏÊ ÓÐÏÓÏ ÚÁÝÉÔÙ ÓÌÕÖÅÂÎÙÈ ÕÞ£ÔÎÙÈ ÚÁÐÉÓÅÊ É ËÏÎÅÞÎÏ
	<username>root</username> ÜÔÏ ÉÓÐÏÌØÚÏ×ÁÎÉÅ ÁÌØÔÅÒÎÁÔÉ×ÎÙÈ ÍÅÔÏÄÏ×
	ÄÏÓÔÕÐÁ É ÚÁÍÅÎÁ ÚÁÛÉÆÒÏ×ÁÎÎÙÈ ÐÁÒÏÌÅÊ ÎÁ ÓÉÍ×ÏÌ
	<quote><literal>*</literal></quote>.  éÓÐÏÌØÚÕÑ ËÏÍÁÎÄÕ
	&man.vipw.8;, ÚÁÍÅÎÉÔÅ ËÁÖÄÙÊ ÚÁÛÉÆÒÏ×ÁÎÎÙÊ ÐÁÒÏÌØ ÓÌÕÖÅÂÎÙÈ ÕÞ£ÔÎÙÈ
	ÚÁÐÉÓÅÊ ÎÁ ÜÔÏÔ ÓÉÍ×ÏÌ ÄÌÑ ÚÁÐÒÅÔÁ ×ÈÏÄÁ Ó ÁÕÔÅÎÔÉÆÉËÁÃÉÅÊ ÐÏ ÐÁÒÏÌÀ.
	üÔÁ ËÏÍÁÎÄÁ ÏÂÎÏ×ÉÔ ÆÁÊÌ <filename>/etc/master.passwd</filename> É
	ÂÁÚÕ ÄÁÎÎÙÈ ÐÏÌØÚÏ×ÁÔÅÌÅÊ/ÐÁÒÏÌÅÊ.</para>

      <para>óÌÕÖÅÂÎÁÑ ÕÞ£ÔÎÁÑ ÚÁÐÉÓØ ×ÒÏÄÅ ÜÔÏÊ:</para>

      <programlisting>foobar:R9DT/Fa1/LV9U:1000:1000::0:0:Foo Bar:/home/foobar:/usr/local/bin/tcsh</programlisting>

      <para>äÏÌÖÎÁ ÂÙÔØ ÚÁÍÅÎÅÎÁ ÎÁ ÔÁËÕÀ:</para>

      <programlisting>foobar:*:1000:1000::0:0:Foo Bar:/home/foobar:/usr/local/bin/tcsh</programlisting>

      <para>üÔÏ ÉÚÍÅÎÅÎÉÅ ÐÒÅÄÏÔ×ÒÁÔÉÔ ÏÂÙÞÎÙÊ ×ÈÏÄ, ÐÏÓËÏÌØËÕ ÚÁÛÉÆÒÏ×ÁÎÎÙÊ
	ÐÁÒÏÌØ ÎÉËÏÇÄÁ ÎÅ ÓÏ×ÐÁÄÅÔ Ó <quote><literal>*</literal></quote>.
	ðÏÓÌÅ ÜÔÏÇÏ ÞÌÅÎÙ ÇÒÕÐÐÙ staff ÄÏÌÖÎÙ ÉÓÐÏÌØÚÏ×ÁÔØ ÄÒÕÇÏÊ ÍÅÈÁÎÉÚÍ
	ÁÕÔÅÎÔÉÆÉËÁÃÉÉ, ÎÁÐÒÉÍÅÒ &man.kerberos.1; ÉÌÉ &man.ssh.1; Ó ÐÁÒÏÊ
	ËÌÀÞÅÊ: ÐÕÂÌÉÞÎÙÍ É ÐÒÉ×ÁÔÎÙÍ.  ðÒÉ ÉÓÐÏÌØÚÏ×ÁÎÉÉ ÔÁËÏÊ	ÓÉÓÔÅÍÙ ËÁË
	Kerberos, ÐÏÔÒÅÂÕÅÔÓÑ ÚÁÝÉÔÉÔØ ÓÅÒ×ÅÒ Kerberos É ÒÁÂÏÞÕÀ ÓÔÁÎÃÉÀ.
	ðÒÉ ÉÓÐÏÌØÚÏ×ÁÎÉÉ ÐÁÒÙ ÐÕÂÌÉÞÎÏÇÏ/ÐÒÉ×ÁÔÎÏÇÏ ËÌÀÞÅÊ Ó ssh,
	ÐÏÔÒÅÂÕÅÔÓÑ ÚÁÝÉÔÉÔØ ËÏÍÐØÀÔÅÒ, <emphasis>Ó</emphasis> ËÏÔÏÒÏÇÏ
	ÐÒÏÉÓÈÏÄÉÔ ×ÈÏÄ (ÏÂÙÞÎÏ ÜÔÏ ÒÁÂÏÞÁÑ ÓÔÁÎÃÉÑ).  äÏÐÏÌÎÉÔÅÌØÎÙÈ ÓÌÏÊ
	ÚÁÝÉÔÙ ÍÏÖÅÔ ÂÙÔØ ÄÏÂÁ×ÌÅÎ ÐÕÔÅÍ ÚÁÝÉÔÙ ÐÁÒÙ ËÌÀÞÅÊ ÐÒÉ ÓÏÚÄÁÎÉÉ ÉÈ
	Ó ÐÏÍÏÝØÀ &man.ssh-keygen.1;.  ÷ÏÚÍÏÖÎÏÓÔØ ÚÁÍÅÎÉÔØ ÐÁÒÏÌÉ ÓÌÕÖÅÂÎÙÈ
	ÕÞ£ÔÎÙÈ ÚÁÐÉÓÅÊ ÎÁ <quote><literal>*</literal></quote> ÇÁÒÁÎÔÉÒÕÅÔ
	ÔÁËÖÅ, ÞÔÏ ×ÈÏÄ ÍÏÖÅÔ ÂÙÔØ ÏÓÕÝÅÓÔ×ÌÅÎ ÔÏÌØËÏ ÞÅÒÅÚ ÚÁÝÉÝÅÎÎÙÅ ÍÅÔÏÄÙ
	ÄÏÓÔÕÐÁ, ËÏÔÏÒÙÅ ×Ù ÎÁÓÔÒÏÉÌÉ.  üÔÏ ÐÒÉÎÕÖÄÁÅÔ ×ÓÅÈ ÞÌÅÎÏ× staff
	ÉÓÐÏÌØÚÏ×ÁÔØ ÚÁÝÉÝÅÎÎÙÅ, ÛÉÆÒÏ×ÁÎÎÙÅ ÓÏÅÄÉÎÅÎÉÑ ÄÌÑ ×ÓÅÈ ×ÈÏÄÏ×,
	ÞÔÏ ÚÁËÒÙ×ÁÅÔ ÂÏÌØÛÕÀ ÂÒÅÛØ, ÉÓÐÏÌØÚÕÅÍÕÀ ÍÎÏÇÉÍÉ ÎÁÒÕÛÉÔÅÌÑÍÉ:
	ÐÅÒÅÈ×ÁÔ ÐÁÒÏÌÅÊ Ó ÄÒÕÇÏÇÏ, ÓÌÁÂÏ ÚÁÝÉÝÅÎÎÏÇÏ ËÏÍÐØÀÔÅÒÁ.</para>

      <para>âÏÌÅÅ ÎÅÐÒÑÍÏÊ ÍÅÈÁÎÉÚÍ ÂÅÚÏÐÁÓÎÏÓÔÉ ÐÒÅÄÐÏÌÁÇÁÅÔ, ÞÔÏ ×Ù ×ÈÏÄÉÔÅ
	Ó ÂÏÌÅÅ ÚÁÝÉÝÅÎÎÏÇÏ ÓÅÒ×ÅÒÁ ÎÁ ÍÅÎÅÅ ÚÁÝÉÝÅÎÎÙÊ.  îÁÐÒÉÍÅÒ, ÅÓÌÉ
	ÇÌÁ×ÎÙÊ ÓÅÒ×ÅÒ ÒÁÂÏÔÁÅÔ ÓÏ ×ÓÅÍÉ ÓÅÒ×ÉÓÁÍÉ, ÒÁÂÏÞÁÑ ÓÔÁÎÃÉÑ ÎÅ ÄÏÌÖÎÁ
	ÒÁÂÏÔÁÔØ ÎÉ Ó ÏÄÎÉÍ.  äÌÑ ÐÏÄÎÑÔÉÑ ÕÒÏ×ÎÑ ÂÅÚÏÐÁÓÎÏÓÔÉ ÄÏ ÐÒÉÅÍÌÅÍÏÇÏ
	ÕÒÏ×ÎÑ, ÞÉÓÌÏ ÚÁÐÕÝÅÎÎÙÈ ÎÁ ÎÅÊ ÓÅÒ×ÉÓÏ× ÎÅÏÂÈÏÄÉÍÏ ÓÏËÒÁÔÉÔØ ÄÏ
	ÍÉÎÉÍÕÍÁ, ×ÐÌÏÔØ ÄÏ ÏÔËÌÀÞÅÎÉÑ ÉÈ ×ÓÅÈ, ËÒÏÍÅ ÔÏÇÏ ÎÅÏÂÈÏÄÉÍÏ
	ÉÓÐÏÌØÚÏ×ÁÔØ ÚÁÝÉÝÅÎÎÙÊ ÐÁÒÏÌÅÍ ÈÒÁÎÉÔÅÌØ ÜËÒÁÎÁ.  ëÏÎÅÞÎÏ, ÐÒÉ
	ÎÁÌÉÞÉÉ ÆÉÚÉÞÅÓËÏÇÏ ÄÏÓÔÕÐÁ Ë ÒÁÂÏÞÅÊ ÓÔÁÎÃÉÉ ÁÔÁËÕÀÝÉÊ ÍÏÖÅÔ ×ÚÌÏÍÁÔØ
	ÌÀÂÕÀ ÓÉÓÔÅÍÕ ÂÅÚÏÐÁÓÎÏÓÔÉ.  üÔÏ ÏÐÒÅÄÅÌÅÎÎÏ ÐÒÏÂÌÅÍÁ, ËÏÔÏÒÕÀ ×Ù
	ÄÏÌÖÎÙ ÕÞÉÔÙ×ÁÔØ, ÎÏ ÕÞÔÉÔÅ ÔÁËÖÅ ÔÏÔ ÆÁËÔ, ÞÔÏ ÂÏÌØÛÉÎÓÔ×Ï ×ÚÌÏÍÏ×
	ÓÏ×ÅÒÛÁÀÔÓÑ ÕÄÁÌÅÎÎÏ, ÞÅÒÅÚ ÓÅÔØ, ÌÀÄØÍÉ, ËÏÔÏÒÙÅ ÎÅ ÉÍÅÀÔ ÆÉÚÉÞÅÓËÏÇÏ
	ÄÏÓÔÕÐÁ Ë ×ÁÛÉÍ ÒÁÂÏÞÉÍ ÓÔÁÎÃÉÑÍ ÉÌÉ ÓÅÒ×ÅÒÁÍ.</para>
      <indexterm><primary>KerberosIV</primary></indexterm>

      <para>éÓÐÏÌØÚÏ×ÁÎÉÅ ÔÁËÏÊ ÓÉÓÔÅÍÙ ËÁË Kerberos ÄÁÅÔ ×ÏÚÍÏÖÎÏÓÔØ
	ÚÁÂÌÏËÉÒÏ×ÁÔØ ÉÌÉ ÉÚÍÅÎÉÔØ ÐÁÒÏÌØ × ÏÄÎÏÍ ÍÅÓÔÅ, ÞÔÏ ÓÒÁÚÕ
	ÏÔÒÁÚÉÔØÓÑ ÎÁ ×ÓÅÈ ËÏÍÐØÀÔÅÒÁÈ, ÇÄÅ ÓÕÝÅÓÔ×ÕÅÔ ÓÌÕÖÅÂÎÁÑ ÕÞ£ÔÎÁÑ
	ÚÁÐÉÓØ.  åÓÌÉ ÜÔÁ ÕÞ£ÔÎÁÑ ÚÁÐÉÓØ ÂÕÄÅÔ ×ÚÌÏÍÁÎÁ, ×ÏÚÍÏÖÎÏÓÔØ
	ÎÅÍÅÄÌÅÎÎÏ ÉÚÍÅÎÉÔØ ÐÁÒÏÌØ ÎÁ ×ÓÅÈ ËÏÍÐØÀÔÅÒÁÈ ÎÅÌØÚÑ ÎÅÄÏÏÃÅÎÉ×ÁÔØ.
	âÅÚ ÜÔÏÊ ×ÏÚÍÏÖÎÏÓÔÉ ÉÚÍÅÎÅÎÉÅ ÐÁÒÏÌÅÊ ÎÁ N ÍÁÛÉÎÁÈ ÍÏÖÅÔ ÓÔÁÔØ
	ÐÒÏÂÌÅÍÏÊ.  ÷Ù ÍÏÖÅÔÅ ÔÁËÖÅ ÎÁÌÏÖÉÔØ ÏÇÒÁÎÉÞÅÎÉÑ ÎÁ ÓÍÅÎÕ ÐÁÒÏÌÅÊ
	Ó ÐÏÍÏÝØÀ Kerberos: ÎÅ ÔÏÌØËÏ ÕÓÔÁÎÏ×ÉÔØ ÚÎÁÞÅÎÉÑ timeout ×
	Kerberos, ÎÏ É ÄÏÂÁ×ÉÔØ ÔÒÅÂÏ×ÁÎÉÅ ÓÍÅÎÙ ÐÁÒÏÌÑ ÐÏÌØÚÏ×ÁÔÅÌÅÍ
	ÐÏÓÌÅ ÏÐÒÅÄÅÌÅÎÎÏÇÏ ÐÅÒÉÏÄÁ ×ÒÅÍÅÎÉ (ÓËÁÖÅÍ, ÒÁÚ × ÍÅÓÑÃ).</para>
    </sect2>

    <sect2>
      <title>úÁÝÉÔÁ ÒÁÂÏÔÁÀÝÉÈ ÐÏÄ root ÓÅÒ×ÉÓÏ× É suid/sgid ÉÓÐÏÌÎÑÅÍÙÈ
	ÆÁÊÌÏ×</title>

      <indexterm>
	<primary><command>ntalk</command></primary>
      </indexterm>
      <indexterm>
	<primary><command>comsat</command></primary>
      </indexterm>
      <indexterm>
	<primary><command>finger</command></primary>
      </indexterm>
      <indexterm>
	<primary>sandboxes</primary>
      </indexterm>
      <indexterm>
	<primary><application>sshd</application></primary>
      </indexterm>
      <indexterm>
	<primary><application>telnetd</application></primary>
      </indexterm>
      <indexterm>
	<primary><application>rshd</application></primary>
      </indexterm>
      <indexterm>
	<primary><application>rlogind</application></primary>
      </indexterm>

      <para>ðÒÅÄÕÓÍÏÔÒÉÔÅÌØÎÙÊ ÓÉÓÔÅÍÎÙÊ ÁÄÍÉÎÉÓÔÒÁÔÏÒ ÚÁÐÕÓËÁÅÔ ÔÏÌØËÏ ÔÅ
	ÓÅÒ×ÉÓÙ, × ËÏÔÏÒÙÈ ÎÕÖÄÁÅÔÓÑ, ÎÉ ÂÏÌØÛÅ ÎÉ ÍÅÎØÛÅ.  õÞÉÔÙ×ÁÊÔÅ, ÞÔÏ
	ÓÅÒ×ÉÓÙ ÓÔÏÒÏÎÎÉÈ ÒÁÚÒÁÂÏÔÞÉËÏ× ÎÁÉÂÏÌÅÅ ÐÏÄ×ÅÒÖÅÎÙ ÏÛÉÂËÁÍ.  ë ÐÒÉÍÅÒÕ,
	ÒÁÂÏÔÁ ÓÏ ÓÔÁÒÙÍÉ ×ÅÒÓÉÑÍÉ <application>imapd</application> ÉÌÉ
	<application>popper</application> ÜÔÏ ×ÓÅ ÒÁ×ÎÏ ÞÔÏ ÒÁÚÄÁÞÁ ÄÏÓÔÕÐÁ
	<username>root</username> ×ÓÅÍÕ ÍÉÒÕ.  îÉËÏÇÄÁ ÎÅ ÚÁÐÕÓËÁÊÔÅ
	ÓÅÒ×ÉÓÙ, ËÏÔÏÒÙÅ ×Ù ÎÅ ÐÒÏ×ÅÒÉÌÉ ÄÏÓÔÁÔÏÞÎÏ ×ÎÉÍÁÔÅÌØÎÏ.  íÎÏÇÉÍ
	ÓÅÒ×ÉÓÁÍ ÎÅ ÔÒÅÂÕÅÔÓÑ ÒÁÂÏÔÁ ÐÏÄ <username>root</username>.
	îÁÐÒÉÍÅÒ, ÄÁÅÍÏÎÙ <application>ntalk</application>,
	<application>comsat</application>, É
	<application>finger</application> ÍÏÇÕÔ ÂÙÔØ ÚÁÐÕÝÅÎÙ × ÔÁË
	ÎÁÚÙ×ÁÅÍÙÈ <firstterm>ÐÅÓÏÞÎÉÃÁÈ</firstterm>
	(<firstterm>sandboxes</firstterm>).  ðÅÓÏÞÎÉÃÁ ÜÔÏ ÎÅ ÉÄÅÁÌØÎÏÅ
	ÒÅÛÅÎÉÅ, ÐÏÓËÏÌØËÕ ×ÙÚÙ×ÁÅÔ ÍÎÏÇÏ ÐÒÏÂÌÅÍ, ÎÏ ÏÎÁ ÐÏÄÈÏÄÉÔ ÐÏÄ
	ÍÏÄÅÌØ ÐÏÓÌÏÊÎÏÊ ÂÅÚÏÐÁÓÎÏÓÔÉ: ÅÓÌÉ ËÔÏ-ÔÏ ÓÍÏÖÅÔ ×ÚÌÏÍÁÔØ ÓÅÒ×ÉÓ,
	ÒÁÂÏÔÁÀÝÉÊ × ÐÅÓÏÞÎÉÃÅ, ÅÍÕ ÐÏÔÒÅÂÕÅÔÓÑ ×ÚÌÏÍÁÔØ ÅÝÅ É ÓÁÍÕ
	ÐÅÓÏÞÎÉÃÕ.  þÅÍ ÂÏÌØÛÅ ÕÒÏ×ÎÅÊ (<quote>ÓÌÏÅ×</quote>) ÐÏÔÒÅÂÕÅÔÓÑ
	ÐÒÏÊÔÉ ÁÔÁËÕÀÝÅÍÕ, ÔÅÍ ÍÅÎØÛÅ ×ÅÒÏÑÔÎÏÓÔØ ÅÇÏ ÕÓÐÅÈÁ.  ïÛÉÂËÉ,
	ÐÏÚ×ÏÌÑÀÝÉÅ ÐÏÌÕÞÁÔØ root ÄÏÓÔÕÐ, ÎÁÈÏÄÉÌÉ ÆÁËÔÉÞÅÓËÉ ×Ï ×ÓÅÈ
	ÓÅÒ×ÉÓÁÈ, ÚÁÐÕÓËÁÅÍÙÈ ÐÏÄ <username>root</username>, ×ËÌÀÞÁÑ
	ÏÓÎÏ×ÎÙÅ ÓÉÓÔÅÍÎÙÅ ÓÅÒ×ÉÓÙ.  åÓÌÉ ×Ù ÏÂÓÌÕÖÉ×ÁÅÔÅ ÍÁÛÉÎÕ, ÎÁ ËÏÔÏÒÕÀ
	×ÈÏÄÑÔ ÔÏÌØËÏ ÞÅÒÅÚ <application>sshd</application> É ÎÉËÏÇÄÁ ÎÅ
	×ÈÏÄÑÔ ÞÅÒÅÚ <application>telnetd</application>,
	<application>rshd</application> ÉÌÉ
	<application>rlogind</application>, ÏÔËÌÀÞÉÔÅ ÜÔÉ ÓÅÒ×ÉÓÙ!</para>

      <para>÷ &os; ÓÅÒ×ÉÓÙ
	<application>ntalkd</application>,
	<application>comsat</application> É
	<application>finger</application> ÔÅÐÅÒØ ÐÏ ÕÍÏÌÞÁÎÉÀ ÒÁÂÏÔÁÀÔ ×
	<quote>ÐÅÓÏÞÎÉÃÅ</quote>.  äÒÕÇÁÑ ÐÒÏÇÒÁÍÍÁ, ËÏÔÏÒÁÑ ÍÏÖÅÔ ÂÙÔØ
	ËÁÎÄÉÄÁÔÏÍ ÎÁ ÚÁÐÕÓË × <quote>ÐÅÓÏÞÎÉÃÅ</quote> ÜÔÏ
	&man.named.8;.  <filename>/etc/defaults/rc.conf</filename> ×ËÌÀÞÁÅÔ
	ÎÅÏÂÈÏÄÉÍÙÅ ÄÌÑ ÚÁÐÕÓËÁ <application>named</application>
	× <quote>ÐÅÓÏÞÎÉÃÅ</quote> ÁÒÇÕÍÅÎÔÙ × ÚÁËÏÍÍÅÎÔÉÒÏ×ÁÎÏÊ ÆÏÒÍÅ.
	÷ ÚÁ×ÉÓÉÍÏÓÔÉ ÏÔ ÔÏÇÏ, ÕÓÔÁÎÁ×ÌÉ×ÁÅÔÅ ÌÉ ×Ù ÎÏ×ÕÀ ÓÉÓÔÅÍÕ, ÉÌÉ
	ÏÂÎÏ×ÌÑÅÔÅ ÓÔÁÒÕÀ, ÕÞ£ÔÎÙÅ ÚÁÐÉÓÉ ÐÏÌØÚÏ×ÁÔÅÌÅÊ, ÉÓÐÏÌØÚÕÅÍÙÅ
	ÜÔÉÍÉ <quote>ÐÅÓÏÞÎÉÃÁÍÉ</quote> ÍÏÇÕÔ ÎÅ ÂÙÔØ ÓÏÚÄÁÎÙ.
	ðÒÅÄÕÓÍÏÔÒÉÔÅÌØÎÙÊ ÓÉÓÔÅÍÎÙÊ ÁÄÍÉÎÉÓÔÒÁÔÏÒ ÄÏÌÖÅÎ ÕÚÎÁÔØ Ï
	<quote>ÐÅÓÏÞÎÉÃÁÈ</quote> ÄÌÑ ÓÅÒ×ÉÓÏ× É ÕÓÔÁÎÏ×ÉÔØ ÉÈ ÅÓÌÉ ÅÓÔØ
	×ÏÚÍÏÖÎÏÓÔØ.</para>
      <indexterm>
	<primary><application>sendmail</application></primary>
      </indexterm>

      <para>åÓÔØ ÍÎÏÖÅÓÔ×Ï ÄÒÕÇÉÈ ÓÅÒ×ÉÓÏ×, ËÏÔÏÒÙÅ ÏÂÙÞÎÏ ÎÅ ÒÁÂÏÔÁÀÔ ×
	<quote>ÐÅÓÏÞÎÉÃÁÈ</quote>: <application>sendmail</application>,
	<application>popper</application>,
	<application>imapd</application>, <application>ftpd</application>,
	É ÄÒÕÇÉÅ.  îÅËÏÔÏÒÙÍ ÉÚ ÜÔÉÈ ÓÅÒ×ÉÓÏ× ÅÓÔØ ÁÌØÔÅÒÎÁÔÉ×Ù,
	ÎÏ ÉÈ ÕÓÔÁÎÏ×ËÁ ÍÏÖÅÔ ÐÏÔÒÅÂÏ×ÁÔØ ÂÏÌØÛÅ ÒÁÂÏÔÙ, ÞÅÍ ×Ù ÇÏÔÏ×Ù
	×ÙÐÏÌÎÉÔØ (ÆÁËÔÏÒ ÕÄÏÂÓÔ×Á).  ÷Ù ÍÏÖÅÔÅ ÚÁÐÕÓÔÉÔØ ÜÔÉ ÓÅÒ×ÉÓÙ ÐÏÄ
	<username>root</username> É ÐÏÌÏÖÉÔØÓÑ ÎÁ ÄÒÕÇÉÅ ÍÅÈÁÎÉÚÍÙ ÏÂÎÁÒÕÖÅÎÉÑ
	×ÔÏÒÖÅÎÉÊ, ËÏÔÏÒÙÅ ÍÏÇÕÔ ÐÒÏÊÔÉ ÞÅÒÅÚ ÎÉÈ.</para>

      <para>äÒÕÇÁÑ ÂÏÌØÛÁÑ ÐÏÔÅÎÃÉÁÌØÎÁÑ <username>root</username> ÂÒÅÛØ
	× ÓÉÓÔÅÍÅ ÜÔÏ suid-root É sgid ÉÓÐÏÌÎÑÅÍÙÅ ÆÁÊÌÙ.  âÏÌØÛÉÎÓÔ×Ï
	ÜÔÉÈ ÉÓÐÏÌÎÑÅÍÙÈ ÆÁÊÌÏ×, ÔÁËÉÈ ËÁË <application>rlogin</application>,
	ÕÓÔÁÎÏ×ÌÅÎÙ × <filename>/bin</filename>, <filename>/sbin</filename>,
	<filename>/usr/bin</filename>, ÉÌÉ <filename>/usr/sbin</filename>.
	èÏÔÑ ÎÉÞÔÏ ÎÅ ÍÏÖÅÔ ÂÙÔØ ÂÅÚÏÐÁÓÎÏ ÎÁ 100%, ÎÁÈÏÄÑÝÉÅÓÑ ÐÏ ÕÍÏÌÞÁÎÉÀ
	× ÓÉÓÔÅÍÅ suid É sgid ÉÓÐÏÌÎÑÅÍÙÅ ÆÁÊÌÙ ÍÏÇÕÔ ÂÙÔØ ÐÒÉÚÎÁÎÙ
	ÄÏÓÔÁÔÏÞÎÏ ÂÅÚÏÐÁÓÎÙÍÉ.  îÏ <username>root</username> ÂÒÅÛÉ ×ÓÅ ÅÝÅ
	ÏÂÎÁÒÕÖÉ×ÁÀÔÓÑ × ÜÔÉÈ ÉÓÐÏÌÎÑÅÍÙÈ ÆÁÊÌÁÈ.  <username>root</username>
	ÂÒÅÛØ, ÏÂÎÁÒÕÖÅÎÎÁÑ × <literal>Xlib</literal> × 1998 ÄÅÌÁÌÁ
	<application>xterm</application> (ËÏÔÏÒÙÊ ÏÂÙÞÎÏ suid) ÐÏÄ×ÅÒÖÅÎÎÙÍ
	×ÚÌÏÍÕ.  ìÕÞÛÅ ÓÒÁÚÕ ÐÒÉÎÑÔØ ÍÅÒÙ ÐÒÅÄÏÓÔÏÒÏÖÎÏÓÔÉ, ÞÅÍ ÓÏÖÁÌÅÔØ
	ÐÏÔÏÍ. ðÒÅÄÕÓÍÏÔÒÉÔÅÌØÎÙÊ ÓÉÓÔÅÍÎÙÊ ÁÄÍÉÎÉÓÔÒÁÔÏÒ ÏÇÒÁÎÉÞÉÔ ÐÒÁ×Á
	ÚÁÐÕÓËÁ suid ÉÓÐÏÌÎÑÅÍÙÈ ÆÁÊÌÏ×, ËÏÔÏÒÙÅ ÄÏÌÖÎÙ ÚÁÐÕÓËÁÔØÓÑ
	ÐÏÌØÚÏ×ÁÔÅÌÑÍÉ ÇÒÕÐÐÙ staff, ÔÏÌØËÏ ÜÔÏÊ ÇÒÕÐÐÏÊ, Á ÔÁËÖÅ ÚÁÐÒÅÔÉÔ
	ÄÏÓÔÕÐ (<command>chmod 000</command>) Ë ÔÅÍ ÉÓÐÏÌÎÑÅÍÙÍ ÆÁÊÌÁÍ
	suid, ËÏÔÏÒÙÅ ÎÉËÅÍ ÎÅ ÉÓÐÏÌØÚÕÀÔÓÑ.  óÅÒ×ÅÒÕ ÂÅÚ ÍÏÎÉÔÏÒÁ ÏÂÙÞÎÏ
	ÎÅ ÔÒÅÂÕÅÔÓÑ ÉÓÐÏÌÎÑÅÍÙÊ ÆÁÊÌ <application>xterm</application>.
	éÓÐÏÌÎÑÅÍÙÅ sgid ÉÓÐÏÌÎÑÅÍÙÅ ÆÁÊÌÙ ÍÏÇÕÔ ÂÙÔØ ÐÏÞÔÉ ÔÁË ÖÅ ÏÐÁÓÎÙ.
	åÓÌÉ ÎÁÒÕÛÉÔÅÌØ ÓÍÏÖÅÔ ×ÚÌÏÍÁÔØ sgid-kmem ÉÓÐÏÌÎÑÅÍÙÊ ÆÁÊÌ, ÏÎ
	×ÏÚÍÏÖÎÏ ÓÍÏÖÅÔ ÐÒÏÞÅÓÔØ <filename>/dev/kmem</filename> É
	ÔÁËÉÍ ÏÂÒÁÚÏÍ ÐÏÌÕÞÉÔØ ÆÁÊÌ ÚÁÛÉÆÒÏ×ÁÎÎÙÈ ÐÁÒÏÌÅÊ, ÞÔÏ ÐÏÔÅÎÃÉÁÌØÎÏ
	ÄÅÌÁÅÔ ×ÏÚÍÏÖÎÙÍ ×ÚÌÏÍ ÌÀÂÏÊ ÚÁÝÉÝ£ÎÎÏÊ ÐÁÒÏÌÅÍ ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ.
	áÎÁÌÏÇÉÞÎÏ ÎÁÒÕÛÉÔÅÌØ, ÐÒÏÎÉËÛÉÊ × ÇÒÕÐÐÕ <literal>kmem</literal>,
	ÍÏÖÅÔ ÏÔÓÌÅÖÉ×ÁÔØ ÐÏÓÌÅÄÏ×ÁÔÅÌØÎÏÓÔÉ ËÌÁ×ÉÛ, ÏÔÐÒÁ×ÌÑÅÍÙÅ ÞÅÒÅÚ
	ÐÓÅ×ÄÏ-ÔÅÒÍÉÎÁÌÙ, ×ËÌÀÞÁÑ ÔÅ, ÞÔÏ ÉÓÐÏÌØÚÕÀÔ ÚÁÝÉÝ£ÎÎÙÅ ÓÏÅÄÉÎÅÎÉÑ.
	îÁÒÕÛÉÔÅÌØ, ×ÏÛÅÄÛÉÊ × ÇÒÕÐÐÕ
	<groupname>tty</groupname> ÍÏÖÅÔ ÓÄÅÌÁÔØ ×Ù×ÏÄ ÐÏÞÔÉ ÎÁ ÌÀÂÏÊ
	ÐÏÌØÚÏ×ÁÔÅÌØÓËÉÊ ÔÅÒÍÉÎÁÌ.  åÓÌÉ ÐÏÌØÚÏ×ÁÔÅÌØ ÒÁÂÏÔÁÅÔ Ó
	ÔÅÒÍÉÎÁÌØÎÏÊ ÐÒÏÇÒÁÍÍÏÊ ÉÌÉ ÜÍÕÌÑÔÏÒÏÍ Ó ×ÏÚÍÏÖÎÏÓÔØÀ ÜÍÕÌÑÃÉÉ
	ËÌÁ×ÉÁÔÕÒÙ, ×ÚÌÏÍÝÉË ÍÏÖÅÔ ÐÏÔÅÎÃÉÁÌØÎÏ ÓÇÅÎÅÒÉÒÏ×ÁÔØ ÐÏÔÏË ÄÁÎÎÙÈ,
	ËÏÔÏÒÙÊ ÚÁÓÔÁ×ÉÔ ÔÅÒÍÉÎÁÌ ÐÏÌØÚÏ×ÁÔÅÌÑ ××ÅÓÔÉ ËÏÍÁÎÄÕ, É ÏÎÁ ÂÕÄÅÔ
	ÚÁÐÕÝÅÎÁ Ó ÐÒÁ×ÁÍÉ ÜÔÏÇÏ ÐÏÌØÚÏ×ÁÔÅÌÑ.</para>
    </sect2>

    <sect2 id="secure-users">
      <title>úÁÝÉÔÁ ÕÞ£ÔÎÙÈ ÚÁÐÉÓÅÊ ÐÏÌØÚÏ×ÁÔÅÌÅÊ</title>

      <para>õÞÅÔÎÙÅ ÚÁÐÉÓÉ ÐÏÌØÚÏ×ÁÔÅÌÅÊ ÏÂÙÞÎÏ ÓÌÏÖÎÅÅ ×ÓÅÇÏ ÚÁÝÉÔÉÔØ.
	÷Ù ÍÏÖÅÔÅ ××ÅÓÔÉ ÄÒÁËÏÎÏ×ÓËÉÅ ÏÇÒÁÎÉÞÅÎÉÑ ÄÏÓÔÕÐÁ Ë ÓÌÕÖÅÂÎÙÍ ÕÞ£ÔÎÙÍ
	ÚÁÐÉÓÑÍ, ÚÁÍÅÎÉ× ÉÈ ÐÁÒÏÌÉ ÎÁ ÓÉÍ×ÏÌ
	<quote><literal>*</literal></quote>, ÎÏ ×ÏÚÍÏÖÎÏ ÎÅ ÓÍÏÖÅÔÅ ÓÄÅÌÁÔØ
	ÔÏ ÖÅ Ó ÏÂÙÞÎÙÍÉ ÕÞ£ÔÎÙÍÉ ÚÁÐÉÓÑÍÉ ÐÏÌØÚÏ×ÁÔÅÌÅÊ.  åÓÌÉ ÅÓÔØ
	ÔÁËÁÑ ×ÏÚÍÏÖÎÏÓÔØ, ×Ù ×ÏÚÍÏÖÎÏ ÓÍÏÖÅÔÅ ÚÁÝÉÔÉÔØ ÕÞ£ÔÎÙÅ ÚÁÐÉÓÉ
	ÐÏÌØÚÏ×ÁÔÅÌÅÊ ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÉÍ ÏÂÒÁÚÏÍ.  åÓÌÉ ÎÅÔ, ÐÒÏÓÔÏ
	ÂÏÌÅÅ ÂÄÉÔÅÌØÎÏ ÏÔÓÌÅÖÉ×ÁÊÔÅ ÜÔÉ ÕÞ£ÔÎÙÅ ÚÁÐÉÓÉ.  éÓÐÏÌØÚÏ×ÁÎÉÅ
	ssh É Kerberos ÄÌÑ ÕÞ£ÔÎÙÈ ÚÁÐÉÓÅÊ ÐÏÌØÚÏ×ÁÔÅÌÅÊ ÂÏÌÅÅ
	ÐÒÏÂÌÅÍÁÔÉÞÎÏ, ÐÏÓËÏÌØËÕ ÔÒÅÂÕÅÔ ÄÏÐÏÌÎÉÔÅÌØÎÏÊ ÁÄÍÉÎÉÓÔÒÁÔÉ×ÎÏÊ
	ÒÁÂÏÔÙ É ÔÅÈÎÉÞÅÓËÏÊ ÐÏÄÄÅÒÖËÉ, ÎÏ ×ÓÅ ÖÅ ÜÔÏ ÒÅÛÅÎÉÅ ÌÕÞÛÅ,
	ÞÅÍ ÆÁÊÌ Ó ÛÉÆÒÏ×ÁÎÎÙÍÉ ÐÁÒÏÌÑÍÉ.</para>
    </sect2>

    <sect2>
      <title>úÁÝÉÔÁ ÆÁÊÌÁ ÐÁÒÏÌÅÊ</title>

      <para>åÄÉÎÓÔ×ÅÎÎÙÊ ÁÂÓÏÌÀÔÎÏ ÎÁÄÅÖÎÙÊ ÓÐÏÓÏ ÜÔÏ ÚÁÍÅÎÁ ÎÁ
	<literal>*</literal> ÍÁËÓÉÍÁÌØÎÏ ×ÏÚÍÏÖÎÏÇÏ ËÏÌÉÞÅÓÔ×Á ÐÁÒÏÌÅÊ É
	ÉÓÐÏÌØÚÏ×ÁÎÉÅ ssh ÉÌÉ Kerberos ÄÌÑ ÄÏÓÔÕÐÁ Ë ÔÁËÉÍ ÕÞ£ÔÎÙÍ ÚÁÐÉÓÑÍ.
	èÏÔÑ ÆÁÊÌ Ó ÛÉÆÒÏ×ÁÎÎÙÍÉ ÐÁÒÏÌÑÍÉ (<filename>/etc/spwd.db</filename>)
	ÄÏÓÔÕÐÅÎ ÄÌÑ ÞÔÅÎÉÑ ÔÏÌØËÏ <username>root</username>, ×ÏÚÍÏÖÎÏ, ÞÔÏ
	ÎÁÒÕÛÉÔÅÌØ ÓÍÏÖÅÔ ÐÏÌÕÞÉÔØ ÄÏÓÔÕÐ ÎÁ ÞÔÅÎÉÅ Ë ÜÔÏÍÕ ÆÁÊÌÕ, ÄÁÖÅ ÅÓÌÉ
	ÎÅ ÐÏÌÕÞÉÔ ÐÒÁ×Á <username>root</username> ÎÁ ÚÁÐÉÓØ.</para>

      <para>÷ÁÛÉ ÓËÒÉÐÔÙ ÂÅÚÏÐÁÓÎÏÓÔÉ ÄÏÌÖÎÙ ×ÓÅÇÄÁ ÐÒÏ×ÅÒÑÔØ É ÓÏÓÔÁ×ÌÑÔØ
	ÏÔÞÅÔ ÏÂ ÉÚÍÅÎÅÎÉÑÈ ÆÁÊÌÁ ÐÁÒÏÌÅÊ (ÏÂÒÁÔÉÔÅÓØ Ë ÒÁÚÄÅÌÕ <link
	linkend="security-integrity">ðÒÏ×ÅÒËÁ ÃÅÌÏÓÔÎÏÓÔÉ ÆÁÊÌÏ×</link>
	ÎÉÖÅ ÐÏ ÔÅËÓÔÕ).</para>
    </sect2>

    <sect2>
      <title>úÁÝÉÔÁ ÑÄÒÁ, raw ÕÓÔÒÏÊÓÔ× É ÆÁÊÌÏ×ÙÈ
	ÓÉÓÔÅÍ</title>

      <para>åÓÌÉ ÁÔÁËÕÀÝÉÊ ×ÚÌÏÍÁÅÔ <username>root</username>, ÏÎ ÓÍÏÖÅÔ
	ÓÄÅÌÁÔØ ÐÒÁËÔÉÞÅÓËÉ ×ÓÅ, ÎÏ ÅÓÔØ ÓÐÏÓÏÂÙ ÕÓÌÏÖÎÉÔØ ÅÇÏ ÚÁÄÁÞÕ.
	îÁÐÒÉÍÅÒ, × ÂÏÌØÛÉÎÓÔ×Å ÓÏ×ÒÅÍÅÎÎÙÈ ÑÄÅÒ ×ÓÔÒÏÅÎÏ ÕÓÔÒÏÊÓÔ×Ï
	ÐÅÒÅÈ×ÁÔÁ ÐÁËÅÔÏ×.  ÷ &os; ÏÎÏ ÎÁÚÙ×ÁÅÔÓÑ
	<devicename>bpf</devicename>.  îÁÒÕÛÉÔÅÌØ ÏÂÙÞÎÏ ÐÙÔÁÅÔÓÑ ÚÁÐÕÓÔÉÔØ
	ÐÅÒÅÈ×ÁÔ ÐÁËÅÔÏ× ÎÁ ×ÚÌÏÍÁÎÎÏÊ ÍÁÛÉÎÅ.  ÷Ù ÎÅ ÄÏÌÖÎÙ ÐÒÅÄÏÓÔÁ×ÌÑÔØ
	ÅÍÕ ÔÁËÏÊ ×ÏÚÍÏÖÎÏÓÔÉ, ÎÁ ÂÏÌØÛÉÎÓÔ×Å ÓÉÓÔÅÍ ÕÓÔÒÏÊÓÔ×Ï
	<devicename>bpf</devicename> ÎÅ ÄÏÌÖÎÏ ÂÙÔØ ×ÓÔÒÏÅÎÏ × ÑÄÒÏ.</para>

      <indexterm>
	<primary><command>sysctl</command></primary>
      </indexterm>
      <para>îÏ ÄÁÖÅ ÅÓÌÉ ×Ù ×ÙËÌÀÞÉÔÅ ÕÓÔÒÏÊÓÔ×Ï <devicename>bpf</devicename>,
	×ÓÅ ÅÝÅ ÏÓÔÁÀÔÓÑ ÐÒÏÂÌÅÍÙ, Ó×ÑÚÁÎÎÙÅ Ó ÕÓÔÒÏÊÓÔ×ÁÍÉ
	<filename>/dev/mem</filename> É
	<filename>/dev/kmem</filename>.
	îÁÒÕÛÉÔÅÌØ ×ÓÅ ÅÝÅ ÍÏÖÅÔ ÐÉÓÁÔØ ÎÁ ÄÉÓËÏ×ÙÅ raw ÕÓÔÒÏÊÓÔ×Á.
	åÓÔØ ÔÁËÖÅ ÄÒÕÇÁÑ ×ÏÚÍÏÖÎÏÓÔØ ÑÄÒÁ, ÚÁÇÒÕÚËÁ ÍÏÄÕÌÅÊ, &man.kldload.8;.
	áËÔÉ×ÎÙÊ ÎÁÒÕÛÉÔÅÌØ ÍÏÖÅÔ ÉÓÐÏÌØÚÏ×ÁÔØ KLD ÍÏÄÕÌØ ÄÌÑ ÕÓÔÁÎÏ×ËÉ
	ÓÏÂÓÔ×ÅÎÎÏÇÏ ÕÓÔÒÏÊÓÔ×Á <devicename>bpf</devicename> ÉÌÉ ÄÒÕÇÏÇÏ
	ÐÅÒÅÈ×ÁÔÙ×ÁÀÝÅÇÏ ÕÓÔÒÏÊÓÔ×Á ÎÁ ÒÁÂÏÔÁÀÝÅÅ ÑÄÒÏ.  äÌÑ ÒÅÛÅÎÉÑ ÜÔÉÈ
	ÐÒÏÂÌÅÍ ÚÁÐÕÓËÁÊÔÅ ÑÄÒÏ Ó ÂÏÌØÛÉÍ ÕÒÏ×ÎÅÍ ÂÅÚÏÐÁÓÎÏÓÔÉ, ËÁË ÍÉÎÉÍÕÍ 1.
	õÒÏ×ÅÎØ ÂÅÚÏÐÁÓÎÏÓÔÉ ÍÏÖÅÔ ÂÙÔØ ÕÓÔÁÎÏ×ÌÅÎ Ó ÐÏÍÏÝØÀ
	<command>sysctl</command> ÞÅÒÅÚ ÐÅÒÅÍÅÎÎÕÀ
	<varname>kern.securelevel</varname>.  ðÏÓÌÅ ÕÓÔÁÎÏ×ËÉ ÕÒÏ×ÎÑ
	ÂÅÚÏÐÁÓÎÏÓÔÉ × 1 ÄÏÓÔÕÐ ÎÁ ÚÁÐÉÓØ × raw ÕÓÔÒÏÊÓÔ×Á ÂÕÄÅÔ ÚÁÐÒÅÝÅÎÁ É
	ÐÏÌÎÏÓÔØÀ ÚÁÒÁÂÏÔÁÀÔ ÓÐÅÃÉÁÌØÎÙÅ ÆÌÁÇÉ <command>chflags</command>,
	ÔÁËÉÅ ËÁË <literal>schg</literal>.  õÂÅÄÉÔÅÓØ ÔÁËÖÅ, ÞÔÏ
	ÆÌÁÇ <literal>schg</literal> ÕÓÔÁÎÏ×ÌÅÎ ÎÁ ËÒÉÔÉÞÅÓËÉ ×ÁÖÎÙÈ
	ÚÁÇÒÕÚÏÞÎÙÈ ÉÓÐÏÌÎÑÅÍÙÈ ÆÁÊÌÁÈ, ËÁÔÁÌÏÇÁÈ É ÆÁÊÌÁÈ ÓËÒÉÐÔÏ× &mdash;
	ÎÁ ×ÓÅÍ, ÞÔÏ ÚÁÐÕÓËÁÅÔÓÑ ÄÏ ÕÓÔÁÎÏ×ËÅ ÕÒÏ×ÎÑ ÂÅÚÏÐÁÓÎÏÓÔÉ.
	üÔÏ ÔÒÅÂÕÅÔ ÂÏÌØÛÏÇÏ ÏÂßÅÍÁ ÒÁÂÏÔÙ, É ÏÂÎÏ×ÌÅÎÉÅ ÓÉÓÔÅÍÙ ÎÁ ÂÏÌÅÅ
	×ÙÓÏËÏÍ ÕÒÏ×ÎÅ ÂÅÚÏÐÁÓÎÏÓÔÉ ÍÏÖÅÔ ÓÔÁÔØ ÇÏÒÁÚÄÏ ÓÌÏÖÎÅÅ.  ÷Ù ÍÏÖÅÔÅ
	ÐÏÊÔÉ ÎÁ ËÏÍÐÒÏÍÉÓÓ É ÚÁÐÕÓËÁÔØ ÓÉÓÔÅÍÕ ÎÁ ×ÙÓÏËÏÍ ÕÒÏ×ÎÅ ÂÅÚÏÐÁÓÎÏÓÔÉ,
	ÎÏ ÎÅ ÕÓÔÁÎÁ×ÌÉ×ÁÔØ ÆÌÁÇ <literal>schg</literal> ÄÌÑ ËÁÖÄÏÇÏ
	ÓÕÝÅÓÔ×ÕÀÝÅÇÏ ÓÉÓÔÅÍÎÏÇÏ ÆÁÊÌÁ É ËÁÔÁÌÏÇÁ.  äÒÕÇÁÑ ×ÏÚÍÏÖÎÏÓÔØ
	ÓÏÓÔÏÉÔ × ÍÏÎÔÉÒÏ×ÁÎÉÉ <filename>/</filename> É
	<filename>/usr</filename> ÔÏÌØËÏ ÄÌÑ ÞÔÅÎÉÑ.  îÅÏÂÈÏÄÉÍÏ ÚÁÍÅÔÉÔØ,
	ÞÔÏ ÔÁËÉÅ ÐÒÁ×ÉÌÁ ÓÌÉÛËÏÍ ÖÅÓÔËÉÅ É ÍÏÇÕÔ ÐÏÍÅÛÁÔØ ÏÂÎÁÒÕÖÅÎÉÀ
	×ÔÏÒÖÅÎÉÑ.</para>
    </sect2>

    <sect2 id="security-integrity">
      <title>ðÒÏ×ÅÒËÁ ÃÅÌÏÓÔÎÏÓÔÉ ÆÁÊÌÏ×: ÉÓÐÏÌÎÑÅÍÙÅ, ËÏÎÆÉÇÕÒÁÃÉÏÎÎÙÅ ÆÁÊÌÙ
	É Ô.Ä.</title>

      <para>÷Ù ÍÏÖÅÔÅ ÚÁÝÉÝÁÔØ ÔÏÌØËÏ ÑÄÒÏ, ÆÁÊÌÙ ÎÁÓÔÒÏÊËÉ É ÕÐÒÁ×ÌÅÎÉÑ
	ÓÉÓÔÅÍÏÊ ÔÏÌØËÏ ÄÏ ÔÅÈ ÐÏÒ, ÐÏËÁ ÜÔÁ ÚÁÝÉÔÁ ÎÅ ×ÓÔÕÐÉÔ × ËÏÎÆÌÉËÔ
	Ó ÕÄÏÂÓÔ×ÏÍ ÒÁÂÏÔÙ × ÓÉÓÔÅÍÅ.  îÁÐÒÉÍÅÒ, ÉÓÐÏÌØÚÏ×ÁÎÉÅ
	<command>chflags</command> ÄÌÑ ÕÓÔÁÎÏ×ËÉ ÂÉÔÁ
	<literal>schg</literal> ÎÁ ÂÏÌØÛÉÎÓÔ×Ï ÆÁÊÌÏ× × <filename>/</filename>
	×ÅÒÏÑÔÎÏ ÍÏÖÅÔ ÔÏÌØËÏ ÎÁ×ÒÅÄÉÔØ, ÐÏÓËÏÌØËÕ ÈÏÔÑ É ÍÏÖÅÔ ÚÁÝÉÔÉÔØ
	ÆÁÊÌÙ, ÐÒÅÐÑÔÓÔ×ÕÅÔ ÏÂÎÁÒÕÖÅÎÉÀ.  ðÏÓÌÅÄÎÉÊ ÓÌÏÊ ÓÉÓÔÅÍÙ ÂÅÚÏÐÁÓÎÏÓÔÉ,
	×ÏÚÍÏÖÎÏ, ÎÁÉÂÏÌÅÅ ×ÁÖÎÙÊ &mdash; ÏÂÎÁÒÕÖÅÎÉÅ.  ïÓÔÁÌØÎÙÅ ÍÅÒÙ
	ÂÅÚÏÐÁÓÎÏÓÔÉ ÐÒÁËÔÉÞÅÓËÉ ÂÅÓÐÏÌÅÚÎÙ (ÉÌÉ, ÞÔÏ ÅÝÅ ÈÕÖÅ, ÍÏÇÕÔ ÄÁÔØ
	×ÁÍ ÌÏÖÎÏÅ ÏÝÕÝÅÎÉÅ ÂÅÚÏÐÁÓÎÏÓÔÉ) ÅÓÌÉ ×Ù ÎÅ ÏÂÎÁÒÕÖÉÔÅ ÐÏÔÅÎÃÉÁÌØÎÏÅ
	×ÔÏÒÖÅÎÉÅ.  ðÏÌÏ×ÉÎÁ ÆÕÎËÃÉÊ ÓÉÓÔÅÍÙ ÂÅÚÏÐÁÓÎÏÓÔÉ ÎÁÐÒÁ×ÌÅÎÁ ÎÁ
	ÚÁÍÅÄÌÅÎÉÅ ÁÔÁËÕÀÝÅÇÏ, Á ÎÅ ÎÁ ÅÇÏ ÏÓÔÁÎÏ×ËÕ, ÄÌÑ ÔÏÇÏ, ÞÔÏÂÙ ÄÁÔØ
	ÓÉÓÔÅÍÅ ÏÂÎÁÒÕÖÅÎÉÑ ×ÏÚÍÏÖÎÏÓÔØ ÐÏÊÍÁÔØ ÎÁÒÕÛÉÔÅÌÑ ÎÁ ÍÅÓÔÅ
	ÐÒÅÓÔÕÐÌÅÎÉÑ.</para>

      <para>ìÕÞÛÉÊ ÓÐÏÓÏ ÏÂÎÁÒÕÖÅÎÉÑ ×ÔÏÒÖÅÎÉÑ &mdash; ÏÔÓÌÅÖÉ×ÁÎÉÅ
	ÉÚÍÅÎÅÎÎÙÈ, ÏÔÓÕÔÓÔ×ÕÀÝÉÈ, ÉÌÉ ÎÅÏÖÉÄÁÎÎÏ ÐÏÑ×É×ÛÉÈÓÑ ÆÁÊÌÏ×.
	äÌÑ ÎÁÂÌÀÄÅÎÉÑ ÚÁ ÉÚÍÅÎÅÎÎÙÍÉ ÆÁÊÌÁÍÉ ÌÕÞÛÅ ×ÓÅÇÏ ÉÓÐÏÌØÚÏ×ÁÔØ
	ÄÒÕÇÕÀ (ÚÁÞÁÓÔÕÀ ÃÅÎÔÒÁÌÉÚÏ×ÁÎÎÕÀ) ÓÉÓÔÅÍÕ Ó ÏÇÒÁÎÉÞÅÎÎÙÍ
	ÄÏÓÔÕÐÏÍ.  äÏÂÁ×ÌÅÎÉÅ ÎÁÐÉÓÁÎÎÙÈ ×ÁÍÉ ÓËÒÉÐÔÏ× Ë ÜÔÏÊ ÄÏÐÏÌÎÉÔÅÌØÎÏ
	ÚÁÝÉÝÅÎÎÏÊ ÓÉÓÔÅÍÅ Ó ÏÇÒÁÎÉÞÅÎÎÙÍ ÄÏÓÔÕÐÏÍ ÄÅÌÁÅÔ ÅÅ ÐÒÁËÔÉÞÅÓËÉ
	ÎÅ×ÉÄÉÍÏÊ ÄÌÑ ÐÏÔÅÎÃÉÁÌØÎÙÈ ×ÚÌÏÍÝÉËÏ×, É ÜÔÏ ×ÁÖÎÏ.  ÷ ÃÅÌÑÈ
	ÄÏÓÔÉÖÅÎÉÑ ÍÁËÓÉÍÁÌØÎÏÇÏ ÜÆÆÅËÔÁ ×ÁÍ ÍÏÖÅÔ ÐÏÔÒÅÂÏ×ÁÔØÓÑ ÐÒÅÄÏÓÔÁ×ÉÔØ
	ÜÔÏÊ ÓÉÓÔÅÍÅ ÄÏÓÔÕÐ Ë ÄÒÕÇÉÍ ÍÁÛÉÎÁÍ × ÓÅÔÉ, ÏÂÙÞÎÏ Ó ÐÏÍÏÝØÀ
	NFS ÜËÓÐÏÒÔÁ ÔÏÌØËÏ ÄÌÑ ÞÔÅÎÉÑ ÉÌÉ ÓÇÅÎÅÒÉÒÏ×Á× ÐÁÒÙ ËÌÀÞÅÊ ssh
	ÄÌÑ ÄÏÓÔÕÐÁ Ë ÄÒÕÇÉÍ ÍÁÛÉÎÁÍ ÐÏ ssh.  ðÏÍÉÍÏ ÂÏÌØÛÏÇÏ ÏÂßÅÍÁ
	ÓÅÔÅ×ÏÇÏ ÔÒÁÆÉËÁ, NFS ÂÏÌÅÅ ÓËÒÙÔÙÊ ÍÅÔÏÄ &mdash; ÏÎ ÐÏÚ×ÏÌÑÅÔ
	ËÏÎÔÒÏÌÉÒÏ×ÁÔØ ÆÁÊÌÏ×ÙÅ ÓÉÓÔÅÍÙ ÎÁ ËÁÖÄÏÍ ËÌÉÅÎÔÓËÏÍ ËÏÍÐØÀÔÅÒÅ
	ÐÒÁËÔÉÞÅÓËÉ ÎÅÚÁÍÅÔÎÏ.  åÓÌÉ ×ÁÛ ÓÅÒ×ÅÒ Ó ÏÇÒÁÎÉÞÅÎÎÙÍ ÄÏÓÔÕÐÏÍ
	ÐÏÄËÌÀÞÅÎ Ë ËÌÉÅÎÔÓËÉÍ ËÏÍÐØÀÔÅÒÁÍ ÞÅÒÅÚ ËÏÍÍÕÔÁÔÏÒ, NFS ÍÅÔÏÄ
	ÜÔÏ ÚÁÞÁÓÔÕÀ ÌÕÞÛÉÊ ×ÙÂÏÒ.  ðÒÉ ÓÏÅÄÉÎÅÎÉÉ ÞÅÒÅÚ ËÏÎÃÅÎÔÒÁÔÏÒ, ÉÌÉ
	ÞÅÒÅÚ ÎÅÓËÏÌØËÏ ÍÁÒÛÒÕÔÉÚÁÔÏÒÏ×, NFS ÍÅÔÏÄ ÍÏÖÅÔ ÓÔÁÔØ ÓÌÉÛËÏÍ
	ÎÅÂÅÚÏÐÁÓÎÙÍ É ÉÓÐÏÌØÚÏ×ÁÎÉÅ ssh ÍÏÖÅÔ ÓÔÁÔØ ÌÕÞÛÉÍ ×ÙÂÏÒÏÍ ÄÁÖÅ
	ÎÅÓÍÏÔÒÑ ÎÁ ÔÏ, ÞÔÏ ssh ÏÓÔÁ×ÌÑÅÔ ÓÌÅÄÙ Ó×ÏÅÊ ÒÁÂÏÔÙ.</para>

      <para>ëÁË ÔÏÌØËÏ Õ ×ÁÓ ÐÏÑ×ÉÌÓÑ ÓÅÒ×ÅÒ Ó ÏÇÒÁÎÉÞÅÎÎÙÍ ÄÏÓÔÕÐÏÍ,
	É ËÁË ÍÉÎÉÍÕÍ ÄÏÓÔÕÐ ÎÁ ÞÔÅÎÉÅ × ËÌÉÅÎÔÓËÉÈ ÓÉÓÔÅÍÁÈ, ÐÏÔÒÅÂÕÅÔÓÑ
	ÎÁÐÉÓÁÔØ ÓËÒÉÐÔÙ ÄÌÑ ×ÙÐÏÌÎÅÎÉÑ ÍÏÎÉÔÏÒÉÎÇÁ.  ðÒÉ ÎÁÌÉÞÉÉ ÄÏÓÔÕÐÁ
	ÐÏ NFS ×Ù ÍÏÖÅÔÅ ÎÁÐÉÓÁÔØ ÓËÒÉÐÔÙ Ó ÐÏÍÏÝØÀ ÐÒÏÓÔÙÈ ÓÉÓÔÅÍÎÙÈ ÕÔÉÌÉÔ,
	ÔÁËÉÈ ËÁË &man.find.1; É &man.md5.1;.  ìÕÞÛÅ ×ÓÅÇÏ ÐÏÄÓÞÉÔÙ×ÁÔØ
	md5 ÆÁÊÌÏ× ÎÁ ËÌÉÅÎÔÓËÏÍ ËÏÍÐØÀÔÅÒÅ ËÁË ÍÉÎÉÍÕÍ ÏÄÉÎ ÒÁÚ × ÄÅÎØ,
	Á ÆÁÊÌÙ, ËÏÎÔÒÏÌÉÒÕÀÝÉÅ ÚÁÐÕÓË ÉÚ <filename>/etc</filename> É
	<filename>/usr/local/etc</filename> ÄÁÖÅ ÂÏÌÅÅ ÞÁÓÔÏ.  ðÒÉ
	ÏÂÎÁÒÕÖÅÎÉÉ ÒÁÓÈÏÖÄÅÎÉÊ × md5, ËÏÎÔÒÏÌÉÒÕÀÝÉÊ ËÏÍÐØÀÔÅÒ ÄÏÌÖÅÎ
	ÐÒÏÓÉÇÎÁÌÉÔØ ÓÉÓÔÅÍÎÏÍÕ ÁÄÍÉÎÉÓÔÒÁÔÏÒÕ ÐÒÏ×ÅÒÉÔØ ÉÚÍÅÎÉ×ÛÉÅÓÑ
	ÆÁÊÌÙ.  èÏÒÏÛÉÊ ÓËÒÉÐÔ ÂÅÚÏÐÁÓÎÏÓÔÉ ÐÒÏ×ÅÒÉÔ ÔÁËÖÅ ÎÁÌÉÞÉÅ
	ÎÅÓÏÏÔ×ÅÔÓÔ×ÕÀÝÉÈ ÉÓÐÏÌÎÑÅÍÙÈ suid ÆÁÊÌÏ× É ÎÏ×ÙÈ ÉÌÉ ÉÚÍÅÎÅÎÎÙÈ
	ÆÁÊÌÏ× × ÓÉÓÔÅÍÎÙÈ ÒÁÚÄÅÌÁÈ <filename>/</filename> É
	<filename>/usr</filename>.</para>

      <para>ðÒÉ ÉÓÐÏÌØÚÏ×ÁÎÉÉ ssh ×ÍÅÓÔÏ NFS, ÎÁÐÉÓÁÔØ ÓËÒÉÐÔÙ ÂÅÚÏÐÁÓÎÏÓÔÉ
	ÇÏÒÁÚÄÏ ÓÌÏÖÎÅÅ.  ÷ÁÍ ÏÂÑÚÁÔÅÌØÎÏ ÐÏÔÒÅÂÕÅÔÓÑ ÓËÏÐÉÒÏ×ÁÔØ
	(<command>scp</command>) ÓËÒÉÐÔÙ ÎÁ ËÌÉÅÎÔÓËÉÊ ËÏÍÐØÀÔÅÒ,
	ÓÄÅÌÁÔØ ÉÚ ÎÅ×ÉÄÉÍÙÍÉ, É ÄÌÑ ÂÅÚÏÐÁÓÎÏÓÔÉ ÐÏÔÒÅÂÕÅÔÓÑ ÔÁËÖÅ
	ÓËÏÐÉÒÏ×ÁÔØ ÉÓÐÏÌÎÑÅÍÙÅ ÆÁÊÌÙ (ÔÁËÉÅ ËÁË find), ËÏÔÏÒÙÅ ÂÕÄÕÔ
	ÉÓÐÏÌØÚÏ×ÁÔØÓÑ ÓËÒÉÐÔÏÍ.  ðÒÉÌÏÖÅÎÉÅ <application>ssh</application>
	ÎÁ ËÌÉÅÎÔÓËÏÍ ËÏÍÐØÀÔÅÒÅ ÍÏÖÅÔ ÂÙÔØ ÕÖÅ ×ÚÌÏÍÁÎÏ.  ÷ ËÏÎÅÞÎÏÍ ÉÔÏÇÅ,
	ÂÅÚ ssh ÎÅ ÏÂÏÊÔÉÓØ ÐÒÉ ÒÁÂÏÔÅ ÞÅÒÅÚ ÎÅÂÅÚÏÐÁÓÎÙÅ ÓÏÅÄÉÎÅÎÉÑ,
	ÎÏ ÅÇÏ ÇÏÒÁÚÄÏ ÓÌÏÖÎÅÅ ÉÓÐÏÌØÚÏ×ÁÔØ.</para>

      <para>èÏÒÏÛÉÊ ÓËÒÉÐÔ ÂÅÚÏÐÁÓÎÏÓÔÉ ÐÒÏ×ÅÒÉÔ ÔÁËÖÅ ÉÚÍÅÎÅÎÉÑ × ÆÁÊÌÁÈ
	ÎÁÓÔÒÏÊËÉ, ÒÁÂÏÔÁÀÝÉÈ ÐÒÉ ÐÏÄËÌÀÞÅÎÉÉ ÐÏÌØÚÏ×ÁÔÅÌÅÊ É ÓÌÕÖÅÂÎÙÈ ÕÞ£ÔÎÙÈ
	ÚÁÐÉÓÅÊ:
	<filename>.rhosts</filename>, <filename>.shosts</filename>,
	<filename>.ssh/authorized_keys</filename> É ÔÁË ÄÁÌÅÅ&hellip;
	ÆÁÊÌÙ, ËÏÔÏÒÙÅ ÍÏÇÌÉ ÎÅ ÐÏÐÁÓÔØ × ÏÂÌÁÓÔØ ÐÒÏ×ÅÒËÉ
	<literal>MD5</literal>.</para>

      <para>åÓÌÉ ÄÌÑ ÐÏÌØÚÏ×ÁÔÅÌÅÊ ×ÙÄÅÌÅÎ ÂÏÌØÛÏÊ ÏÂßÅÍ ÄÉÓËÏ×ÏÇÏ
	ÐÒÏÓÔÒÁÎÓÔ×Á, ÐÒÏ×ÅÒËÁ ËÁÖÄÏÇÏ ÆÁÊÌÁ ÎÁ ÔÁËÉÈ ÒÁÚÄÅÌÁÈ ÍÏÖÅÔ ÚÁÎÑÔØ
	ÓÌÉÛËÏÍ ÍÎÏÇÏ ×ÒÅÍÅÎÉ.  ÷ ÔÁËÏÍ ÓÌÕÞÁÅ ÕÓÔÁÎÏ×ËÁ ÆÌÁÇÏ× ÍÏÎÔÉÒÏ×ÁÎÉÑ
	ÄÌÑ ÚÁÐÒÅÔÁ suid ÉÓÐÏÌÎÑÅÍÙÈ ÆÁÊÌÏ× É ÕÓÔÒÏÊÓÔ× ÎÁ ÔÁËÉÈ ÒÁÚÄÅÌÁÈ
	ÜÔÏ ÈÏÒÏÛÁÑ ÉÄÅÑ.  ðÒÉÍÅÎÉÔÅ ÐÁÒÁÍÅÔÒÙ &man.mount.8;
	<literal>nodev</literal> É <literal>nosuid</literal>.  ðÒÏ×ÅÒÑÊÔÅ
	ÜÔÉ ÒÁÚÄÅÌÙ × ÌÀÂÏÍ ÓÌÕÞÁÅ, ÈÏÔÑ ÂÙ ÒÁÚ × ÎÅÄÅÌÀ, ÐÏÓËÏÌØËÕ
	ÎÅÏÂÈÏÄÉÍÏ ÏÂÎÁÒÕÖÉ×ÁÔØ ÐÏÐÙÔËÉ ×ÚÌÏÍÁ, ÎÅÚÁ×ÉÓÉÍÏ ÏÔ ÔÏÇÏ,
	ÜÆÆÅËÔÉ×ÎÙ ÏÎÉ ÉÌÉ ÎÅÔ.</para>

      <para>õÞÅÔ ÐÒÏÃÅÓÓÏ× (&man.accton.8;) ÜÔÏ ÏÔÎÏÓÉÔÅÌØÎÏ ÎÅÓÌÏÖÎÁÑ
	×ÏÚÍÏÖÎÏÓÔØ ÏÐÅÒÁÃÉÏÎÎÏÊ ÓÉÓÔÅÍÙ, ËÏÔÏÒÁÑ ÍÏÖÅÔ ÐÏÍÏÞØ
	ËÁË ÍÅÈÁÎÉÚÍ ÏÂÎÁÒÕÖÅÎÉÑ ÓÏÓÔÏÑ×ÛÉÈÓÑ ×ÔÏÒÖÅÎÉÊ.  ïÎÁ ÏÓÏÂÅÎÎÏ
	ÐÏÌÅÚÎÁ ÄÌÑ ÏÂÎÁÒÕÖÅÎÉÑ ÐÕÔÉ ÐÒÏÎÉËÎÏ×ÅÎÉÑ ÎÁÒÕÛÉÔÅÌÑ × ÓÉÓÔÅÍÕ,
	ÅÓÌÉ ÆÁÊÌ ÎÅ ÂÙÌ ÚÁÔÒÏÎÕÔ ÐÒÏÎÉËÎÏ×ÅÎÉÅÍ.</para>

      <para>îÁËÏÎÅÃ, ÓËÒÉÐÔÙ ÂÅÚÏÐÁÓÎÏÓÔÉ ÄÏÌÖÎÙ ÏÂÒÁÂÏÔÁÔØ ÌÏÇ ÆÁÊÌÙ,
	ËÏÔÏÒÙÅ ÎÅÏÂÈÏÄÉÍÏ ÓÏÚÄÁ×ÁÔØ ÎÁÓÔÏÌØËÏ ÚÁÝÉÝÅÎÎÙÍ ÓÐÏÓÏÂÏÍ, ÎÁÓËÏÌØËÏ
	ÜÔÏ ×ÏÚÍÏÖÎÏ &mdash; ÐÏÄËÌÀÞÅÎÉÅ syslog ÕÄÁÌÅÎÎÏ ÍÏÖÅÔ ÂÙÔØ ÏÞÅÎØ
	ÐÏÌÅÚÎÙÍ.  úÌÏÕÍÙÛÌÅÎÎÉË ÐÏÐÙÔÁÅÔÓÑ ÕÎÉÞÔÏÖÉÔØ ÓÌÅÄÙ ×ÚÌÏÍÁ,
	É ÌÏÇ ÆÁÊÌÙ ËÒÉÔÉÞÅÓËÉ ×ÁÖÎÙ ÄÌÑ ÓÉÓÔÅÍÎÏÇÏ ÁÄÍÉÎÉÓÔÒÁÔÏÒÁ,
	ÐÙÔÁÀÝÅÇÏÓÑ ÏÔÓÌÅÄÉÔØ ×ÒÅÍÑ É ÍÅÔÏÄ ÐÅÒ×ÏÇÏ ÐÒÏÎÉËÎÏ×ÅÎÉÑ.
	ïÄÉÎ ÉÚ ÎÁÄÅÖÎÙÈ ÓÐÏÓÏÂÏ× ÐÏÌÕÞÅÎÉÑ ÌÏÇ ÆÁÊÌÏ× Ñ×ÌÑÅÔÓÑ ÐÏÄËÌÀÞÅÎÉÅ
	ÓÉÓÔÅÍÎÏÊ ËÏÎÓÏÌÉ Ë ÐÏÓÌÅÄÏ×ÁÔÅÌØÎÏÍÕ ÐÏÒÔÕ É ÐÏÓÔÏÑÎÎÙÊ
	ÓÂÏÒ ÉÎÆÏÒÍÁÃÉÉ ÞÅÒÅÚ ÚÁÝÉÝÅÎÎÕÀ ÍÁÛÉÎÕ, ÏÔÓÌÅÖÉ×ÁÀÝÕÀ
	ËÏÎÓÏÌÉ.</para>
    </sect2>

    <sect2>
      <title>ðÁÒÁÎÏÊÑ</title>

      <para>îÅÍÎÏÇÏ ÐÁÒÁÎÏÊÉ ÎÉËÏÇÄÁ ÎÅ ÐÏ×ÒÅÄÉÔ.  ëÁË ÐÒÁ×ÉÌÏ, ÓÉÓÔÅÍÎÙÊ
	ÁÄÍÉÎÉÓÔÒÁÔÏÒ ÍÏÖÅÔ ÄÏÂÁ×ÌÑÔØ ÜÌÅÍÅÎÔÙ ÂÅÚÏÐÁÓÎÏÓÔÉ × ÌÀÂÏÍ
	ËÏÌÉÞÅÓÔ×Å, ÐÏËÁ ÜÔÏ ÎÅ ×ÌÉÑÅÔ ÎÁ ÕÄÏÂÓÔ×Ï, Á ÔÁËÖÅ ÎÅËÏÔÏÒÏÅ
	ËÏÌÉÞÅÓÔ×Ï ÜÌÅÍÅÎÔÏ× ÂÅÚÏÐÁÓÎÏÓÔÉ, <emphasis>×ÌÉÑÀÝÉÈ</emphasis>
	ÎÁ ÕÄÏÂÓÔ×Ï.  þÔÏ ÄÁÖÅ ÂÏÌÅÅ ×ÁÖÎÏ, ÓÉÓÔÅÍÎÙÊ ÁÄÍÉÎÉÓÔÒÁÔÏÒ ÄÏÌÖÅÎ
	ÎÅÍÎÏÇÏ ÉÚÍÅÎÉÔØ ÉÈ &mdash; ÅÓÌÉ ×Ù ÉÓÐÏÌØÚÕÅÔÅ ÒÅËÏÍÅÎÄÁÃÉÉ, ÎÁÐÒÉÍÅÒ
	ÔÅ, ÞÔÏ ÄÁÎÙ × ÜÔÏÍ ÄÏËÕÍÅÎÔÅ, ÏÎÉ ÓÔÁÎÏ×ÑÔÓÑ ÉÚ×ÅÓÔÎÙ ÁÔÁËÕÀÝÅÍÕ,
	ËÏÔÏÒÙÊ ÔÁËÖÅ ÉÍÅÅÔ ÄÏÓÔÕÐ Ë ÜÔÏÍÕ ÄÏËÕÍÅÎÔÕ.</para>
    </sect2>

    <sect2>
      <title>áÔÁËÉ DoS</title>
      <indexterm><primary>ïÔËÁÚ × ÏÂÓÌÕÖÉ×ÁÎÉÉ (DoS)</primary></indexterm>

      <para>üÔÏÔ ÒÁÚÄÅÌ ÏÈ×ÁÔÙ×ÁÅÔ DoS ÁÔÁËÉ.  DoS ÁÔÁËÉ ÜÔÏ ÏÂÙÞÎÏ
	ÐÁËÅÔÎÙÅ ÁÔÁËÉ.  èÏÔÑ ÐÒÏÔÉ× ÓÏ×ÒÅÍÅÎÎÏÊ ÁÔÁËÉ Ó ÐÏÄÄÅÌËÏÊ ÐÁËÅÔÏ×,
	ËÏÔÏÒÁÑ ÐÅÒÅÇÒÕÖÁÅÔ ÓÅÔØ, ÍÁÌÏ ÞÔÏ ÍÏÖÎÏ ÓÄÅÌÁÔØ, ×Ù ÍÏÖÅÔÅ
	ÏÇÒÁÎÉÞÉÔØ ÐÏ×ÒÅÖÄÅÎÉÑ, ÕÂÅÄÉ×ÛÉÓØ, ÞÔÏ ÁÔÁËÁ ÎÅ ÍÏÖÅÔ
	ÏÂÒÕÛÉÔØ ×ÁÛÉ ÓÅÒ×ÅÒÁ.</para>

      <orderedlist>
	<listitem>
	  <para>ïÇÒÁÎÉÞÅÎÉÅ ËÏÌÉÞÅÓÔ×Á ÐÏÒÏÖÄÁÅÍÙÈ ÐÒÏÃÅÓÓÏ×.</para>
	</listitem>

	<listitem>
	  <para>õÍÅÎØÛÅÎÉÅ ÐÏÓÌÅÄÓÔ×ÉÊ springboard ÁÔÁË (ICMP ÏÔ×ÅÔ,
	    ÛÉÒÏËÏ×ÅÝÁÔÅÌØÎÙÊ ping É Ô.Ä.).</para>
	</listitem>

	<listitem>
	  <para>ëÜÛ ÍÁÒÛÒÕÔÉÚÁÃÉÉ ÑÄÒÁ.</para>
	</listitem>
      </orderedlist>

      <para>ïÂÙÞÎÁÑ DoS ÁÔÁËÁ ÐÒÏÔÉ× ÐÏÒÏÖÄÁÀÝÅÇÏ ÐÒÏÃÅÓÓÙ ÓÅÒ×ÅÒÁ ÐÙÔÁÅÔÓÑ
	ÉÓÞÅÒÐÁÔØ ÒÅÓÕÒÓÙ ÓÅÒ×ÅÒÁ ÐÏ ÐÒÏÃÅÓÓÁÍ, ÆÁÊÌÏ×ÙÍ ÄÅÓËÒÉÐÔÏÒÁÍ É
	ÐÁÍÑÔÉ ÄÏ ÔÅÈ ÐÏÒ, ÐÏËÁ ÍÁÛÉÎÁ ÎÅ <quote>ÐÏ×ÉÓÎÅÔ</quote>.  õ
	<application>inetd</application> (ÏÂÒÁÔÉÔÅÓØ Ë &man.inetd.8;)
	ÅÓÔØ ÎÅÓËÏÌØËÏ ÐÁÒÁÍÅÔÒÏ×, ÐÏÚ×ÏÌÑÀÝÉÈ ÏÇÒÁÎÉÞÉÔØ ÔÁËÉÅ ÁÔÁËÉ.
	îÅÏÂÈÏÄÉÍÏ ÕÞÅÓÔØ, ÞÔÏ ÈÏÔÑ ÍÏÖÎÏ ÐÒÅÄÏÔ×ÒÁÔÉÔØ ÐÁÄÅÎÉÅ ÓÉÓÔÅÍÙ, ×
	ÏÂÝÅÍ ÓÌÕÞÁÅ ÎÅ×ÏÚÍÏÖÎÏ ÐÒÅÄÏÔ×ÒÁÔÉÔØ ÐÒÅËÒÁÝÅÎÉÅ ÒÁÂÏÔÙ ÓÅÒ×ÉÓÁ.
	÷ÎÉÍÁÔÅÌØÎÏ ÐÒÏÞÔÉÔÅ ÓÔÒÁÎÉÃÕ ÓÐÒÁ×ÏÞÎÉËÁ É ÏÂÒÁÔÉÔÅ ÏÓÏÂÏÅ ×ÎÉÍÁÎÉÅ
	ÎÁ ÐÁÒÁÍÅÔÒÙ <option>-c</option>, <option>-C</option>, É
	<option>-R</option>.  õÞÔÉÔÅ, ÞÔÏ ÐÁÒÁÍÅÔÒ <option>-C</option> ÎÅ
	ÒÁÂÏÔÁÅÔ × ÓÌÕÞÁÅ ÁÔÁË Ó ÉÓÐÏÌØÚÏ×ÁÎÉÅÍ ÐÏÄÄÅÌØÎÙÈ IP ÐÁËÅÔÏ×,
	ÐÏÜÔÏÍÕ ËÁË ÐÒÁ×ÉÌÏ ÎÅÏÂÈÏÄÉÍÏ ÉÓÐÏÌØÚÏ×ÁÎÉÅ ËÏÍÂÉÎÁÃÉÉ ÐÁÒÁÍÅÔÒÏ×.
	îÅËÏÔÏÒÙÅ standalone ÓÅÒ×ÉÓÙ ÉÓÐÏÌØÚÕÀÔ ÓÏÂÓÔ×ÅÎÎÙÅ ÐÁÒÁÍÅÔÒÙ,
	ÏÇÒÁÎÉÞÉ×ÁÀÝÉÅ ÐÏÒÏÖÄÅÎÉÅ ÐÒÏÃÅÓÓÏ×.</para>

      <para>õ <application>Sendmail</application> ÅÓÔØ ÓÏÂÓÔ×ÅÎÎÙÊ ÐÁÒÁÍÅÔÒ
	<option>-OMaxDaemonChildren</option>, ËÏÔÏÒÁÑ ÒÁÂÏÔÁÅÔ ÇÏÒÁÚÄÏ ÌÕÞÛÅ,
	ÞÅÍ ÐÁÒÁÍÅÔÒ sendmail, ÏÇÒÁÎÉÞÉ×ÁÀÝÉÊ ÎÁÇÒÕÚËÕ. ÷ÁÍ ÎÅÏÂÈÏÄÉÍÏ ÚÁÄÁÔØ
	ÐÁÒÁÍÅÔÒ ÚÁÐÕÓËÁ <application>sendmail</application>
	<literal>MaxDaemonChildren</literal> ÄÏÓÔÁÔÏÞÎÏ ÂÏÌØÛÉÍ, ÞÔÏÂÙ
	ÏÂÓÌÕÖÉ×ÁÔØ ÏÖÉÄÁÅÍÕÀ ÎÁÇÒÕÚËÕ, ÎÏ ÔÁË, ÞÔÏÂÙ ËÏÍÐØÀÔÅÒ ÍÏÇ ÏÂÓÌÕÖÉÔØ
	ÔÁËÏÅ ËÏÌÉÞÅÓÔ×Ï ÐÒÉÌÏÖÅÎÉÊ <application>sendmail</application> ÂÅÚ
	ÐÁÄÅÎÉÑ ÓÉÓÔÅÍÙ.  èÏÒÏÛÅÊ ÍÅÒÏÊ Ñ×ÌÑÅÔÓÑ ÚÁÐÕÓË sendmail × ÒÅÖÉÍÅ
	ÏÞÅÒÅÄÉ (<option>-ODeliveryMode=queued</option>) É ÚÁÐÕÓË ÄÁÅÍÏÎÁ
	(<command>sendmail -bd</command>) ÏÔÄÅÌØÎÏ ÏÔ ÏÞÅÒÅÄÉ
	(<command>sendmail -q15m</command>).  åÓÌÉ ×Ù ×ÓÅ ÖÅ ÈÏÔÉÔÅ
	ÏÒÇÁÎÉÚÏ×ÁÔØ ÄÏÓÔÁ×ËÕ × ÒÅÖÉÍÅ ÒÅÁÌØÎÏÇÏ ×ÒÅÍÅÎÉ, ÚÁÐÕÓËÁÊÔÅ
	ÏÞÅÒÅÄØ Ó ÍÅÎØÛÉÍ ÉÎÔÅÒ×ÁÌÏÍ <option>-q1m</option>, ÎÏ ÕÂÅÄÉÔÅÓØ
	× ÐÒÁ×ÉÌØÎÏÊ ÕÓÔÁÎÏ×ËÅ ÐÁÒÁÍÅÔÒÁ sendmail
	<literal>MaxDaemonChildren</literal> ÄÌÑ ÐÒÅÄÏÔ×ÒÁÝÅÎÉÑ
	ÏÛÉÂÏË.</para>

      <para><application>Syslogd</application> ÍÏÖÅÔ ÂÙÔØ ÁÔÁËÏ×ÁÎ
	ÎÅÐÏÓÒÅÄÓÔ×ÅÎÎÏ, ÎÁÓÔÏÑÔÅÌØÎÏ ÒÅËÏÍÅÎÄÕÅÔÓÑ ÉÓÐÏÌØÚÏ×ÁÔØ ÐÁÒÁÍÅÔÒ
	<option>-s</option> ÅÓÌÉ ÜÔÏ ×ÏÚÍÏÖÎÏ É ÐÁÒÁÍÅÔÒ <option>-a</option>
	× ÏÓÔÁÌØÎÙÈ ÓÌÕÞÁÑÈ.</para>

      <para>÷Ù ÔÁËÖÅ ÄÏÌÖÎÙ ÂÙÔØ ÏÞÅÎØ ÏÓÔÏÒÏÖÎÙ Ó ÓÅÒ×ÉÓÁÍÉ, ÓÏ×ÅÒÛÁÀÝÉÍÉ
	ÏÂÒÁÔÎÏÅ ÐÏÄËÌÀÞÅÎÉÅ, ÎÁÐÒÉÍÅÒ, Ó <application>TCP
	Wrapper</application> É ÅÇÏ ÏÂÒÁÔÎÙÍ identd-ÚÁÐÒÏÓÏÍ, ËÏÔÏÒÙÊ ÍÏÖÅÔ
	ÂÙÔØ ÁÔÁËÏ×ÁÎ ÎÁÐÒÑÍÕÀ.  ðÏ ÜÔÏÊ ÐÒÉÞÉÎÅ ×ÏÚÍÏÖÎÏÓÔØ <application>TCP
	Wrapper</application> ÇÅÎÅÒÉÒÏ×ÁÔØ ÏÂÒÁÔÎÙÊ ident ÏÂÙÞÎÏ ÎÅ ÓÌÅÄÕÅÔ
	ÉÓÐÏÌØÚÏ×ÁÔØ.</para>

      <para>ðÒÁ×ÉÌØÎÙÍ ÂÕÄÅÔ ÚÁÐÒÅÔ ÄÏÓÔÕÐÁ Ë ×ÎÕÔÒÅÎÎÉÍ ÓÅÒ×ÉÓÁÍ ÉÚ ×ÎÅÛÎÅÊ
	ÓÅÔÉ ÐÕÔÅÍ ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÅÊ ÎÁÓÔÒÏÊËÉ ÂÒÁÎÄÍÁÕÜÒÁ ÎÁ ×ÎÅÛÎÅÍ
	ÍÁÒÛÒÕÔÉÚÁÔÏÒÅ.  éÄÅÑ × ÔÏÍ, ÞÔÏÂÙ ÐÒÅÄÏÔ×ÒÁÔÉÔØ ÐÅÒÅÇÒÕÚËÕ ÓÅÒ×ÉÓÏ×
	ÁÔÁËÁÍÉ ÉÚ ×ÎÅÛÎÅÊ ÓÅÔÉ, Á ËÒÏÍÅ ÔÏÇÏ ÚÁÝÉÔÉÔØ
	<username>root</username> ÏÔ ×ÚÌÏÍÁ ÞÅÒÅÚ ÓÅÔØ.  ÷ÓÅÇÄÁ ÎÁÓÔÒÁÉ×ÁÊÔÅ
	ÉÓËÌÀÞÁÀÝÉÊ ÂÒÁÎÄÍÁÕÜÒ, Ô.Å. <quote>ÚÁËÒÙÔØ ×ÓÅ
	<emphasis>ËÒÏÍÅ</emphasis> ÐÏÒÔÏ× A, B, C, D, É M-Z</quote>.
	üÔÉÍ ÓÐÏÓÏÂÏÍ ×Ù ÍÏÖÅÔÅ ÚÁËÒÙÔØ ×ÓÅ ÐÏÒÔÙ ÎÉÖÎÅÇÏ ÄÉÁÐÁÚÏÎÁ,
	ËÒÏÍÅ Ñ×ÎÏ ÕËÁÚÁÎÎÙÈ, ÔÁËÉÈ ËÁË <application>named</application>
	(ÅÓÌÉ ×Ù ÐÏÄÄÅÒÖÉ×ÁÅÔÅ ÉÎÔÅÒÎÅÔ-ÚÏÎÕ),
	<application>ntalkd</application>,
	<application>sendmail</application>, É ÄÒÕÇÉÈ ÓÅÒ×ÉÓÏ×, ÄÏÓÔÕÐÎÙÈ
	ÉÚ ÉÎÔÅÒÎÅÔ.  åÓÌÉ ×Ù ÐÏÐÒÏÂÕÅÔÅ ÎÁÓÔÒÏÉÔØ ÂÒÁÎÄÍÁÕÜÒ ÄÒÕÇÉÍ
	ÓÐÏÓÏÂÏÍ &mdash; ×ËÌÀÞÁÀÝÉÊ, ÉÌÉ ÒÁÚÒÅÛÁÀÝÉÊ ÂÒÁÎÄÍÁÕÜÒ, ÅÓÔØ
	ÂÏÌØÛÏÊ ÛÁÎÓ ÚÁÂÙÔØ <quote>ÚÁËÒÙÔØ</quote> ÐÁÒÕ ÓÅÒ×ÉÓÏ×, ÉÌÉ
	ÄÏÂÁ×ÉÔØ ÎÏ×ÙÊ ×ÎÕÔÒÉÓÅÔÅ×ÏÊ ÓÅÒ×ÉÓ É ÚÁÂÙÔØ ÏÂÎÏ×ÉÔØ ÂÒÁÎÄÍÁÕÜÒ.
	÷Ù ÍÏÖÅÔÅ ÏÔËÒÙÔØ ÄÉÁÐÁÚÏÎ ÐÏÒÔÏ× Ó ÂÏÌØÛÉÍÉ ÎÏÍÅÒÁÍÉ
	ÄÌÑ ÏÂÙÞÎÙÈ ÐÒÉÌÏÖÅÎÉÊ ÂÅÚ ÕÇÒÏÚÙ ÐÏÒÔÁÍ ÎÉÖÎÅÇÏ ÄÉÁÐÁÚÏÎÁ.
	õÞÔÉÔÅ ÔÁËÖÅ, ÞÔÏ &os; ÐÏÚ×ÏÌÑÅÔ ×ÁÍ ËÏÎÔÒÏÌÉÒÏ×ÁÔØ ÄÉÁÐÁÚÏÎÙ
	ÐÏÒÔÏ×, ÉÓÐÏÌØÚÕÅÍÙÅ ÄÌÑ ÄÉÎÁÍÉÞÅÓËÏÊ ÐÒÉ×ÑÚËÉ ÞÅÒÅÚ ÒÁÚÌÉÞÎÙÅ
	ÐÅÒÅÍÅÎÎÙÅ <command>sysctl</command>
	<varname>net.inet.ip.portrange</varname> (<command>sysctl -a | fgrep
	portrange</command>), ÞÔÏ ÐÏÚ×ÏÌÑÅÔ ÕÐÒÏÓÔÉÔØ ÎÁÓÔÒÏÊËÕ
	ÂÒÁÎÄÍÁÕÜÒÁ.  îÁÐÒÉÍÅÒ, ×Ù ÍÏÖÅÔÅ ÉÓÐÏÌØÚÏ×ÁÔØ ÏÂÙÞÎÙÊ
	ÄÉÁÐÁÚÏÎ ÐÏÒÔÏ× ÓÏ ÚÎÁÞÅÎÉÑÍÉ ÏÔ 4000 ÄÏ 5000, É ÄÉÁÐÁÚÏÎ ÐÏÒÔÏ× Ó
	ÂÏÌØÛÉÍÉ ÎÏÍÅÒÁÍÉ ÏÔ 49152 ÄÏ 65535, Á ÚÁÔÅÍ ÚÁÂÌÏËÉÒÏ×ÁÔØ ×ÓÅ ÄÏ
	4000 ÐÏÒÔÁ (ËÏÎÅÞÎÏ ÏÓÔÁ×É× ÄÏÓÔÕÐ ÉÚ ÉÎÔÅÒÎÅÔ Ë ÏÐÒÅÄÅÌÅÎÎÙÍ
	ÐÏÒÔÁÍ.</para>

      <para>äÒÕÇÏÊ ÒÁÓÐÒÏÓÔÒÁÎÅÎÎÙÊ ÔÉÐ DoS ÁÔÁË ÎÁÚÙ×ÁÅÔÓÑ springboard
	&mdash; ÓÅÒ×ÅÒ ÁÔÁËÕÅÔÓÑ ÔÁËÉÍ ÏÂÒÁÚÏÍ, ÞÔÏ ÇÅÎÅÒÉÒÕÅÍÙÅ ÏÔ×ÅÔÙ
	ÐÅÒÅÇÒÕÖÁÀÔ ÅÇÏ, ÌÏËÁÌØÎÕÀ ÓÅÔØ ÉÌÉ ËÁËÉÅ-ÔÏ ÄÒÕÇÉÅ ËÏÍÐØÀÔÅÒÙ.
	îÁÉÂÏÌÅÅ ÒÁÓÐÒÏÓÔÒÁÎÅÎÎÁÑ ÁÔÁËÁ ÜÔÏÇÏ ×ÉÄÁ ÜÔÏ
	<emphasis>ÛÉÒÏËÏ×ÅÝÁÔÅÌØÎÁÑ ICMP ping ÁÔÁËÁ</emphasis>.
	áÔÁËÕÀÝÉÊ ÐÏÄÄÅÌÙ×ÁÅÔ ÐÁËÅÔÙ ping, ÐÏÄÓÔÁ×ÌÑÑ IP ÁÄÒÅÓ ÍÁÛÉÎÙ, ËÏÔÏÒÕÀ
	ÏÎ ÎÁÍÅÒÅ×ÁÅÔÓÑ ÁÔÁËÏ×ÁÔØ, É ÏÔÐÒÁ×ÌÑÅÔ ÉÈ ÎÁ ÛÉÒÏËÏ×ÅÝÁÔÅÌØÎÙÊ
	ÁÄÒÅÓ ×ÁÛÅÊ ÌÏËÁÌØÎÏÊ ÓÅÔÉ.  åÓÌÉ ×ÁÛ ×ÎÅÛÎÉÊ ÍÁÒÛÒÕÔÉÚÁÔÏÒ ÎÅ
	ÎÁÓÔÒÏÅÎ ÎÁ ÏÔÂÒÁÓÙ×ÁÎÉÅ ÐÁËÅÔÏ× ping ÎÁ ÛÉÒÏËÏ×ÅÝÁÔÅÌØÎÙÅ ÁÄÒÅÓÁ,
	×ÁÛÁ ÓÅÔØ ÎÁÞÉÎÁÅÔ ÇÅÎÅÒÉÒÏ×ÁÔØ ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÉÅ ÏÔ×ÅÔÙ ÎÁ
	ÐÏÄÄÅÌØÎÙÊ ÁÄÒÅÓ, ÞÔÏ ÐÒÉ×ÏÄÉÔ Ë ÐÅÒÅÇÒÕÚËÅ ÈÏÓÔÁ-ÖÅÒÔ×Ù, ÏÓÏÂÅÎÎÏ
	ÅÓÌÉ ÁÔÁËÕÀÝÉÊ ÉÓÐÏÌØÚÕÅÔ ÜÔÏÔ ÖÅ ÔÒÀË Ó ÍÎÏÖÅÓÔ×ÏÍ
	ÛÉÒÏËÏ×ÅÝÁÔÅÌØÎÙÈ ÁÄÒÅÓÏ× × ÍÎÏÖÅÓÔ×Å ÓÅÔÅÊ ÏÄÎÏ×ÒÅÍÅÎÎÏ.
	âÙÌÉ ÚÁÒÅÇÉÓÔÒÉÒÏ×ÁÎÙ ÛÉÒÏËÏ×ÅÝÁÔÅÌØÎÙÅ ÁÔÁËÉ Ó×ÙÛÅ ÓÔÁ Ä×ÁÄÃÁÔÉ
	ÍÅÇÁÂÉÔ.  äÒÕÇÁÑ ÒÁÓÐÒÏÓÔÒÁÎÅÎÎÁÑ springboard ÁÔÁËÁ ÎÁÐÒÁ×ÌÅÎÁ ÎÁ
	ICMP ÓÉÓÔÅÍÕ ÓÏÏÂÝÅÎÉÑ Ï ÏÛÉÂËÁÈ.  ëÏÎÓÔÒÕÉÒÕÑ ÐÁËÅÔÙ, ×ÙÚÙ×ÁÀÝÉÅ
	ICMP ÓÏÏÂÝÅÎÉÑ Ï ÏÛÉÂËÁÈ, ÁÔÁËÕÀÝÉÊ ÍÏÖÅÔ ÎÁÇÒÕÚÉÔØ ×ÈÏÄÑÝÅÅ
	ÓÏÅÄÉÎÅÎÉÅ ÓÅÒ×ÅÒÁ É ×ÙÎÕÄÉÔØ ÓÅÒ×ÅÒ ÎÁÇÒÕÚÉÔØ ÉÓÈÏÄÑÝÅÅ ÓÏÅÄÉÎÅÎÉÅ
	ICMP ÏÔ×ÅÔÁÍÉ.  üÔÏÔ ÔÉÐ ÁÔÁËÉ ÍÏÖÅÔ ÔÁËÖÅ ÏÂÒÕÛÉÔØ ÓÅÒ×ÅÒ, ËÏÇÄÁ
	ÔÏÔ ÉÓÞÅÒÐÁÅÔ mbuf, ÏÂÙÞÎÏ ÅÓÌÉ ÓÅÒ×ÅÒ ÎÅ ÍÏÖÅÔ ÏÇÒÁÎÉÞÉÔØ ÞÉÓÌÏ
	ÏÔ×ÅÔÏ× ICMP, ËÏÇÄÁ ÏÎÉ ÇÅÎÅÒÉÒÕÀÔÓÑ ÓÌÉÛËÏÍ ÂÙÓÔÒÏ.
	éÓÐÏÌØÚÕÊÔÅ ÐÅÒÅÍÅÎÎÕÀ <application>sysctl</application>
	<literal>net.inet.icmp.icmplim</literal>.  ðÏÓÌÅÄÎÉÊ
	ÏÓÎÏ×ÎÏÊ ËÌÁÓÓ springboard ÁÔÁË ÏÔÎÏÓÉÔÓÑ Ë ÏÐÒÅÄÅÌÅÎÎÙÍ
	×ÎÕÔÒÅÎÎÉÍ ÓÅÒ×ÉÓÁÍ <application>inetd</application>, ÔÁËÉÍ ËÁË
	ÓÅÒ×ÉÓ udp echo.  áÔÁËÕÀÝÉÊ ÐÒÏÓÔÏ ÐÏÄÄÅÌÙ×ÁÅÔ ÁÄÒÅÓ ÉÓÔÏÞÎÉËÁ
	É ÁÄÒÅÓ ÎÁÚÎÁÞÅÎÉÑ UDP ÐÁËÅÔÏ×, ÕÓÔÁÎÁ×ÌÉ×ÁÑ × ÉÈ ËÁÞÅÓÔ×Å
	ÓÏÏÔ×ÅÔÓÔ×ÅÎÎÏ echo ÐÏÒÔ ÓÅÒ×ÅÒÁ A É B, ÏÂÁ ÜÔÉÈ ÓÅÒ×ÅÒÁ ÐÒÉÎÁÄÌÅÖÁÔ
	×ÁÛÅÊ ÌÏËÁÌØÎÏÊ ÓÅÔÉ.  üÔÉ Ä×Á ÓÅÒ×ÅÒÁ ÎÁÞÉÎÁÀÔ ÐÅÒÅÂÒÁÓÙ×ÁÔØÓÑ
	ÜÔÉÍ ÐÁËÅÔÏÍ ÄÒÕÇ Ó ÄÒÕÇÏÍ.  áÔÁËÕÀÝÉÊ ÍÏÖÅÔ ×ÙÚ×ÁÔØ ÐÅÒÅÇÒÕÚËÕ
	ÏÂÅÉÈ ÓÅÒ×ÅÒÏ× É ÉÈ ÓÅÔÅÊ, ÐÒÏÓÔÏ ÏÔÐÒÁ×É× ÎÅÓËÏÌØËÏ ÐÁËÅÔÏ× ÔÁËÉÍ
	ÓÐÏÓÏÂÏÍ.  áÎÁÌÏÇÉÞÎÙÅ ÐÒÏÂÌÅÍÙ ÓÕÝÅÓÔ×ÕÀÔ Ó ÐÏÒÔÏÍ
	<application>chargen</application>.  ëÏÍÐÅÔÅÎÔÎÙÊ ÓÉÓÔÅÍÎÙÊ
	ÁÄÍÉÎÉÓÔÒÁÔÏÒ ÄÏÌÖÅÎ ÏÔËÌÀÞÉÔØ ÜÔÉ ÔÅÓÔÏ×ÙÅ ÓÅÒ×ÉÓÙ inetd.</para>

      <para>áÔÁËÉ Ó ÐÏÄÄÅÌØÎÙÍÉ ÐÁËÅÔÁÍÉ ÍÏÇÕÔ ÔÁËÖÅ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ ÄÌÑ
	ÐÅÒÅÐÏÌÎÅÎÉÑ ËÜÛÁ ÍÁÒÛÒÕÔÉÚÁÃÉÉ ÑÄÒÁ.  ïÂÒÁÔÉÔÅÓØ Ë ÐÁÒÁÍÅÔÒÁÍ
	<command>sysctl</command> <varname>net.inet.ip.rtexpire</varname>,
	<varname>rtminexpire</varname>, É <varname>rtmaxcache</varname>.
	áÔÁËÁ Ó ÐÏÄÄÅÌØÎÙÍÉ ÐÁËÅÔÁÍÉ, ÉÓÐÏÌØÚÕÀÝÁÑ ÐÒÏÉÚ×ÏÌØÎÙÊ IP ÁÄÒÅÓ
	ÉÓÔÏÞÎÉËÁ, ÚÁÓÔÁ×ÉÔ ÑÄÒÏ ÓÇÅÎÅÒÉÒÏ×ÁÔØ ×ÒÅÍÅÎÎÙÊ ËÜÛÉÒÏ×ÁÎÎÙÊ
	ÍÁÒÛÒÕÔ × ÔÁÂÌÉÃÅ ÍÁÒÛÒÕÔÉÚÁÃÉÉ, ËÏÔÏÒÙÊ ÍÏÖÎÏ Õ×ÉÄÅÔØ Ó ÐÏÍÏÝØÀ
	<command>netstat -rna | fgrep W3</command>.  üÔÉ ÍÁÒÛÒÕÔÙ ÏÂÙÞÎÏ
	ÕÄÁÌÑÀÔÓÑ ÞÅÒÅÚ 1600 ÓÅËÕÎÄ ÉÌÉ ÏËÏÌÏ ÔÏÇÏ.  åÓÌÉ ÑÄÒÏ ÏÐÒÅÄÅÌÉÔ,
	ÞÔÏ ËÜÛÉÒÏ×ÁÎÎÁÑ ÍÁÒÛÒÕÔÎÁÑ ÔÁÂÌÉÃÁ ÓÔÁÌÁ ÓÌÉÛËÏÍ ÂÏÌØÛÏÊ, ÏÎÏ
	ÄÉÎÁÍÉÞÅÓËÉ ÕÍÅÎØÛÉÔ <varname>rtexpire</varname>, ÎÏ ÎÉËÏÇÄÁ ÎÅ
	ÓÔÁÎÅÔ ÄÅÌÁÔØ ÅÇÏ ÍÅÎØÛÅ ÞÅÍ <varname>rtminexpire</varname>.
	ó ÜÔÉÍ Ó×ÑÚÁÎÙ Ä×Å ÐÒÏÂÌÅÍÙ:</para>

      <orderedlist>
	<listitem>
	  <para>ñÄÒÏ ÎÅ ÏÔÒÅÁÇÉÒÕÅÔ ÄÏÓÔÁÔÏÞÎÏ ÂÙÓÔÒÏ, ËÏÇÄÁ ÌÅÇËÏ ÎÁÇÒÕÖÅÎÎÙÊ
	    ÓÅÒ×ÅÒ ÂÕÄÅÔ ×ÎÅÚÁÐÎÏ ÁÔÁËÏ×ÁÎ.</para>
	</listitem>

	<listitem>
	  <para>úÎÁÞÅÎÉÅ <varname>rtminexpire</varname> ÎÅÄÏÓÔÁÔÏÞÎÏ ÍÁÌÏ
	    ÄÌÑ ÐÏÄÄÅÒÖËÉ ÒÁÂÏÔÏÓÐÏÓÏÂÎÏÓÔÉ × ÕÓÌÏ×ÉÑÈ ÐÒÏÄÏÌÖÉÔÅÌØÎÏÊ
	    ÁÔÁËÉ.</para>
	</listitem>
      </orderedlist>

      <para>åÓÌÉ ×ÁÛÉ ÓÅÒ×ÅÒÙ ÐÏÄËÌÀÞÅÎÙ Ë ÉÎÔÅÒÎÅÔ ÞÅÒÅÚ ÌÉÎÉÀ T3 ÉÌÉ
	ÂÏÌÅÅ ÂÙÓÔÒÕÀ, ÐÒÅÄÕÓÍÏÔÒÉÔÅÌØÎÏ ÂÕÄÅÔ ÉÚÍÅÎÉÔØ ÏÂÁ ÚÎÁÞÅÎÉÑ
	<varname>rtexpire</varname> É <varname>rtminexpire</varname>
	Ó ÐÏÍÏÝØÀ &man.sysctl.8;.  îÉËÏÇÄÁ ÎÅ ÕÓÔÁÎÁ×ÌÉ×ÁÊÔÅ ÎÉ ÏÄÉÎ ÉÚ ÜÔÉÈ
	ÐÁÒÁÍÅÔÒÏ× × ÎÕÌØ (ÅÓÌÉ ÔÏÌØËÏ ×Ù ÎÅ ÈÏÔÉÔÅ ÏÂÒÕÛÉÔØ ÓÉÓÔÅÍÕ).
	õÓÔÁÎÏ×ËÁ ÏÂÅÉÈ ÐÁÒÁÍÅÔÒÏ× × ÚÎÁÞÅÎÉÅ 2 ÓÅËÕÎÄÙ ÄÏÌÖÎÁ ÐÒÅÄÏÔ×ÒÁÔÉÔØ
	ÔÁÂÌÉÃÕ ÍÁÒÛÒÕÔÉÚÁÃÉÉ ÏÔ ÁÔÁË.</para>
    </sect2>

    <sect2>
      <title>ðÒÏÂÌÅÍÙ, Ó×ÑÚÁÎÎÙÅ Ó ÄÏÓÔÕÐÏÍ Ë Kerberos É SSH</title>
      <indexterm><primary><command>ssh</command></primary></indexterm>
      <indexterm><primary>KerberosIV</primary></indexterm>

      <para>ðÒÉ ÉÓÐÏÌØÚÏ×ÁÎÉÉ Kerberos É ssh ÎÅÏÂÈÏÄÉÍÏ ÕÞÅÓÔØ ÎÅÓËÏÌØËÏ
	×ÏÚÍÏÖÎÙÈ ÐÒÏÂÌÅÍ.  Kerberos V ÜÔÏ ÏÔÌÉÞÎÙÊ ÐÒÏÔÏËÏÌ
	ÁÕÔÅÎÔÉÆÉËÁÃÉÉ, ÎÏ × ÁÄÁÐÔÉÒÏ×ÁÎÎÙÈ Ë ÎÅÍÕ ÐÒÉÌÏÖÅÎÉÑÈ
	<application>telnet</application> É
	<application>rlogin</application> ÅÓÔØ ÎÅÓËÏÌØËÏ ÏÛÉÂÏË, ËÏÔÏÒÙÅ
	ÍÏÇÕÔ ÓÄÅÌÁÔØ ÉÈ ÎÅÐÒÉÇÏÄÎÙÍÉ Ë ÒÁÂÏÔÅ Ó ÂÉÎÁÒÎÙÍÉ ÐÏÔÏËÁÍÉ.
	ë ÔÏÍÕ ÖÅ, ÐÏ ÕÍÏÌÞÁÎÉÀ Kerberos ÎÅ ÛÉÆÒÕÅÔ ÓÅÓÓÉÀ, ÅÓÌÉ ×Ù ÎÅ
	ÉÓÐÏÌØÚÕÅÔÅ ÐÁÒÁÍÅÔÒ <option>-x</option>.
	<application>ssh</application> ÛÉÆÒÕÅÔ ×ÓÅ ÐÏ ÕÍÏÌÞÁÎÉÀ.

      <para>ssh ÒÁÂÏÔÁÅÔ ÏÞÅÎØ ÈÏÒÏÛÏ ×Ï ×ÓÅÈ ÓÉÔÕÁÃÉÑÈ, ÎÏ ÐÅÒÅÓÙÌÁÅÔ
	ËÌÀÞÉ ÐÏ ÕÍÏÌÞÁÎÉÀ.  üÔÏ ÏÚÎÁÞÁÅÔ, ÞÔÏ ÅÓÌÉ ×Ù ÒÁÂÏÔÁÅÔÅ Ó
	ÚÁÝÉÝÅÎÎÏÊ ÒÁÂÏÞÅÊ ÓÔÁÎÃÉÉ, ËÌÀÞÉ ÎÁ ËÏÔÏÒÏÊ ÄÁÀÔ ÄÏÓÔÕÐ Ë
	ÏÓÔÁÌØÎÏÊ ÓÅÔÉ, É ÚÁÈÏÄÉÔÅ ÐÏ ssh ÎÁ ÎÅÚÁÝÉÝÅÎÎÙÊ ËÏÍÐØÀÔÅÒ,
	ÜÔÉ ËÌÀÞÉ ÍÏÇÕÔ ÂÙÔØ ÉÓÐÏÌØÚÏ×ÁÎÙ ÄÌÑ ×ÚÌÏÍÁ.  áÔÁËÕÀÝÅÍÕ
	ÎÅ ÕÄÁÓÔÓÑ ÐÏÌÕÞÉÔØ ÓÁÍÉ ËÌÀÞÉ, ÎÏ ÐÏÓËÏÌØËÕ ssh ÏÔËÒÙ×ÁÅÔ ÐÏÒÔ
	×Ï ×ÒÅÍÑ ×ÈÏÄÁ × ÓÉÓÔÅÍÕ, ÔÏ ÅÓÌÉ ÎÁ ÎÅÚÁÝÉÝÅÎÎÏÊ ÍÁÛÉÎÅ
	×ÚÌÏÍÁÎ <username>root</username>, ÜÔÉ ËÌÀÞÉ ÍÏÇÕÔ ÂÙÔØ ÉÓÐÏÌØÚÏ×ÁÎÙ
	ÄÌÑ ÄÏÓÔÕÐÁ Ë ÄÒÕÇÉÍ ËÏÍÐØÀÔÅÒÁÍ, ÎÁ ËÏÔÏÒÙÈ ÏÎÉ ÄÅÊÓÔ×ÕÀÔ.</para>

      <para>íÙ ÒÅËÏÍÅÎÄÕÅÍ ÉÓÐÏÌØÚÏ×ÁÔØ ssh × ËÏÍÂÉÎÁÃÉÉ Ó Kerberos
	ÄÌÑ ÓÌÕÖÅÂÎÙÈ ÕÞ£ÔÎÙÈ ÚÁÐÉÓÅÊ ÅÓÌÉ ÜÔÏ ×ÏÚÍÏÖÎÏ.
	<application>ssh</application> ÍÏÖÅÔ ÂÙÔØ ÓÏÂÒÁÎ Ó ÐÏÄÄÅÒÖËÏÊ
	Kerberos.  üÔÏ ÕÍÅÎØÛÁÅÔ ÚÁ×ÉÓÉÍÏÓÔØ ÏÔ ÐÏÔÅÎÃÉÁÌØÎÏ ÐÏÄ×ÅÒÖÅÎÎÙÈ
	×ÚÌÏÍÕ ssh ËÌÀÞÅÊ, É × ÔÏ ÖÅ ×ÒÅÍÑ ÚÁÝÉÝÁÅÔ ÐÁÒÏÌÉ ÞÅÒÅÚ
	Kerberos.  ëÌÀÞÉ ssh ÄÏÌÖÎÙ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ ÔÏÌØËÏ ÄÌÑ ÒÁÂÏÔÙ
	ÓËÒÉÐÔÏ× ÎÁ ÚÁÝÉÝÅÎÎÙÈ ËÏÍÐØÀÔÅÒÁÈ (ÔÁÍ, ÇÄÅ Kerberos ÉÓÐÏÌØÚÏ×ÁÔØ
	ÎÅ ÐÏÌÕÞÉÔÓÑ).  íÙ ÔÁËÖÅ ÒÅËÏÍÅÎÄÕÅÍ ÉÌÉ ×ÙËÌÀÞÉÔØ ÐÅÒÅÄÁÞÕ ËÌÀÞÅÊ
	× ÎÁÓÔÒÏÊËÁÈ ssh, ÉÌÉ ÉÓÐÏÌØÚÏ×ÁÔØ ÐÁÒÁÍÅÔÒ
	<literal>from=IP/DOMAIN</literal>, ÐÏÄÄÅÒÖÉ×ÁÅÍÙÊ ssh × ÆÁÊÌÅ
	<filename>authorized_keys</filename>, ËÏÔÏÒÙÊ ÐÏÚ×ÏÌÑÅÔ ÉÓÐÏÌØÚÏ×ÁÔØ
	ËÌÀÞÉ ÔÏÌØËÏ Ó ÏÐÒÅÄÅÌÅÎÎÙÈ ËÏÍÐØÀÔÅÒÏ×.</para>
    </sect2>
  </sect1>

  <sect1 id="crypt">
    <sect1info>
      <authorgroup>
	<author>
	  <firstname>Bill</firstname>
	  <surname>Swingle</surname>
	  <contrib>þÁÓÔÉÞÎÏ ÐÅÒÅÐÉÓÁÌ É ÏÂÎÏ×ÉÌ </contrib>
	</author>
      </authorgroup>
      <!-- 21 Mar 2000 -->
    </sect1info>

    <title>DES, MD5, É ÛÉÆÒÏ×ÁÎÉÅ</title>
    <indexterm>
      <primary>ÂÅÚÏÐÁÓÎÏÓÔØ</primary>
      <secondary>ÛÉÆÒÏ×ÁÎÉÅ</secondary>
    </indexterm>

    <indexterm><primary>ÛÉÆÒÏ×ÁÎÉÅ</primary></indexterm>
    <indexterm><primary>DES</primary></indexterm>
    <indexterm><primary>MD5</primary></indexterm>

    <para>õ ËÁÖÄÏÇÏ ÐÏÌØÚÏ×ÁÔÅÌÑ &unix; ÓÉÓÔÅÍÙ ÅÓÔØ ÐÁÒÏÌØ, Ó×ÑÚÁÎÎÙÊ Ó ÅÇÏ
      ÕÞ£ÔÎÏÊ ÚÁÐÉÓØÀ.  ïÞÅ×ÉÄÎÏ, ÞÔÏ ÜÔÉ ÐÁÒÏÌÉ ÄÏÌÖÎÙ ÂÙÔØ ÉÚ×ÅÓÔÎÙ ÔÏÌØËÏ
      ÐÏÌØÚÏ×ÁÔÅÌÀ É ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÅÊ ÏÐÅÒÁÃÉÏÎÎÏÊ ÓÉÓÔÅÍÅ.  äÌÑ ÚÁÝÉÔÙ ÐÁÒÏÌÅÊ
      ÏÎÉ ÛÉÆÒÕÀÔÓÑ ÓÐÏÓÏÂÏÍ, ÉÚ×ÅÓÔÎÙÍ ËÁË <quote>ÏÄÎÏÓÔÏÒÏÎÎÉÊ ÈÜÛ</quote>,
      ÔÏ ÅÓÔØ ÉÈ ÍÏÖÎÏ ÌÅÇËÏ ÚÁÛÉÆÒÏ×ÁÔØ, ÎÏ ÎÅÌØÚÑ ÒÁÓÛÉÆÒÏ×ÁÔØ.  äÒÕÇÉÍÉ
      ÓÌÏ×ÁÍÉ, ÔÏ, ÞÔÏ ÍÙ ÓËÁÚÁÌÉ ÞÕÔØ ÒÁÎØÛÅ ÂÙÌÏ ÏÞÅ×ÉÄÎÏ, ÎÏ ÎÅ ÓÏ×ÓÅÍ
      ×ÅÒÎÏ: ÏÐÅÒÁÃÉÏÎÎÏÊ ÓÉÓÔÅÍÅ <emphasis>ÓÁÍ ÐÁÒÏÌØ</emphasis>
      ÎÅÉÚ×ÅÓÔÅÎ.  åÊ ÉÚ×ÅÓÔÅÎ ÔÏÌØËÏ ÐÁÒÏÌØ ×
      <emphasis>ÚÁÛÉÆÒÏ×ÁÎÎÏÊ</emphasis> ÆÏÒÍÅ.  åÄÉÎÓÔ×ÅÎÎÙÊ ÓÐÏÓÏ ÐÏÌÕÞÉÔØ
      <quote>ÏÂÙÞÎÙÊ</quote> ÐÁÒÏÌØ ÜÔÏ ÐÒÏÓÔÏÊ ÐÅÒÅÂÏÒ ×ÓÅÈ ×ÏÚÍÏÖÎÙÈ
      ÐÁÒÏÌÅÊ.</para>

    <para>ë ÓÏÖÁÌÅÎÉÀ, ÅÄÉÎÓÔ×ÅÎÎÙÊ ÓÐÏÓÏ ÛÉÆÒÏ×ÁÎÉÑ ÐÁÒÏÌÑ ÐÒÉ ÐÏÑ×ÌÅÎÉÉ
      &unix; ÂÙÌ ÏÓÎÏ×ÁÎ ÎÁ DES, Data Encryption Standard.  üÔÏ ÎÅ ÂÙÌÏ
      ÐÒÏÂÌÅÍÏÊ ÄÌÑ ÐÏÌØÚÏ×ÁÔÅÌÅÊ, ÖÉ×ÕÝÉÈ × óûá, ÎÏ ÐÏÓËÏÌØËÕ ÉÓÈÏÄÎÙÊ ËÏÄ
      DES ÎÅÌØÚÑ ÂÙÌÏ ÜËÓÐÏÒÔÉÒÏ×ÁÔØ ÉÚ óûá, &os; ÎÁÛÌÁ ÓÐÏÓÏ ÏÄÎÏ×ÒÅÍÅÎÎÏ
      ÎÅ ÎÁÒÕÛÁÔØ ÚÁËÏÎÏ× óûá É ÓÏÈÒÁÎÉÔØ ÓÏ×ÍÅÓÔÉÍÏÓÔØ ÓÏ ×ÓÅÍÉ ÄÒÕÇÉÍÉ
      ×ÁÒÉÁÎÔÁÍÉ &unix;, ÇÄÅ ×ÓÅ ÅÝÅ ÉÓÐÏÌØÚÏ×ÁÌÓÑ DES.</para>

    <para>òÅÛÅÎÉÅ ÂÙÌÏ × ÒÁÚÄÅÌÅÎÉÉ ÂÉÂÌÉÏÔÅË ÛÉÆÒÏ×ÁÎÉÑ, ÞÔÏÂÙ ÐÏÌØÚÏ×ÁÔÅÌÉ
      × óûá ÍÏÇÌÉ ÕÓÔÁÎÁ×ÌÉ×ÁÔØ É ÉÓÐÏÌØÚÏ×ÁÔØ ÂÉÂÌÉÏÔÅËÉ DES, Á Õ ÏÓÔÁÌØÎÙÈ
      ÐÏÌØÚÏ×ÁÔÅÌÅÊ ÂÙÌ ÍÅÔÏÄ ÛÉÆÒÏ×ÁÎÉÑ, ÒÁÚÒÅÛÅÎÎÙÊ Ë ÜËÓÐÏÒÔÕ.  ôÁË
      &os; ÐÒÉÛÌÁ Ë ÉÓÐÏÌØÚÏ×ÁÎÉÀ MD5 × ËÁÞÅÓÔ×Å ÍÅÔÏÄÁ ÛÉÆÒÏ×ÁÎÉÑ ÐÏ
      ÕÍÏÌÞÁÎÉÀ.  MD5 ÓÞÉÔÁÅÔÓÑ ÂÏÌÅÅ ÂÅÚÏÐÁÓÎÙÍ, ÞÅÍ DES, ÐÏÜÔÏÍÕ ÕÓÔÁÎÏ×ËÁ
      DES ÒÅËÏÍÅÎÄÕÅÔÓÑ × ÏÓÎÏ×ÎÏÍ ÉÚ ÓÏÏÂÒÁÖÅÎÉÊ ÓÏ×ÍÅÓÔÉÍÏÓÔÉ.</para>

    <sect2>
      <title>ïÐÒÅÄÅÌÅÎÉÑ ÍÅÈÁÎÉÚÍÁ ÛÉÆÒÏ×ÁÎÉÑ</title>

      <para>îÁ ÄÁÎÎÙÊ ÍÏÍÅÎÔ ÂÉÂÌÉÏÔÅËÁ ÐÏÄÄÅÒÖÉ×ÁÅÔ ÈÜÛÉ DES, MD5 É
	Blowfish.  ðÏ ÕÍÏÌÞÁÎÉÀ &os; ÉÓÐÏÌØÚÕÅÔ ÄÌÑ ÛÉÆÒÏ×ÁÎÉÑ ÐÁÒÏÌÅÊ
	MD5.</para>

      <para>äÏ×ÏÌØÎÏ ÌÅÇËÏ ÏÐÒÅÄÅÌÉÔØ ËÁËÏÊ ÍÅÔÏÄ ÛÉÆÒÏ×ÁÎÉÑ ÉÓÐÏÌØÚÕÅÔÓÑ
	× &os;.  ïÄÉÎ ÉÚ ÓÐÏÓÏÂÏ× ÜÔÏ ÐÒÏ×ÅÒËÁ ÆÁÊÌÁ
	<filename>/etc/master.passwd</filename>.  ðÁÒÏÌÉ, ÚÁÛÉÆÒÏ×ÁÎÎÙÅ ×
	ÈÜÛ MD5 ÄÌÉÎÎÅÅ, ÞÅÍ ÔÅ, ÞÔÏ ÚÁÛÉÆÒÏ×ÁÎÙ Ó ÐÏÍÏÝØÀ DES É ÎÁÞÉÎÁÀÔÓÑ
	Ó ÓÉÍ×ÏÌÏ× <literal>&dollar;1&dollar;</literal>.  ðÁÒÏÌÉ, ÎÁÞÉÎÁÀÝÉÅÓÑ
	Ó ÓÉÍ×ÏÌÏ× <literal>&dollar;2a&dollar;</literal> ÚÁÛÉÆÒÏ×ÁÎÙ Ó ÐÏÍÏÝØÀ
	Blowfish.  ðÁÒÏÌÉ, ÚÁÛÉÆÒÏ×ÁÎÎÙÅ DES ÎÅ ÓÏÄÅÒÖÁÔ ËÁËÉÈ-ÔÏ ÏÐÒÅÄÅÌÅÎÎÙÈ
	ÉÄÅÎÔÉÆÉÃÉÒÕÀÝÉÈ ÓÉÍ×ÏÌÏ×, ÎÏ ÏÎÉ ËÏÒÏÞÅ, ÞÅÍ ÐÁÒÏÌÉ MD5 É
	ÚÁËÏÄÉÒÏ×ÁÎÙ × 64-ÓÉÍ×ÏÌØÎÏÍ ÁÌÆÁ×ÉÔÅ, ÎÅ ÓÏÄÅÒÖÁÝÅÍ ÓÉÍ×ÏÌÁ
	<literal>&dollar;</literal>, ÐÏÜÔÏÍÕ ÏÔÎÏÓÉÔÅÌØÎÏ ËÏÒÏÔËÁÑ ÓÔÒÏËÁ,
	ÎÅ ÎÁÞÉÎÁÀÝÁÑÓÑ Ó ÜÔÏÇÏ ÓÉÍ×ÏÌÁ ÜÔÏ ÓËÏÒÅÅ ×ÓÅÇÏ DES ÐÁÒÏÌØ.</para>

      <para>æÏÒÍÁÔ ÐÁÒÏÌÅÊ, ÉÓÐÏÌØÚÕÅÍÙÈ ÄÌÑ ÎÏ×ÙÈ ÐÁÒÏÌÅÊ, ÏÐÒÅÄÅÌÑÅÔÓÑ
	ÐÁÒÁÍÅÔÒÏÍ <literal>passwd_format</literal> ×
	<filename>/etc/login.conf</filename>, ËÏÔÏÒÏÅ ÍÏÖÅÔ ÐÒÉÎÉÍÁÔØ ÚÎÁÞÅÎÉÑ
	<literal>des</literal>, <literal>md5</literal> ÉÌÉ
	<literal>blf</literal>.  ïÂÒÁÔÉÔÅÓØ Ë ÓÔÒÁÎÉÃÅ ÓÐÒÁ×ÏÞÎÉËÁ
	&man.login.conf.5; ÚÁ ÄÏÐÏÌÎÉÔÅÌØÎÏÊ ÉÎÆÏÒÍÁÃÉÅÊ Ï ÐÁÒÁÍÅÔÒÁÈ
	login.</para>

    </sect2>
  </sect1>

  <sect1 id="one-time-passwords">
    <title>ïÄÎÏÒÁÚÏ×ÙÅ ÐÁÒÏÌÉ</title>
    <indexterm><primary>ÏÄÎÏÒÁÚÏ×ÙÅ ÐÁÒÏÌÉ</primary></indexterm>
    <indexterm>
      <primary>ÂÅÚÏÐÁÓÎÏÓÔØ</primary>
      <secondary>ÏÄÎÏÒÁÚÏ×ÙÅ ÐÁÒÏÌÉ</secondary>
    </indexterm>

    <para>&os; ÉÓÐÏÌØÚÕÅÔ ÄÌÑ ÏÄÎÏÒÁÚÏ×ÙÈ ÐÁÒÏÌÅÊ
      OPIE (One-time Passwords In Everything).
      OPIE ÐÏ ÕÍÏÌÞÁÎÉÀ ÉÓÐÏÌØÚÕÅÔ MD5.</para>

    <para>åÓÔØ ÔÒÉ ÒÁÚÌÉÞÎÙÈ ×ÉÄÁ ÐÁÒÏÌÅÊ, Ï ËÏÔÏÒÙÈ ÍÙ ÐÏÇÏ×ÏÒÉÍ ÎÉÖÅ.
      ðÅÒ×ÙÊ ×ÉÄ ÜÔÏ ×ÁÛ ÏÂÙÞÎÙÊ ÐÁÒÏÌØ &unix; ÉÌÉ ÐÁÒÏÌØ Kerberos; ÍÙ
      ÂÕÄÅÍ ÎÁÚÙ×ÁÔØ ÅÇÏ <quote>ÐÁÒÏÌØ &unix;</quote>.  ÷ÔÏÒÏÊ ×ÉÄ ÜÔÏ
      ÏÄÎÏÒÁÚÏ×ÙÊ ÐÁÒÏÌØ, ÓÇÅÎÅÒÉÒÏ×ÁÎÎÙÊ ÐÒÏÇÒÁÍÍÏÊ
      OPIE &man.opiekey.1; É ÐÒÉÎÉÍÁÅÍÙÊ
      ËÏÍÁÎÄÏÊ &man.opiepasswd.1;
      É × ÐÒÉÇÌÁÛÅÎÉÉ login; ÍÙ ÂÕÄÅÍ ÎÁÚÙ×ÁÔØ ÉÈ <quote>ÏÄÎÏÒÁÚÏ×ÙÍÉ
      ÐÁÒÏÌÑÍÉ</quote>.  ðÏÓÌÅÄÎÉÊ ×ÉÄ ÐÁÒÏÌÅÊ ÜÔÏ ÚÁÝÉÝÅÎÎÙÅ ÐÁÒÏÌÉ, ËÏÔÏÒÙÅ
      ×Ù ÐÅÒÅÄÁÅÔÅ ÐÒÏÇÒÁÍÍÁÍ <command>opiekey</command> (É ÉÎÏÇÄÁ
      <command>opiepasswd</command>),
      É ËÏÔÏÒÙÅ ÜÔÉ ÐÒÏÇÒÁÍÍÙ ÉÓÐÏÌØÚÕÀÔ ÄÌÑ ÓÏÚÄÁÎÉÑ ÏÄÎÏÒÁÚÏ×ÙÈ ÐÁÒÏÌÅÊ;
      ÍÙ ÂÕÄÅÍ ÎÁÚÙ×ÁÔØ ÅÇÏ <quote>ÚÁÝÉÝÅÎÎÙÍÉ ÐÁÒÏÌÑÍÉ</quote> ÉÌÉ ÐÒÏÓÔÏ
      <quote>ÐÁÒÏÌÑÍÉ</quote>.</para>

    <para>úÁÝÉÝÅÎÎÙÊ ÐÁÒÏÌØ ÎÅ ÉÍÅÅÔ ÎÉËÁËÏÇÏ ÏÔÎÏÛÅÎÉÑ Ë ×ÁÛÅÍÕ ÐÁÒÏÌÀ
      &unix;; ÏÎÉ ÍÏÇÕÔ ÂÙÔØ ÏÄÉÎÁËÏ×ÙÍÉ, ÎÏ ÜÔÏ ÎÅ ÒÅËÏÍÅÎÄÕÅÔÓÑ.
      úÁÝÉÝÅÎÎÙÅ ÐÁÒÏÌÉ OPIE ÎÅ ÏÇÒÁÎÉÞÅÎÙ 8-À ÓÉÍ×ÏÌÁÍÉ, ËÁË
      ÓÔÁÒÙÅ &unix; ÐÁÒÏÌÉ<footnote><para>÷ &os; ÓÔÁÎÄÁÒÔÎÙÊ ÐÁÒÏÌØ
      ÍÏÖÅÔ ÂÙÔØ ÄÏ 128 ÓÉÍ×ÏÌÏ× ÄÌÉÎÏÊ.</para></footnote>,
      ÏÎÉ ÍÏÇÕÔ ÂÙÔØ ÎÁÓÔÏÌØËÏ ÄÌÉÎÎÙÍÉ, ÎÁÓËÏÌØËÏ ×Ù ÚÁÈÏÔÉÔÅ.  ïÞÅÎØ ÞÁÓÔÏ
      ÉÓÐÏÌØÚÕÀÔÓÑ ÐÁÒÏÌÉ ÄÌÉÎÏÊ × ÛÅÓÔØ ÉÌÉ ÓÅÍØ ÓÉÍ×ÏÌÏ×.  ðÏ ÂÏÌØÛÅÊ ÞÁÓÔÉ
      ÓÉÓÔÅÍÁ OPIE ÒÁÂÏÔÁÅÔ ÐÏÌÎÏÓÔØÀ ÎÅÚÁ×ÉÓÉÍÏ ÏÔ ÓÉÓÔÅÍÙ
      ÐÁÒÏÌÅÊ &unix;.</para>

    <para>ðÏÍÉÍÏ ÐÁÒÏÌÅÊ, ÅÓÔØ Ä×Á ÄÒÕÇÉÈ ×ÉÄÁ ÄÁÎÎÙÈ, ×ÁÖÎÙÈ ÄÌÑ
      OPIE.  ðÅÒ×ÙÊ, ÉÚ×ÅÓÔÎÙÊ ËÁË <quote>seed</quote> ÉÌÉ
      <quote>ËÌÀÞ</quote>, ÓÏÓÔÏÉÔ ÉÚ Ä×ÕÈ ÂÕË× É ÐÑÔÉ ÃÉÆÒ.  äÒÕÇÏÊ,
      ÎÁÚÙ×ÁÅÍÙÊ <quote>ÓÞÅÔÞÉËÏÍ ÃÉËÌÁ</quote>, ÜÔÏ ÎÏÍÅÒ ÏÔ 1 ÄÏ 100.
      OPIE ÓÏÚÄÁÅÔ ÏÄÎÏÒÁÚÏ×ÙÊ ÐÁÒÏÌØ, ÓÏÅÄÉÎÑÑ ËÌÀÞ É ÚÁÝÉÝÅÎÎÙÊ ÐÁÒÏÌØ,
      Á ÚÁÔÅÍ ÐÒÉÍÅÎÑÑ MD4 ÓÔÏÌØËÏ ÒÁÚ, ÓËÏÌØËÏ ÕËÁÚÁÎÏ ÓÞÅÔÞÉËÏÍ ÃÉËÌÁ É
      ×ÙÄÁÅÔ ÒÅÚÕÌØÔÁÔ × ×ÉÄÅ ÛÅÓÔÉ ËÏÒÏÔËÉÈ ÓÌÏ× ÎÁ ÁÎÇÌÉÊÓËÏÍ.  üÔÉ ÛÅÓÔØ
      ÓÌÏ× ÎÁ ÁÎÇÌÉÊÓËÏÍ É ÅÓÔØ ×ÁÛ ÏÄÎÏÒÁÚÏ×ÙÊ ÐÁÒÏÌØ.  óÉÓÔÅÍÁ
      ÁÕÔÅÎÔÉÆÉËÁÃÉÉ (ËÁË ÐÒÁ×ÉÌÏ PAM) ÈÒÁÎÉÔ ÐÏÓÌÅÄÎÉÊ ÉÓÐÏÌØÚÏ×ÁÎÎÙÊ
      ÏÄÎÏÒÁÚÏ×ÙÊ ÐÁÒÏÌØ, É ÐÏÌØÚÏ×ÁÔÅÌØ ÁÕÔÅÎÔÉÆÉÃÉÒÕÅÔÓÑ ÅÓÌÉ ÈÜÛ ××ÏÄÉÍÏÇÏ
      ÐÏÌØÚÏ×ÁÔÅÌÅÍ ÐÁÒÏÌÑ ÓÏ×ÐÁÄÁÅÔ Ó ÐÒÅÄÙÄÕÝÉÍ ÐÁÒÏÌÅÍ.  ðÏÓËÏÌØËÕ
      ÉÓÐÏÌØÚÕÅÔÓÑ ÏÄÎÏÓÔÏÒÏÎÎÉÊ ÈÜÛ, ÎÅ×ÏÚÍÏÖÎÏ ÓÇÅÎÅÒÉÒÏ×ÁÔØ ÓÌÅÄÕÀÝÉÊ
      ÏÄÎÏÒÁÚÏ×ÙÊ ÐÁÒÏÌØ ÅÓÌÉ ÐÏÌÕÞÅÎ ÐÒÅÄÙÄÕÝÉÊ; ÓÞÅÔÞÉË ÃÉËÌÁ ÕÍÅÎØÛÁÅÔÓÑ
      ÐÏÓÌÅ ËÁÖÄÏÇÏ ÕÓÐÅÛÎÏÇÏ ×ÈÏÄÁ ÄÌÑ ÐÏÄÄÅÒÖËÉ ÓÉÎÈÒÏÎÉÚÁÃÉÉ ÐÏÌØÚÏ×ÁÔÅÌÑ
      Ó ÐÒÏÇÒÁÍÍÏÊ login.  ëÏÇÄÁ ÓÞÅÔÞÉË ÃÉËÌÁ ÕÍÅÎØÛÁÅÔÓÑ ÄÏ 1, ÎÁÂÏÒ OPIE
      ÄÏÌÖÅÎ ÂÙÔØ ÐÅÒÅÉÎÉÃÉÁÌÉÚÉÒÏ×ÁÎ.</para>

    <para>÷ ËÁÖÄÏÊ ÉÚ ÏÂÓÕÖÄÁÅÍÙÈ ÎÉÖÅ ÓÉÓÔÅÍ ÚÁÄÅÊÓÔ×Ï×ÁÎÙ ÔÒÉ ÐÒÏÇÒÁÍÍÙ.
      ðÒÏÇÒÁÍÍÁ <command>opiekey</command>
      ÐÏÌÕÞÁÅÔ ÓÞÅÔÞÉË ÃÉËÌÁ, ËÌÀÞ É ÚÁÝÉÝÅÎÎÙÊ ÐÁÒÏÌØ É ÓÏÚÄÁÅÔ ÏÄÎÏÒÁÚÏ×ÙÊ
      ÐÁÒÏÌØ ÉÌÉ ÐÏÓÌÅÄÏ×ÁÔÅÌØÎÙÊ ÓÐÉÓÏË ÏÄÎÏÒÁÚÏ×ÙÈ ÐÁÒÏÌÅÊ.  ðÒÏÇÒÁÍÍÁ
      <command>opiepasswd</command>
      ÉÓÐÏÌØÚÕÅÔÓÑ ÄÌÑ ÉÎÉÃÉÁÌÉÚÁÃÉÉ OPIE ÓÏÏÔ×ÅÔÓÔ×ÅÎÎÏ,
      É ÄÌÑ ÓÍÅÎÙ ÐÁÒÏÌÅÊ, ÓÞÅÔÞÉËÏ× ÃÉËÌÁ, ÉÌÉ ËÌÀÞÅÊ; ÏÎÁ ÐÒÉÎÉÍÁÅÔ
      ÚÁÝÉÝÅÎÎÙÊ ÐÁÒÏÌØ ÉÌÉ ÓÞÅÔÞÉË ÃÉËÌÁ, ËÌÀÞ É ÏÄÎÏÒÁÚÏ×ÙÊ ÐÁÒÏÌØ.
      ðÒÏÇÒÁÍÍÁ <command>opieinfo</command>
      ÐÒÏ×ÅÒÑÅÔ ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÉÊ ÆÁÊÌ (<filename>/etc/opiekeys</filename>)
      É ÐÅÞÁÔÁÅÔ ÔÅËÕÝÉÊ ÓÞÅÔÞÉË
      ÃÉËÌÁ É ËÌÀÞ ×ÙÚÙ×ÁÀÝÅÇÏ ÐÏÌØÚÏ×ÁÔÅÌÑ.</para>

    <para>íÙ ÒÁÓÓÍÏÔÒÉÍ ÞÅÔÙÒÅ ×ÉÄÁ ÏÐÅÒÁÃÉÊ.  ðÅÒ×ÁÑ ÜÔÏ ÉÓÐÏÌØÚÏ×ÁÎÉÅ
      <command>opiepasswd</command> ÞÅÒÅÚ
      ÚÁÝÉÝÅÎÎÏÅ ÓÏÅÄÉÎÅÎÉÅ ÄÌÑ ÐÅÒ×ÏÎÁÞÁÌØÎÏÊ ÎÁÓÔÒÏÊËÉ ÓÉÓÔÅÍÙ ÏÄÎÏÒÁÚÏ×ÙÈ
      ÐÁÒÏÌÅÊ, ÉÌÉ ÄÌÑ ÉÚÍÅÎÅÎÉÑ ÐÁÒÏÌÑ ÉÌÉ ËÌÀÞÁ.  ÷ÔÏÒÁÑ ÏÐÅÒÁÃÉÑ ÜÔÏ
      ÉÓÐÏÌØÚÏ×ÁÎÉÅ × ÔÅÈ ÖÅ ÃÅÌÑÈ
      <command>opiepasswd</command> ÞÅÒÅÚ ÎÅÚÁÝÉÝÅÎÎÏÅ ÓÏÅÄÉÎÅÎÉÅ, × ÓÏÞÅÔÁÎÉÉ
      Ó <command>opiekey</command> ÞÅÒÅÚ ÚÁÝÉÝÅÎÎÏÅ
      ÓÏÅÄÉÎÅÎÉÅ.  ôÒÅÔØÑ ÜÔÏ ÉÓÐÏÌØÚÏ×ÁÎÉÅ
      <command>opiekey</command> ÄÌÑ ×ÈÏÄÁ ÞÅÒÅÚ
      ÎÅÚÁÝÉÝÅÎÎÏÅ ÓÏÅÄÉÎÅÎÉÅ.  þÅÔ×ÅÒÔÁÑ ÜÔÏ ÉÓÐÏÌØÚÏ×ÁÎÉÅ
      <command>opiekey</command> ÄÌÑ ÇÅÎÅÒÁÃÉÉ
      ÎÁÂÏÒÁ ËÌÀÞÅÊ, ËÏÔÏÒÙÅ ÍÏÇÕÔ ÂÙÔØ ÚÁÐÉÓÁÎÙ ÉÌÉ ÒÁÓÐÅÞÁÔÁÎÙ ÄÌÑ
      ÓÏÅÄÉÎÅÎÉÑ ÉÚ ÍÅÓÔÁ, ÇÄÅ ÚÁÝÉÝÅÎÎÏÅ ÓÏÅÄÉÎÅÎÉÅ ÎÅÄÏÓÔÕÐÎÏ.</para>

    <sect2>
      <title>úÁÝÉÝÅÎÎÁÑ ÕÓÔÁÎÏ×ËÁ ÓÏÅÄÉÎÅÎÉÑ</title>

      <para>äÌÑ ÐÅÒ×ÏÎÁÞÁÌØÎÏÊ ÎÁÓÔÒÏÊËÉ OPIE ÉÓÐÏÌØÚÕÅÔÓÑ ËÏÍÁÎÄÁ
	<command>opiepasswd</command>:</para>

      <screen>&prompt.user; <userinput>opiepasswd -c</userinput>
[grimreaper] ~ $ opiepasswd -f -c
Adding unfurl:
Only use this method from the console; NEVER from remote. If you are using
telnet, xterm, or a dial-in, type ^C now or exit with no password.
Then run opiepasswd without the -c parameter.
Using MD5 to compute responses.
Enter new secret pass phrase:
Again new secret pass phrase:
ID unfurl OTP key is 499 to4268
MOS MALL GOAT ARM AVID COED
</screen>

      <para>÷ ÐÒÉÇÌÁÛÅÎÉÑÈ <prompt>Enter new secret pass phrase:</prompt> ÉÌÉ
	<prompt>Enter secret password:</prompt>, ××ÅÄÉÔÅ ÐÁÒÏÌØ ÉÌÉ ÆÒÁÚÕ.
	úÁÐÏÍÎÉÔÅ, ÜÔÏ ÎÅ ÔÏÔ ÐÁÒÏÌØ, Ó ËÏÔÏÒÙÍ ×Ù ÂÕÄÅÔÅ ×ÈÏÄÉÔØ, ÏÎ
	ÉÓÐÏÌØÚÕÅÔÓÑ ÄÌÑ ÇÅÎÅÒÁÃÉÉ ÏÄÎÏÒÁÚÏ×ÙÈ ÐÁÒÏÌÅÊ.  óÔÒÏËÁ
	<quote>ID</quote> ÓÏÄÅÒÖÉÔ ÉÎÆÏÒÍÁÃÉÀ ÄÌÑ ×ÁÛÅÇÏ ËÏÎËÒÅÔÎÏÇÏ ÓÌÕÞÁÑ:
	ÉÍÑ ÐÏÌØÚÏ×ÁÔÅÌÑ, ÓÞÅÔÞÉË ÃÉËÌÁ É ËÌÀÞ.  ðÒÉ ×ÈÏÄÅ ÓÉÓÔÅÍÁ ÚÁÐÏÍÎÉÔ
	ÜÔÉ ÐÁÒÁÍÅÔÒÙ É ÏÔÐÒÁ×ÉÔ ÉÈ ×ÁÍ, ÐÏÜÔÏÍÕ ÉÈ ÎÅ ÎÁÄÏ ÚÁÐÏÍÉÎÁÔØ.  ÷
	ÐÏÓÌÅÄÎÅÊ ÓÔÒÏËÅ ÎÁÈÏÄÉÔÓÑ ÏÄÎÏÒÁÚÏ×ÙÊ ÐÁÒÏÌØ, ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÉÊ
	ÜÔÉÍ ÐÁÒÁÍÅÔÒÁÍ É ÓÅËÒÅÔÎÏÍÕ ÐÁÒÏÌÀ; ÅÓÌÉ ×Ù ×ÏÊÄÅÔÅ × ÓÉÓÔÅÍÕ ÓÒÁÚÕ,
	ÉÓÐÏÌØÚÕÊÔÅ ÜÔÏÔ ÏÄÎÏÒÁÚÏ×ÙÊ ÐÁÒÏÌØ.</para>
    </sect2>

    <sect2>
      <title>îÅÚÁÝÉÝÅÎÎÁÑ ÕÓÔÁÎÏ×ËÁ ÓÏÅÄÉÎÅÎÉÑ</title>

      <para>äÌÑ ÉÎÉÃÉÁÌÉÚÁÃÉÉ ÉÌÉ ÉÚÍÅÎÅÎÉÑ ÚÁÝÉÝÅÎÎÏÇÏ ÐÁÒÏÌÑ ÞÅÒÅÚ
	ÎÅÚÁÝÉÝÅÎÎÏÅ ÓÏÅÄÉÎÅÎÉÅ, ×ÁÍ ÐÏÔÒÅÂÕÅÔÓÑ ÓÕÝÅÓÔ×ÕÀÝÅÅ ÚÁÝÉÝÅÎÎÏÅ
	ÓÏÅÄÉÎÅÎÉÅ ËÕÄÁ-ÔÏ, ÇÄÅ ×Ù ÓÍÏÖÅÔÅ ÚÁÐÕÓÔÉÔØ
	<command>opiekey</command>; ÜÔÏ ÍÏÖÅÔ ÂÙÔØ
	shell ÎÁ ËÏÍÐØÀÔÅÒÅ, ËÏÔÏÒÏÍÕ ×Ù ÄÏ×ÅÒÑÅÔÅ.
	÷ÁÍ ÐÏÔÒÅÂÕÅÔÓÑ ÔÁËÖÅ ÕÓÔÁÎÏ×ÉÔØ ÚÎÁÞÅÎÉÅ ÓÞÅÔÞÉËÁ ÃÉËÌÁ (100
	×ÏÚÍÏÖÎÏ ÐÏÄÏÊÄÅÔ), É ÚÁÄÁÔØ ËÌÀÞ ÉÌÉ ÉÓÐÏÌØÚÏ×ÁÔØ ÓÇÅÎÅÒÉÒÏ×ÁÎÎÙÊ.
	þÅÒÅÚ ÎÅÚÁÝÉÝÅÎÎÏÅ ÓÏÅÄÉÎÅÎÉÅ (Ë ËÏÍÐØÀÔÅÒÕ, ÎÁ ËÏÔÏÒÏÍ ÐÒÏÉÚ×ÏÄÉÔÓÑ
	ÎÁÓÔÒÏÊËÁ), ÉÓÐÏÌØÚÕÊÔÅ ËÏÍÁÎÄÕ <command>opiepasswd</command>:</para>

      <screen>&prompt.user; <userinput>opiepasswd</userinput>

Updating unfurl:
You need the response from an OTP generator.
Old secret pass phrase:
        otp-md5 498 to4268 ext
        Response: GAME GAG WELT OUT DOWN CHAT
New secret pass phrase:
        otp-md5 499 to4269
        Response: LINE PAP MILK NELL BUOY TROY

ID mark OTP key is 499 gr4269
LINE PAP MILK NELL BUOY TROY
</screen>

	<!--russian translation issue: seed/key == ËÌÀÞ? -->
      <para>þÔÏÂÙ ÐÒÉÎÑÔØ ËÌÀÞ ÐÏ ÕÍÏÌÞÁÎÉÀ ÎÁÖÍÉÔÅ <keycap>Enter</keycap>.
	úÁÔÅÍ, ÐÅÒÅÄ ××ÏÄÏÍ ÐÁÒÏÌÑ ÄÏÓÔÕÐÁ ××ÅÄÉÔÅ ÔÅ ÖÅ ÐÁÒÁÍÅÔÒÙ ×
	×ÁÛÅÍ ÚÁÝÉÝÅÎÎÏÍ ÓÏÅÄÉÎÅÎÉÉ ÉÌÉ ÓÒÅÄÓÔ×Å ÄÏÓÔÕÐÁ OPIE:</para>

      <screen>&prompt.user; <userinput>opiekey 498 to4268</userinput>
Using the MD5 algorithm to compute response.
Reminder: Don't use opiekey from telnet or dial-in sessions.
Enter secret pass phrase:
GAME GAG WELT OUT DOWN CHAT
</screen>

      <para>ôÅÐÅÒØ ÐÅÒÅËÌÀÞÉÔÅÓØ ÎÁ ÎÅÚÁÝÉÝÅÎÎÏÅ ÓÏÅÄÉÎÅÎÉÅ É ÓËÏÐÉÒÕÊÔÅ
	ÏÄÎÏÒÁÚÏ×ÙÊ ÐÁÒÏÌØ, ÓÇÅÎÅÒÉÒÏ×ÁÎÎÙÊ ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÅÊ ÐÒÏÇÒÁÍÍÏÊ.</para>
    </sect2>

    <sect2>
      <title>óÏÚÄÁÎÉÅ ÏÄÎÏÇÏ ÏÄÎÏÒÁÚÏ×ÏÇÏ ÐÁÒÏÌÑ</title>

      <para>ëÁË ÔÏÌØËÏ ×Ù ÎÁÓÔÒÏÉÔÅ OPIE, ×Ï ×ÒÅÍÑ ×ÈÏÄÁ ÐÏÑ×ÉÔÓÑ
	ÐÒÉÇÌÁÛÅÎÉÅ ×ÒÏÄÅ ÜÔÏÇÏ:</para>

<screen>&prompt.user; <userinput>telnet example.com</userinput>
Trying 10.0.0.1...
Connected to example.com
Escape character is '^]'.

FreeBSD/i386 (example.com) (ttypa)

login: <userinput>&lt;username&gt;</userinput>
otp-md5 498 gr4269 ext
Password: </screen>

      <para>ëÒÏÍÅ ÔÏÇÏ, Õ OPIE ÅÓÔØ ÐÏÌÅÚÎÁÑ ÏÓÏÂÅÎÎÏÓÔØ (ÎÅ
	ÐÏËÁÚÁÎÎÁÑ ÚÄÅÓØ): ÅÓÌÉ ×Ù ÎÁÖÍÅÔÅ <keycap>Enter</keycap>
	× ÐÒÉÇÌÁÛÅÎÉÉ ÎÁ ××ÏÄ ÐÁÒÏÌÑ, ×ËÌÀÞÉÔÓÑ ÜÈÏ, É ×Ù ÓÍÏÖÅÔÅ Õ×ÉÄÅÔØ
	ÔÏ, ÞÔÏ ××ÏÄÉÔÅ.  üÔÏ ÍÏÖÅÔ ÂÙÔØ ÏÞÅÎØ ÐÏÌÅÚÎÏ, ÅÓÌÉ ×Ù ÐÙÔÁÅÔÅÓØ
	××ÅÓÔÉ ÐÁÒÏÌØ ×ÒÕÞÎÕÀ, ÎÁÐÒÉÍÅÒ Ó ÒÁÓÐÅÞÁÔËÉ.</para>

      <indexterm><primary>MS-DOS</primary></indexterm>
      <indexterm><primary>Windows</primary></indexterm>
      <indexterm><primary>MacOS</primary></indexterm>

      <para>÷ ÜÔÏÔ ÍÏÍÅÎÔ ×ÁÍ ÐÏÔÒÅÂÕÅÔÓÑ ÓÇÅÎÅÒÉÒÏ×ÁÔØ ÏÄÎÏÒÁÚÏ×ÙÊ ÐÁÒÏÌØ,
	ÞÔÏÂÙ ××ÅÓÔÉ ÅÇÏ × ÐÒÉÇÌÁÛÅÎÉÅ.  üÔÏ ÄÏÌÖÎÏ ÂÙÔØ ×ÙÐÏÌÎÅÎÏ ÎÁ
	ÚÁÝÉÝÅÎÎÏÊ ÓÉÓÔÅÍÅ, × ËÏÔÏÒÏÊ ×Ù ÍÏÖÅÔÅ ÚÁÐÕÓÔÉÔØ
	<command>opiekey</command> (ÅÓÔØ ×ÅÒÓÉÉ
	ÄÌÑ DOS, &windows; É &macos;).  éÍ ÔÒÅÂÕÀÔÓÑ ÚÎÁÞÅÎÉÑ ÓÞÅÔÞÉËÁ ÃÉËÌÁ
	É ËÌÀÞ × ËÁÞÅÓÔ×Å ÐÁÒÁÍÅÔÒÏ× ËÏÍÁÎÄÎÏÊ ÓÔÒÏËÉ.  ÷Ù ÍÏÖÅÔÅ ÓËÏÐÉÒÏ×ÁÔØ
	É ×ÓÔÁ×ÉÔØ ÉÈ ÐÒÑÍÏ ÉÚ ÐÒÉÇÌÁÛÅÎÉÑ login ËÏÍÐØÀÔÅÒÁ, ÎÁ ËÏÔÏÒÙÊ
	×ÈÏÄÉÔÅ.</para>

      <para>÷ ÚÁÝÉÝÅÎÎÏÊ ÓÉÓÔÅÍÅ:</para>

      <screen>&prompt.user; <userinput>opiekey 498 to4268</userinput>
Using the MD5 algorithm to compute response.
Reminder: Don't use opiekey from telnet or dial-in sessions.
Enter secret pass phrase:
GAME GAG WELT OUT DOWN CHAT</screen>

      <para>ôÅÐÅÒØ, ËÏÇÄÁ Õ ×ÁÓ ÅÓÔØ ÏÄÎÏÒÁÚÏ×ÙÊ ÐÁÒÏÌØ, ÍÏÖÅÔÅ ÐÒÏÄÏÌÖÉÔØ
	×ÈÏÄ × ÓÉÓÔÅÍÕ.</para>
    </sect2>

    <sect2>
      <title>óÏÚÄÁÎÉÅ ÎÅÓËÏÌØËÉÈ ÏÄÎÏÒÁÚÏ×ÙÈ ÐÁÒÏÌÅÊ</title>

      <para>éÎÏÇÄÁ ×Ù ÏÔÐÒÁ×ÌÑÅÔÅÓØ ÔÕÄÁ, ÇÄÅ ÎÅÔ ÄÏÓÔÕÐÁ Ë ÚÁÝÉÝÅÎÎÏÍÕ
	ËÏÍÐØÀÔÅÒÕ ÉÌÉ ÚÁÝÉÝÅÎÎÏÍÕ ÓÏÅÄÉÎÅÎÉÀ.  ÷ ÜÔÏÍ ÓÌÕÞÁÅ, ÍÏÖÎÏ
	ÉÓÐÏÌØÚÏ×ÁÔØ ËÏÍÁÎÄÕ
	<command>opiekey</command> ÄÌÑ ÓÏÚÄÁÎÉÑ ÎÅÓËÏÌØËÉÈ ÏÄÎÏÒÁÚÏ×ÙÈ
	ÐÁÒÏÌÅÊ, ËÏÔÏÒÙÅ ×Ù ÓÍÏÖÅÔÅ ÒÁÓÐÅÞÁÔÁÔØ É ÚÁÂÒÁÔØ Ó ÓÏÂÏÊ.
	îÁÐÒÉÍÅÒ:</para>

      <screen>&prompt.user; <userinput>opiekey -n 5 30 zz99999</userinput>
Using the MD5 algorithm to compute response.
Reminder: Don't use opiekey from telnet or dial-in sessions.
Enter secret pass phrase: <userinput>&lt;secret password&gt;</userinput>
26: JOAN BORE FOSS DES NAY QUIT
27: LATE BIAS SLAY FOLK MUCH TRIG
28: SALT TIN ANTI LOON NEAL USE
29: RIO ODIN GO BYE FURY TIC
30: GREW JIVE SAN GIRD BOIL PHI</screen>

      <para>ðÁÒÁÍÅÔÒ <option>-n 5</option> ÚÁÐÒÁÛÉ×ÁÅÔ ÐÑÔØ ÐÁÒÏÌÅÊ,
	<option>30</option> ÕËÁÚÙ×ÁÅÔ ÚÎÁÞÅÎÉÅ ÐÏÓÌÅÄÎÅÇÏ ÓÞÅÔÞÉËÁ ÃÉËÌÁ.
	ïÂÒÁÔÉÔÅ ×ÎÉÍÁÎÉÅ, ÞÔÏ ÐÁÒÏÌÉ ÐÅÞÁÔÁÀÔÓÑ ×
	<emphasis>ÏÂÒÁÔÎÏÍ</emphasis> ÐÏ ÓÒÁ×ÎÅÎÉÀ Ó ÏÂÙÞÎÙÍ ÉÓÐÏÌØÚÏ×ÁÎÉÅÍ
	ÐÏÒÑÄËÅ.  åÓÌÉ ×Ù ÄÅÊÓÔ×ÉÔÅÌØÎÏ ÐÁÒÁÎÏÉË, ÐÅÒÅÐÉÛÉÔÅ ÒÅÚÕÌØÔÁÔ
	×ÒÕÞÎÕÀ; ÉÎÁÞÅ ÓËÏÐÉÒÕÊÔÅ É ÐÅÒÅÄÁÊÔÅ ÅÇÏ <command>lpr</command>.
	ïÂÒÁÔÉÔÅ ×ÎÉÍÁÎÉÅ, ÞÔÏ ËÁÖÄÁÑ ÌÉÎÉÑ ÓÏÄÅÒÖÉÔ ËÁË ÓÞÅÔÞÉË ÃÉËÌÁ, ÔÁË
	É ÏÄÎÏÒÁÚÏ×ÙÊ ÐÁÒÏÌØ; ×ÁÍ ÍÏÖÅÔ ÐÏËÁÚÁÔØÓÑ ÕÄÏÂÎÙÍ ÏÔÒÙ×ÁÔØ ÐÁÒÏÌØ
	ÐÏÓÌÅ ÉÓÐÏÌØÚÏ×ÁÎÉÑ.</para>
    </sect2>

    <sect2>
      <title>ïÇÒÁÎÉÞÅÎÉÅ ÉÓÐÏÌØÚÏ×ÁÎÉÑ &unix; ÐÁÒÏÌÅÊ</title>

      <para>OPIE ÍÏÖÅÔ ÏÇÒÁÎÉÞÉ×ÁÔØ ÉÓÐÏÌØÚÏ×ÁÎÉÅ ÐÁÒÏÌÅÊ &unix; ÎÁ ÏÓÎÏ×Å IP
	ÁÄÒÅÓÁ.  óÏÏÔ×ÅÔÓÔ×ÕÀÝÉÊ ÆÁÊÌ ÎÁÚÙ×ÁÅÔÓÑ
	<filename>/etc/opieaccess</filename>, ÏÎ ÓÕÝÅÓÔ×ÕÅÔ ÐÏ ÕÍÏÌÞÁÎÉÀ.
	ïÂÒÁÔÉÔÅÓØ Ë
	&man.opieaccess.5; ÚÁ ÂÏÌÅÅ ÐÏÄÒÏÂÎÏÊ ÉÎÆÏÒÍÁÃÉÅÊ ÏÂ ÜÔÏÍ ÆÁÊÌÅ É Ï
	ÐÒÅÄÏÓÔÏÒÏÖÎÏÓÔÑÈ, ËÏÔÏÒÙÅ ×Ù ÄÏÌÖÎÙ ÐÒÅÄÐÒÉÎÑÔØ ÐÒÉ ÉÓÐÏÌØÚÏ×ÁÎÉÉ
	ÜÔÏÇÏ ÆÁÊÌÁ.</para>

      <para>÷ÏÔ ÐÒÉÍÅÒ ÆÁÊÌÁ <filename>opieaccess</filename>:</para>

      <programlisting>permit 192.168.0.0 255.255.0.0</programlisting>

      <para>üÔÁ ÓÔÒÏËÁ ÐÏÚ×ÏÌÑÅÔ ÐÏÌØÚÏ×ÁÔÅÌÑÍ, ÞÅÊ IP ÁÄÒÅÓ (ËÏÔÏÒÙÊ
	ÐÏÄ×ÅÒÖÅÎ ÐÏÄÄÅÌËÅ) ÓÏÏÔ×ÅÔÓÔ×ÕÅÔ ÕËÁÚÁÎÎÏÍÕ ÚÎÁÞÅÎÉÀ É ÍÁÓËÅ,
	×ÈÏÄÉÔØ Ó ÐÁÒÏÌÅÍ &unix;.</para>

      <para>åÓÌÉ ÎÉ ÏÄÎÏ ÉÚ ÐÒÁ×ÉÌ × <filename>opieaccess</filename> ÎÅ
	ÓÒÁÂÏÔÁÌÏ, ÐÏ×ÅÄÅÎÉÅÍ ÐÏ ÕÍÏÌÞÁÎÉÀ Ñ×ÌÑÅÔÓÑ ÚÁÐÒÅÔ ×ÓÅÈ ÎÅ-OPIE
	×ÈÏÄÏ×.</para>

    </sect2>
  </sect1>

  <sect1 id="tcpwrappers">
    <sect1info>
      <authorgroup>
	<author>
	  <firstname>Tom</firstname>
	  <surname>Rhodes</surname>
	  <contrib>îÁÐÉÓÁÌ: </contrib>
	</author>
      </authorgroup>
    </sect1info>

    <indexterm><primary>TCP Wrappers</primary></indexterm>

    <title>TCP Wrappers</title>

    <para>ëÁÖÄÙÊ, ËÔÏ ÚÎÁËÏÍ Ó &man.inetd.8;, ×ÏÚÍÏÖÎÏ ËÏÇÄÁ-ÔÏ ÓÌÙÛÁÌ
      Ï <acronym>TCP</acronym> Wrappers.  îÏ ÎÅÍÎÏÇÉÅ ÐÏÌÎÏÓÔØÀ
      ÐÏÎÉÍÁÀÔ ÉÈ ÐÏÌÅÚÎÏÓÔØ × ÓÅÔÅ×ÏÊ ÓÒÅÄÅ: ÂÏÌØÛÉÎÓÔ×Ï
      ÉÓÐÏÌØÚÕÀÔ ÂÒÁÎÄÍÁÕÜÒ.  èÏÔÑ ÅÇÏ ÐÒÉÍÅÎÉÍÏÓÔØ ÏÞÅÎØ ÛÉÒÏËÁ,
      ÅÓÔØ ×ÅÝÉ, Ó ËÏÔÏÒÙÍÉ ÂÒÁÎÄÍÁÕÜÒ ÎÅ ÍÏÖÅÔ ÒÁÂÏÔÁÔØ, ÔÁËÉÅ
      ËÁË ÏÔÐÒÁ×ËÁ ÔÅËÓÔÁ ÏÂÒÁÔÎÏ ×ÙÚÙ×ÁÀÝÅÊ ÓÔÏÒÏÎÅ.  ðÒÏÇÒÁÍÍÎÏÅ
      ÏÂÅÓÐÅÞÅÎÉÅ ÕÒÏ×ÎÑ <acronym>TCP</acronym> ÍÏÖÅÔ ÄÅÌÁÔØ ÜÔÏ
      É ÍÎÏÇÏÅ ÄÒÕÇÏÅ.  ÷ ÓÌÅÄÕÀÝÉÈ ÎÅÓËÏÌØËÉÈ ÒÁÚÄÅÌÁÈ ÏÂÓÕÖÄÁÀÔÓÑ
      ÍÎÏÇÉÅ ×ÏÚÍÏÖÎÏÓÔÉ <acronym>TCP</acronym> Wrappers, É, ËÏÇÄÁ
      ÜÔÏ ÎÅÏÂÈÏÄÉÍÏ, ÄÁÀÔÓÑ ÐÒÉÍÅÒÙ ÎÁÓÔÒÏÅË.</para>

    <para>ðÒÏÇÒÁÍÍÎÏÅ ÏÂÅÓÐÅÞÅÎÉÅ <acronym>TCP</acronym> Wrappers
      ÒÁÓÛÉÒÑÅÔ ×ÏÚÍÏÖÎÏÓÔØ <command>inetd</command> ÐÏ ÐÏÄÄÅÒÖËÅ
      ËÁÖÄÏÇÏ ÄÁÅÍÏÎÁ.  ó ÎÉÍ ÓÔÁÎÏ×ÉÔÓÑ ×ÏÚÍÏÖÎÙÍ ÐÒÏÔÏËÏÌÉÒÏ×ÁÎÉÅ,
      ×ÏÚ×ÒÁÔ ÓÏÏÂÝÅÎÉÊ ×ÙÚÙ×ÁÀÝÅÊ ÓÔÏÒÏÎÅ, ÏÇÒÁÎÉÞÅÎÉÅ ÐÏÄËÌÀÞÅÎÉÊ
      ×ÎÕÔÒÅÎÎÅÊ ÓÅÔØÀ É Ô.Ð.  èÏÔÑ ÎÅËÏÔÏÒÙÅ ÉÚ ÜÔÉÈ ×ÏÚÍÏÖÎÏÓÔÅÊ
      ÍÏÇÕÔ ÂÙÔØ ÒÅÁÌÉÚÏ×ÁÎÙ ÂÒÁÎÄÍÁÕÜÒÏÍ, <acronym>TCP</acronym>
      Wrappers ÎÅ ÔÏÌØËÏ ÐÒÅÄÏÓÔÁ×ÌÑÀÔ ÄÏÐÏÌÎÉÔÅÌØÎÙÊ ÕÒÏ×ÅÎØ ÚÁÝÉÔÙ,
      ÎÏ É ÄÁÀÔ ÂÏÌØÛÅ ËÏÎÔÒÏÌÑ ÎÁÄ ÓÉÓÔÅÍÏÊ, ÞÅÍ ÜÔÏ ×ÏÚÍÏÖÎÏ
      Ó ÂÒÁÎÄÍÁÕÜÒÏÍ.</para>

    <para>òÁÓÛÉÒÅÎÎÁÑ ÆÕÎËÃÉÏÎÁÌØÎÏÓÔØ ÏÂÒÁÂÏÔÞÉËÏ× <acronym>TCP</acronym>
      ÎÅ ÍÏÖÅÔ ÚÁÍÅÎÉÔØ ÈÏÒÏÛÉÊ ÓÅÔÅ×ÏÊ ÜËÒÁÎ.  ôÅÍ ÎÅ ÍÅÎÅÅ, ÏÂÒÁÂÏÔÞÉËÉ
      <acronym>TCP</acronym> ÍÏÇÕÔ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ ÓÏ×ÍÅÓÔÎÏ Ó ÓÅÔÅ×ÙÍ ÜËÒÁÎÏÍ
      É ÄÒÕÇÉÍÉ ÓÒÅÄÓÔ×ÁÍÉ ÏÂÅÓÐÅÞÅÎÉÑ ÉÎÆÏÒÍÁÃÉÏÎÎÏÊ ÂÅÚÏÐÁÓÎÏÓÔÉ, ÏÂÅÓÐÅÞÉ×ÁÑ
      ÔÅÍ ÓÁÍÙÍ ÄÏÐÏÌÎÉÔÅÌØÎÙÊ ÕÒÏ×ÅÎØ ÚÁÝÉÔÙ ÓÉÓÔÅÍÙ.</para>

    <para>ðÏÓËÏÌØËÕ ÒÁÓÓÍÁÔÒÉ×ÁÅÔÓÑ ÒÁÓÛÉÒÅÎÉÅ Ë ÎÁÓÔÒÏÊËÁÍ
      <command>inetd</command>, ÐÒÅÄÐÏÌÁÇÁÅÔÓÑ, ÞÔÏ ÞÉÔÁÔÅÌØ ÏÚÎÁËÏÍÉÌÓÑ
      Ó ÒÁÚÄÅÌÏÍ Ï <link linkend="network-inetd">ÎÁÓÔÒÏÊËÅ
      inetd</link>.</para>

    <note>
      <para>èÏÔÑ ÐÒÏÇÒÁÍÍÙ, ÚÁÐÕÓËÁÅÍÙÅ ÉÚ &man.inetd.8;, ÎÁ ÓÁÍÏÍ ÄÅÌÅ ÎÅ
	ÓÏÏÔ×ÅÔÓÔ×ÕÀÔ ÔÅÒÍÉÎÕ <quote>ÄÁÅÍÏÎÙ</quote>, ÓÕÝÅÓÔ×ÕÅÔ ÔÒÁÄÉÃÉÑ
	ÎÁÚÙ×ÁÔØ ÉÈ ÉÍÅÎÎÏ ÔÁË.  üÔÏÔ ÔÅÒÍÉÎ É ÉÓÐÏÌØÚÕÅÔÓÑ × ÄÁÎÎÏÍ
	ÒÁÚÄÅÌÅ.</para>
    </note>

    <sect2>
      <title>îÁÞÁÌØÎÁÑ ÎÁÓÔÒÏÊËÁ</title>

      <para>åÄÉÎÓÔ×ÅÎÎÏÅ ÔÒÅÂÏ×ÁÎÉÅ ÄÌÑ ÉÓÐÏÌØÚÏ×ÁÎÉÑ <acronym>TCP</acronym>
	Wrappers × &os; ÜÔÏ ÎÁÌÉÞÉÅ × <filename>rc.conf</filename>
	ÐÁÒÁÍÅÔÒÏ× ÚÁÐÕÓËÁ <command>inetd</command> <option>-Ww</option>;
	ÜÔÏ ÎÁÓÔÒÏÊËÉ ÐÏ ÕÍÏÌÞÁÎÉÀ.  ëÏÎÅÞÎÏ, ÏÖÉÄÁÅÔÓÑ ÔÁËÖÅ ÎÁÌÉÞÉÅ
	ÐÒÁ×ÉÌØÎÏÊ ÎÁÓÔÒÏÊËÉ <filename>/etc/hosts.allow</filename>,
	ÎÏ &man.syslogd.8; ÏÔÐÒÁ×ÉÔ ÓÏÏÂÝÅÎÉÑ × ÓÉÓÔÅÍÎÙÊ ÐÒÏÔÏËÏÌ ÅÓÌÉ
	ÞÔÏ-ÔÏ ÎÅ ÔÁË.</para>

      <note>
	<para>÷ ÏÔÌÉÞÉÅ ÏÔ ÄÒÕÇÉÈ ÒÅÁÌÉÚÁÃÉÊ <acronym>TCP</acronym>
	  Wrappers, ÉÓÐÏÌØÚÏ×ÁÎÉÅ <filename>hosts.deny</filename> ÎÅ
	  ÐÏÄÄÅÒÖÉ×ÁÅÔÓÑ.  ÷ÓÅ ÐÁÒÁÍÅÔÒÙ ÎÁÓÔÒÏÊËÉ ÄÏÌÖÎÙ ÂÙÔØ ÐÏÍÅÝÅÎÙ
	  × <filename>/etc/hosts.allow</filename>.</para>
      </note>

      <para>÷ ÐÒÏÓÔÅÊÛÅÊ ËÏÎÆÉÇÕÒÁÃÉÉ, ÐÏÌÉÔÉËÁ ÐÏÄËÌÀÞÅÎÉÑ Ó×ÏÄÉÔÓÑ Ë
	ÒÁÚÒÅÛÅÎÉÀ ÉÌÉ ÂÌÏËÉÒÏ×ÁÎÉÀ × ÚÁ×ÉÓÉÍÏÓÔÉ ÏÔ ÐÁÒÁÍÅÔÒÏ× ×
	<filename>/etc/hosts.allow</filename>.  îÁÓÔÒÏÊËÁ × &os;
	ÐÏ ÕÍÏÌÞÁÎÉÀ ÚÁËÌÀÞÁÅÔÓÑ × ÒÁÚÒÅÛÅÎÉÉ ÐÏÄËÌÀÞÅÎÉÑ Ë ÌÀÂÏÍÕ
	ÄÁÅÍÏÎÕ, ÚÁÐÕÝÅÎÎÏÍÕ ÉÚ <command>inetd</command>.  éÚÍÅÎÅÎÉÅ
	ÜÔÏÇÏ ÐÏ×ÅÄÅÎÉÑ ÂÕÄÅÔ ÏÂÓÕÖÄÁÔØÓÑ ÔÏÌØËÏ ÐÏÓÌÅ ÒÁÓÓÍÏÔÒÅÎÉÑ
	ÂÁÚÏ×ÏÊ ÎÁÓÔÒÏÊËÉ.</para>

      <para>âÁÚÏ×ÁÑ ÎÁÓÔÒÏÊËÁ ÏÂÙÞÎÏ ÐÒÉÎÉÍÁÅÔ ÆÏÒÍÕ
	<literal>daemon : address : action</literal>, ÇÄÅ
	<literal>daemon</literal> ÜÔÏ ÉÍÑ ÄÁÅÍÏÎÁ, ËÏÔÏÒÙÊ ÚÁÐÕÓËÁÅÔÓÑ
	<command>inetd</command>.  ÷ ÐÏÌÅ <literal>address</literal>
	ÍÏÖÅÔ ÎÁÈÏÄÉÔØÓÑ ÉÍÑ ÈÏÓÔÁ, <acronym>IP</acronym> ÁÄÒÅÓ, ÉÌÉ
	IPv6 ÁÄÒÅÓ, ÚÁËÌÀÞÅÎÎÙÊ × Ë×ÁÄÒÁÔÎÙÅ ÓËÏÂËÉ ([&nbsp;]).
	ðÏÌÅ action ÍÏÖÅÔ ÐÒÉÎÉÍÁÔØ ÚÎÁÞÅÎÉÑ allow ÉÌÉ deny,
	ÞÔÏÂÙ ÓÏÏÔ×ÅÔÓÔ×ÅÎÎÏ ÒÁÚÒÅÛÁÔØ ÉÌÉ ÚÁÐÒÅÝÁÔØ ÄÏÓÔÕÐ.
	ðÏÍÎÉÔÅ, ÞÔÏ ÐÏÉÓË ÐÒÁ×ÉÌ ÐÒÏÉÚ×ÏÄÉÔÓÑ ÄÏ ÐÅÒ×ÏÇÏ ÓÏ×ÐÁÄÅÎÉÑ.
	ðÒÉ ÏÂÎÁÒÕÖÅÎÉÉ ÓÏ×ÐÁÄÅÎÉÑ ÐÒÉÍÅÎÑÅÔÓÑ ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÅÅ ÐÒÁ×ÉÌÏ
	É ÐÏÉÓË ÐÒÅÒÙ×ÁÅÔÓÑ.</para>

      <para>óÕÝÅÓÔ×ÕÀÔ É ÄÒÕÇÉÅ ÐÁÒÁÍÅÔÒÙ, ÎÏ ÏÎÉ ÂÕÄÕÔ ÏÐÉÓÁÎÙ × ÓÌÅÄÕÀÝÉÈ
	ÒÁÚÄÅÌÁÈ.  ðÒÏÓÔÁÑ ËÏÎÆÉÇÕÒÁÃÉÑ ÍÏÖÅÔ ÂÙÔØ, ÎÁÐÒÉÍÅÒ, ÔÁËÏÊ:
	ÄÌÑ ÒÁÚÒÅÛÅÎÉÑ ÓÏÅÄÉÎÅÎÉÊ ÐÏ ÐÒÏÔÏËÏÌÕ <acronym>POP</acronym>3
	Ë ÄÁÅÍÏÎÕ <filename role="package">mail/qpopper</filename>,
	× <filename>hosts.allow</filename> ÎÅÏÂÈÏÄÉÍÏ ÄÏÂÁ×ÉÔØ ÓÌÅÄÕÀÝÉÅ
	ÓÔÒÏËÉ:</para>

      <programlisting># This line is required for POP3 connections:
qpopper : ALL : allow</programlisting>

      <para>ðÏÓÌÅ ÄÏÂÁ×ÌÅÎÉÑ ÜÔÏÊ ÓÔÒÏËÉ, <command>inetd</command>
	ÎÅÏÂÈÏÄÉÍÏ ÐÅÒÅÚÁÐÕÓÔÉÔØ.  üÔÏ ÍÏÖÎÏ ×ÙÐÏÌÎÉÔØ ËÏÍÁÎÄÏÊ
	&man.kill.1; ÉÌÉ ÓËÒÉÐÔÏÍ <filename>/etc/rc.d/inetd</filename>
	Ó ÐÁÒÁÍÅÔÒÏÍ <parameter>restart</parameter>.</para>
      </sect2>

      <sect2>
	<title>òÁÓÛÉÒÅÎÎÁÑ ËÏÎÆÉÇÕÒÁÃÉÑ</title>

      <para>õ <acronym>TCP</acronym> Wrappers ÉÍÅÀÔÓÑ ÄÏÐÏÌÎÉÔÅÌØÎÙÅ
	ÐÁÒÁÍÅÔÒÙ; ÏÎÉ ÄÁÀÔ ÄÏÐÏÌÎÉÔÅÌØÎÙÅ ×ÏÚÍÏÖÎÏÓÔÉ ËÏÎÔÒÏÌÑ ÎÁÄ
	ÓÏÅÄÉÎÅÎÉÑÍÉ.  éÎÏÇÄÁ ÂÙ×ÁÅÔ ÐÏÌÅÚÎÏ ×ÏÚ×ÒÁÝÁÔØ ËÏÍÍÅÎÔÁÒÉÊ
	ÏÐÒÅÄÅÌÅÎÎÙÍ ÈÏÓÔÁÍ ÉÌÉ ÐÒÉ ÐÏÄËÌÀÞÅÎÉÉ Ë ÏÐÒÅÄÅÌÅÎÎÙÍ
	ÄÁÅÍÏÎÁÍ.  ÷ ÄÒÕÇÉÈ ÓÌÕÞÁÑÈ ÍÏÖÅÔ ÂÙÔØ ÎÅÏÂÈÏÄÉÍÏ ÄÏÂÁ×ÉÔØ
	ÚÁÐÉÓØ × ÌÏÇ ÆÁÊÌ, ÉÌÉ ÏÔÐÒÁ×ÉÔØ ÐÉÓØÍÏ ÁÄÍÉÎÉÓÔÒÁÔÏÒÕ.
	÷ ÏÐÒÅÄÅÌÅÎÎÙÈ ÓÉÔÕÁÃÉÑÈ ÓÅÒ×ÉÓ ÄÏÌÖÅÎ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ
	ÔÏÌØËÏ ÄÌÑ ÌÏËÁÌØÎÙÈ ÓÏÅÄÉÎÅÎÉÊ.  ÷ÓÅ ÜÔÏ ×ÏÚÍÏÖÎÏ Ó
	ÉÓÐÏÌØÚÏ×ÁÎÉÅÍ ÐÁÒÁÍÅÔÒÏ× c ÛÁÂÌÏÎÁÍÉ, ÓÉÍ×ÏÌÁÍÉ ÐÏÄÓÔÁÎÏ×ËÉ
	É ÐÕÔÅÍ ×ÙÐÏÌÎÅÎÉÑ ×ÎÅÛÎÉÈ ËÏÍÁÎÄ.  óÌÅÄÕÀÝÉÅ Ä×Á ÒÁÚÄÅÌÁ
	ÐÏÓ×ÑÝÅÎÙ ÜÔÉÍ ÔÉÐÁÍ ÎÁÓÔÒÏÅË.</para>

      <sect3>
	<title>÷ÎÅÛÎÉÅ ËÏÍÁÎÄÙ</title>

	<para>ðÒÅÄÐÏÌÏÖÉÍ ÓÉÔÕÁÃÉÀ, × ËÏÔÏÒÏÊ ÓÏÅÄÉÎÅÎÉÅ ÄÏÌÖÎÏ
	  ÂÙÔØ ÚÁÐÒÅÝÅÎÏ, Á Ï ÐÒÉÞÉÎÅ ÎÅÏÂÈÏÄÉÍÏ ÓÏÏÂÝÉÔØ ×ÙÚÙ×ÁÀÝÅÊ
	  ÓÔÏÒÏÎÅ.  ëÁË ÜÔÏ ÍÏÖÎÏ ÓÄÅÌÁÔØ?  óÏÏÔ×ÅÔÓÔ×ÕÀÝÕÀ
	  ×ÏÚÍÏÖÎÏÓÔØ ÐÒÅÄÏÓÔÁ×ÌÑÅÔ ÐÁÒÁÍÅÔÒ <option>twist</option>.
	  ðÒÉ ÐÏÐÙÔËÅ ÐÏÄËÌÀÞÅÎÉÑ ×ÙÐÏÌÎÑÅÔÓÑ ËÏÍÁÎÄÁ ÉÌÉ ÓËÒÉÐÔ,
	  ÚÁÄÁÎÎÙÊ ÜÔÉÍ ÐÁÒÁÍÅÔÒÏÍ.  ðÒÉÍÅÒ ÄÁÎ × ÆÁÊÌÅ
	  <filename>hosts.allow</filename>:</para>

	<programlisting># The rest of the daemons are protected.
ALL : ALL \
        : severity auth.info \
        : twist /bin/echo "You are not welcome to use %d from %h."</programlisting>

	<para>÷ ÜÔÏÍ ÐÒÉÍÅÒÅ ÓÏÏÂÝÅÎÉÅ,
	  <quote>You are not allowed to use <literal>daemon</literal>
	  from <literal>hostname</literal>.</quote> ÂÕÄÅÔ ×ÏÚ×ÒÁÝÅÎÏ
	  ÏÔ ×ÓÅÈ ÄÁÅÍÏÎÏ×, ËÏÔÏÒÙÅ ÎÅ ÂÙÌÉ ÐÒÅÄ×ÁÒÉÔÅÌØÎÏ ÎÁÓÔÒÏÅÎÙ
	  × ÆÁÊÌÅ ÄÏÓÔÕÐÁ.  ïÂÒÁÔÉÔÅ ×ÎÉÍÁÎÉÅ, ÞÔÏ ×ÏÚ×ÒÁÝÁÅÍÏÅ
	  ÓÏÏÂÝÅÎÉÅ <emphasis>ÄÏÌÖÎÏ</emphasis> ÂÙÔØ ÚÁËÌÀÞÅÎÏ ×
	  ËÁ×ÙÞËÉ; ÉÚ ÜÔÏÇÏ ÐÒÁ×ÉÌÁ ÎÅÔ ÉÓËÌÀÞÅÎÉÊ.</para>

	<warning>
	  <para>÷ÏÚÍÏÖÎÁ ÒÅÁÌÉÚÁÃÉÑ DoS ÁÔÁËÉ, ËÏÇÄÁ ÇÒÕÐÐÁ
	    ÁÔÁËÕÀÝÉÈ ÐÒÏÉÚ×ÏÄÉÔ ÍÎÏÖÅÓÔ×Ï ÚÁÐÒÏÓÏ× ÎÁ ÐÏÄËÌÀÞÅÎÉÅ.</para>
	</warning>

	<para>÷ÏÚÍÏÖÎÏ ÔÁËÖÅ ÉÓÐÏÌØÚÏ×ÁÎÉÅ ÐÁÒÁÍÅÔÒÁ <option>spawn</option>.
	  ëÁË É ÐÁÒÁÍÅÔÒ <option>twist</option>, ÐÁÒÁÍÅÔÒ
	  <option>spawn</option> ÐÏÄÒÁÚÕÍÅ×ÁÅÔ ÚÁÐÒÅÔ ÓÏÅÄÉÎÅÎÉÑ
	  É ÍÏÖÅÔ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ ÄÌÑ ÚÁÐÕÓËÁ ËÏÍÁÎÄ ÉÌÉ ÓËÒÉÐÔÏ×.
	  ÷ ÏÔÌÉÞÉÅ ÏÔ <option>twist</option>, <option>spawn</option> ÎÅ
	  ÏÔÐÒÁ×ÌÑÅÔ ÏÔ×ÅÔ ×ÙÚÙ×ÁÀÝÅÊ ÓÔÏÒÏÎÅ.  îÁÐÒÉÍÅÒ, ÓÌÅÄÕÀÝÁÑ
	  ËÏÎÆÉÇÕÒÁÃÉÑ:</para>

	<programlisting># We do not allow connections from example.com:
ALL : .example.com \
        : spawn (/bin/echo %a from %h attempted to access %d &gt;&gt; \
          /var/log/connections.log) \
        : deny</programlisting>

	<para>ÏÔËÌÏÎÉÔ ×ÓÅ ÐÏÐÙÔËÉ ÓÏÅÄÉÎÅÎÉÑ ÉÚ ÄÏÍÅÎÁ
	  <hostid role="fqdn">*.example.com</hostid>; ÉÍÑ ÈÏÓÔÁ,
	  <acronym>IP</acronym> ÁÄÒÅÓ É ÄÁÅÍÏÎ ÐÒÏÔÏËÏÌÉÒÕÀÔÓÑ × ÆÁÊÌ
	  <filename>/var/log/connections.log</filename>.</para>

	<para>ðÏÍÉÍÏ ÐÒÉ×ÅÄÅÎÎÙÈ ×ÙÛÅ ÓÉÍ×ÏÌÏ× ÐÏÄÓÔÁÎÏ×ËÉ, ÎÁÐÒÉÍÅÒ
	  %a, ÓÕÝÅÓÔ×ÕÅÔ ÅÝÅ ÎÅÓËÏÌØËÏ ÓÉÍ×ÏÌÏ×.  ïÂÒÁÔÉÔÅÓØ Ë ÓÔÒÁÎÉÃÅ
	  &man.hosts.access.5; ÓÐÒÁ×ÏÞÎÏÊ ÓÉÓÔÅÍÙ ÚÁ ÐÏÌÎÙÍ ÓÐÉÓËÏÍ.</para>
      </sect3>

      <sect3>
	<title>ðÁÒÁÍÅÔÒÙ &ndash; ÛÁÂÌÏÎÙ</title>

	<para>äÏ ÜÔÏÇÏ ÍÏÍÅÎÔÁ × ÐÒÉÍÅÒÁÈ ÉÓÐÏÌØÚÏ×ÁÌÓÑ ÛÁÂÌÏÎ
	  <literal>ALL</literal>.  óÕÝÅÓÔ×ÕÀÔ É ÄÒÕÇÉÅ ÐÁÒÁÍÅÔÒÙ,
	  ÆÕÎËÃÉÏÎÁÌØÎÏÓÔØ ËÏÔÏÒÙÈ × ÄÁÌØÎÅÊÛÅÍ ÍÏÖÅÔ ÂÙÔØ ÒÁÓÛÉÒÅÎÁ.
	  <literal>ALL</literal> ÓÏÏÔ×ÅÔÓÔ×ÕÅÔ ÌÀÂÏÍÕ ÄÁÅÍÏÎÕ,
	  ÄÏÍÅÎÕ ÉÌÉ <acronym>IP</acronym> ÁÄÒÅÓÕ.  äÒÕÇÏÊ ÄÏÓÔÕÐÎÙÊ
	  ÛÁÂÌÏÎ ÜÔÏ <literal>PARANOID</literal>, ËÏÔÏÒÙÊ ÓÏÏÔ×ÅÔÓÔ×ÕÅÔ
	  ÈÏÓÔÕ, <acronym>IP</acronym> ÁÄÒÅÓ ËÏÔÏÒÏÇÏ ÍÏÖÅÔ ÂÙÔØ
	  ÐÏÄÄÅÌÁÎ.  äÒÕÇÉÍÉ ÓÌÏ×ÁÍÉ, <literal>paranoid</literal>
	  ÍÏÖÅÔ ÂÙÔØ ÉÓÐÏÌØÚÏ×ÁÎ ÄÌÑ ÏÐÒÅÄÅÌÅÎÉÑ ÄÅÊÓÔ×ÉÑ Ó ÈÏÓÔÁÍÉ,
	  <acronym>IP</acronym> ÁÄÒÅÓ ËÏÔÏÒÙÈ ÎÅ ÓÏÏÔ×ÅÔÓÔ×ÕÅÔ ÉÍÅÎÉ
	  ÈÏÓÔÁ.  ÷ÏÔ ÐÒÉÍÅÒ ÐÒÉÍÅÎÅÎÉÑ ÜÔÏÇÏ ÐÁÒÁÍÅÔÒÁ:</para>

	<programlisting># Block possibly spoofed requests to sendmail:
sendmail : PARANOID : deny</programlisting>

	<para>÷ ÜÔÏÍ ÐÒÉÍÅÒÅ ×ÓÅ ÚÁÐÒÏÓÙ ÎÁ ÐÏÄËÌÀÞÅÎÉÑ Ë
	  <command>sendmail</command> ÏÔ ÈÏÓÔÏ×, <acronym>IP</acronym>
	  ÁÄÒÅÓ ËÏÔÏÒÙÈ ÎÅ ÓÏÏÔ×ÅÔÓÔ×ÕÅÔ ÉÍÅÎÉ ÈÏÓÔÁ, ÂÕÄÕÔ
	  ÏÔËÌÏÎÅÎÙ.</para>

	<caution>
	  <para>éÓÐÏÌØÚÏ×ÁÎÉÅ <literal>PARANOID</literal> ÎÅ×ÏÚÍÏÖÎÏ,
	    ÅÓÌÉ Õ ËÌÉÅÎÔÁ ÉÌÉ ÓÅÒ×ÅÒÁ ÎÅÐÒÁ×ÉÌØÎÏ ÎÁÓÔÒÏÅÎ
	    <acronym>DNS</acronym>.  ÷ ÔÁËÉÈ ÓÌÕÞÁÑÈ ÎÅÏÂÈÏÄÉÍÏ
	    ×ÍÅÛÁÔÅÌØÓÔ×Ï ÁÄÍÉÎÉÓÔÒÁÔÏÒÁ.</para>
	</caution>

	<para>âÏÌÅÅ ÐÏÄÒÏÂÎÁÑ ÉÎÆÏÒÍÁÃÉÑ Ï ÛÁÂÌÏÎÁÈ É ÉÈ ×ÏÚÍÏÖÎÏÓÔÑÈ
	  ÄÁÎÁ ÎÁ ÓÔÒÁÎÉÃÅ &man.hosts.access.5; ÓÐÒÁ×ÏÞÎÏÊ
	  ÓÉÓÔÅÍÙ.</para>

	<para>äÌÑ ÔÏÇÏ, ÞÔÏÂÙ ÌÀÂÁÑ ×ÙÂÒÁÎÎÁÑ ËÏÎÆÉÇÕÒÁÃÉÑ ÚÁÒÁÂÏÔÁÌÁ,
	  × <filename>hosts.allow</filename> ÎÅÏÂÈÏÄÉÍÏ ÚÁËÏÍÍÅÎÔÉÒÏ×ÁÔØ
	  ÐÅÒ×ÕÀ ÓÔÒÏËÕ ÎÁÓÔÒÏÊËÉ.  ÷ ÎÁÞÁÌÅ ÒÁÚÄÅÌÁ ÏÂ ÜÔÏÍ ÎÅ
	  ÕÐÏÍÉÎÁÌÏÓØ.</para>
      </sect3>
    </sect2>
  </sect1>

<!--
  òÁÚÄÅÌÙ ÐÏ Kerberos ÐÅÒÅ×ÅÄÅÎÙ ÎÅ ×ÐÏÌÎÅ ËÏÒÒÅËÔÎÏ × Ó×ÑÚÉ Ó ÉÓÐÏÌØÚÏ×ÁÎÉÅÍ
  ÓÌÅÄÕÀÝÉÈ ÔÅÒÍÉÎÏ×: principal, ticket, realm, credentials.
  ÷ÏÚÍÏÖÎÏ, ÔÒÅÂÕÅÔÓÑ ÓÕÝÅÓÔ×ÅÎÎÁÑ ÐÅÒÅÒÁÂÏÔËÁ ÐÅÒÅ×ÏÄÁ.
-->

  <sect1 id="kerberosIV">
    <sect1info>
      <authorgroup>
	<author>
	  <firstname>Mark</firstname>
	  <surname>Murray</surname>
	  <contrib>ðÒÅÄÏÓÔÁ×ÉÌ </contrib>
	</author>
      </authorgroup>
      <authorgroup>
	<author>
	  <firstname>Mark</firstname>
	  <surname>Dapoz</surname>
	  <contrib>ïÒÉÇÉÎÁÌØÎÙÊ ÔÅËÓÔ ÐÒÅÄÏÓÔÁ×ÉÌ </contrib>
	</author>
      </authorgroup>
    </sect1info>

    <title><application>KerberosIV</application></title>

    <para>Kerberos ÜÔÏ ÓÅÔÅ×ÁÑ ÄÏÐÏÌÎÉÔÅÌØÎÁÑ ÓÉÓÔÅÍÁ/ÐÒÏÔÏËÏÌ, ËÏÔÏÒÁÑ
      ÄÅÌÁÅÔ ×ÏÚÍÏÖÎÏÊ ÁÕÔÅÎÔÉÆÉËÁÃÉÀ ÐÏÌØÚÏ×ÁÔÅÌÅÊ ÞÅÒÅÚ ÓÅÒ×ÉÓÙ ÎÁ ÚÁÝÉÝÅÎÎÏÍ
      ÓÅÒ×ÅÒÅ.  ôÁËÉÅ ÓÅÒ×ÉÓÙ, ËÁË ÕÄÁÌÅÎÎÙÊ ×ÈÏÄ, ÕÄÁÌÅÎÎÏÅ ËÏÐÉÒÏ×ÁÎÉÅ,
      ÚÁÝÉÝÅÎÎÏÅ ËÏÐÉÒÏ×ÁÎÉÅ ÆÁÊÌÏ× ÍÅÖÄÕ ÓÉÓÔÅÍÁÍÉ É ÄÒÕÇÉÅ ÚÁÄÁÞÉ Ó
      ×ÙÓÏËÉÍ ÒÉÓËÏÍ ÓÔÁÎÏ×ÑÔÓÑ ÄÏÐÕÓÔÉÍÏ ÂÅÚÏÐÁÓÎÙÍÉ É ÂÏÌÅÅ
      ËÏÎÔÒÏÌÉÒÕÅÍÙÍÉ.</para>

    <para>ðÏÓÌÅÄÕÀÝÉÅ ÉÎÓÔÒÕËÃÉÉ ÍÏÇÕÔ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ × ËÁÞÅÓÔ×Å ÒÕËÏ×ÏÄÓÔ×Á
      ÐÏ ÎÁÓÔÒÏÊËÅ ÐÏÓÔÁ×ÌÑÅÍÏÇÏ Ó &os; Kerberos.  ôÅÍ ÎÅ ÍÅÎÅÅ, ×ÁÍ
      ÍÏÇÕÔ ÐÏÔÒÅÂÏ×ÁÔØÓÑ ÓÔÒÁÎÉÃÙ ÓÐÒÁ×ÏÞÎÉËÁ ÐÏÌÎÏÇÏ ÄÉÓÔÒÉÂÕÔÉ×Á.</para>

    <sect2>
      <title>õÓÔÁÎÏ×ËÁ <application>KerberosIV</application></title>

      <indexterm><primary>MIT</primary></indexterm>

      <indexterm>
	<primary>KerberosIV</primary>
	<secondary>ÕÓÔÁÎÏ×ËÁ</secondary>
      </indexterm>

      <para>Kerberos ÜÔÏ ÏÐÃÉÏÎÁÌØÎÙÊ ËÏÍÐÏÎÅÎÔ &os;.  ðÒÏÓÔÅÊÛÉÊ ÓÐÏÓÏÂ
	ÕÓÔÁÎÏ×ËÉ ÜÔÏÊ ÐÒÏÇÒÁÍÍÙ ÜÔÏ ×ÙÂÏÒ <literal>krb4</literal> ÉÌÉ
	<literal>krb5</literal> ÉÚ <application>sysinstall</application>
	×Ï ×ÒÅÍÑ ÐÅÒ×ÏÊ ÕÓÔÁÎÏ×ËÉ &os;.  âÕÄÅÔ ÕÓÔÁÎÏ×ÌÅÎ
	<quote>eBones</quote> (KerberosIV) ÉÌÉ <quote>Heimdal</quote>
	(Kerberos5) ×ÁÒÉÁÎÔ Kerberos.  ÷ËÌÀÞÅÎÉÅ ÜÔÉÈ ÒÅÁÌÉÚÁÃÉÊ ÏÂßÑÓÎÑÅÔÓÑ
	ÔÅÍ, ÞÔÏ ÏÎÉ ÒÁÚÒÁÂÏÔÁÎÙ ×ÎÅ óûá/ëÁÎÁÄÙ É ÄÏÓÔÕÐÎÙ ×ÎÅ ÜÔÉÈ ÓÔÒÁÎ,
	ÐÏÓËÏÌØËÕ ÎÁ ÎÉÈ ÎÅ ×ÌÉÑÀÔ ÏÇÒÁÎÉÞÅÎÉÑ ÎÁ ÜËÓÐÏÒÔ ËÒÉÐÔÏÇÒÁÆÉÞÅÓËÏÇÏ
	ËÏÄÁ ÉÚ óûá.</para>

      <para>ëÒÏÍÅ ÔÏÇÏ, ÒÅÁÌÉÚÁÃÉÑ MIT Kerberos ÄÏÓÔÕÐÎÁ ÉÚ ëÏÌÌÅËÃÉÉ ðÏÒÔÏ×
	× ×ÉÄÅ ÐÁËÅÔÁ
	<filename role="package">security/krb5</filename>.</para>
    </sect2>

    <sect2>
      <title>óÏÚÄÁÎÉÅ ÂÁÚÙ ÄÁÎÎÙÈ</title>

      <para>üÔÏ ÎÅÏÂÈÏÄÉÍÏ ÓÄÅÌÁÔØ ÔÏÌØËÏ ÎÁ ÓÅÒ×ÅÒÅ Kerberos.  ÷Ï-ÐÅÒ×ÙÈ,
	ÕÂÅÄÉÔÅÓØ ÞÔÏ ÎÅ ÏÓÔÁÌÏÓØ ÓÔÁÒÏÊ ÂÁÚÙ ÄÁÎÎÙÈ Kerberos.  ÷ÏÊÄÉÔÅ
	× ËÁÔÁÌÏÇ <filename>/etc/kerberosIV</filename> É ÕÂÅÄÉÔÅÓØ, ÞÔÏ × ÎÅÍ
	ÎÁÈÏÄÑÔÓÑ ÔÏÌØËÏ ÜÔÉ ÆÁÊÌÙ:</para>

      <screen>&prompt.root; <userinput>cd /etc/kerberosIV</userinput>
&prompt.root; <userinput>ls</userinput>
README	        krb.conf        krb.realms</screen>

      <para>åÓÌÉ ÐÒÉÓÕÔÓÔ×ÕÀÔ ÅÝÅ ËÁËÉÅ-ÔÏ ÆÁÊÌÙ (ÔÁËÉÅ ËÁË
	<filename>principal.*</filename> ÉÌÉ <filename>master_key</filename>),
	ÉÓÐÏÌØÚÕÊÔÅ ËÏÍÁÎÄÕ <command>kdb_destroy</command> ÄÌÑ ÕÄÁÌÅÎÉÑ ÓÔÁÒÏÊ
	ÂÁÚÙ ÄÁÎÎÙÈ Kerberos, ÉÌÉ, ÅÓÌÉ Kerberos ÎÅ ÚÁÐÕÝÅÎ, ÐÒÏÓÔÏ ÕÄÁÌÉÔÅ
	ÜÔÉ ÆÁÊÌÙ.</para>

      <para>úÁÔÅÍ ÏÔÒÅÄÁËÔÉÒÕÊÔÅ ÆÁÊÌÙ <filename>krb.conf</filename> É
	<filename>krb.realms</filename>, ××ÅÄÑ ×ÁÛÉ ÄÁÎÎÙÅ.  ÷ ÜÔÏÍ ÐÒÉÍÅÒÅ
	ÕÎÉËÁÌØÎÙÊ ÉÄÅÎÔÉÆÉËÁÔÏÒ <literal>EXAMPLE.COM</literal>, ÓÅÒ×ÅÒ
	<hostid role="fqdn">grunt.example.com</hostid>.  ïÔÒÅÄÁËÔÉÒÕÅÍ ÉÌÉ
	ÓÏÚÄÁÄÉÍ ÆÁÊÌ <filename>krb.conf</filename>:</para>

      <screen>&prompt.root; <userinput>cat krb.conf</userinput>
EXAMPLE.COM
EXAMPLE.COM grunt.example.com admin server
CS.BERKELEY.EDU okeeffe.berkeley.edu
ATHENA.MIT.EDU kerberos.mit.edu
ATHENA.MIT.EDU kerberos-1.mit.edu
ATHENA.MIT.EDU kerberos-2.mit.edu
ATHENA.MIT.EDU kerberos-3.mit.edu
LCS.MIT.EDU kerberos.lcs.mit.edu
TELECOM.MIT.EDU bitsy.mit.edu
ARC.NASA.GOV trident.arc.nasa.gov</screen>

      <para>÷ ÜÔÏÍ ÐÒÉÍÅÒÅ ÄÒÕÇÉÅ ÉÄÅÎÔÉÆÉËÁÔÏÒÙ ××ÅÄÅÎÙ ÄÌÑ ÉÌÌÀÓÔÒÁÃÉÉ
	ÎÁÓÔÒÏÊËÉ c ÎÅÓËÏÌØËÉÍÉ ÈÏÓÔÁÍÉ.  ó ÃÅÌØÀ ÕÐÒÏÝÅÎÉÑ
	ÎÁÓÔÒÏÊËÉ ×Ù ÍÏÖÅÔÅ ÎÅ ×ËÌÀÞÁÔØ ÉÈ.</para>

      <para>ðÅÒ×ÁÑ ÓÔÒÏËÁ ÓÏÄÅÒÖÉÔ ÉÄÅÎÔÉÆÉËÁÔÏÒ, ÐÏÄ ËÏÔÏÒÙÍ ÒÁÂÏÔÁÅÔ ÜÔÁ
	ÓÉÓÔÅÍÁ.  ïÓÔÁÌØÎÙÅ ÓÔÒÏËÉ Ó×ÑÚÙ×ÁÀÔ ÉÄÅÎÔÉÆÉËÁÔÏÒÙ Ó ÉÍÅÎÁÍÉ ÈÏÓÔÏ×.
	óÎÁÞÁÌÁ ÕËÁÚÙ×ÁÅÔÓÑ ÉÄÅÎÔÉÆÉËÁÔÏÒ, ÚÁÔÅÍ ÈÏÓÔ ÐÏÄ ÜÔÉÍ
	ÉÄÅÎÔÉÆÉËÁÔÏÒÏÍ, ÒÁÂÏÔÁÀÝÉÊ ËÁË <quote>ÃÅÎÔÒ ÒÁÓÐÒÏÓÔÒÁÎÅÎÉÑ
	ËÌÀÞÅÊ</quote>.  óÌÏ×Á <literal>admin server</literal> Ó ÐÏÓÌÅÄÕÀÝÉÍ
	ÉÍÅÎÅÍ ÈÏÓÔÁ ÏÚÎÁÞÁÀÔ, ÞÔÏ ÜÔÏÔ ÈÏÓÔ ÔÁËÖÅ Ñ×ÌÑÅÔÓÑ ÓÅÒ×ÅÒÏÍ
	ÁÄÍÉÎÉÓÔÒÉÒÏ×ÁÎÉÑ ÂÁÚÙ ÄÁÎÎÙÈ.  úÁ ÄÁÌØÎÅÊÛÅÊ ÉÎÆÏÒÍÁÃÉÅÊ Ï ÜÔÉÈ
	ÔÅÒÍÉÎÁÈ ÏÂÒÁÔÉÔÅÓØ Ë ÓÔÒÁÎÉÃÁÍ ÓÐÒÁ×ÏÞÎÉËÁ ÐÏ Kerberos.</para>

      <para>íÙ ÄÏÂÁ×ÉÌÉ <hostid role="fqdn">grunt.example.com</hostid>
	Ë ÉÄÅÎÔÉÆÉËÁÔÏÒÕ <literal>EXAMPLE.COM</literal> É ËÒÏÍÅ ÔÏÇÏ
	ÓÏÐÏÓÔÁ×ÉÌÉ ×ÓÅÍ ÈÏÓÔÁÍ × ÄÏÍÅÎÅ
	<hostid role="domainname">.example.com</hostid> ÉÄÅÎÔÉÆÉËÁÔÏÒ
	<literal>EXAMPLE.COM</literal>.  æÁÊÌ
	<filename>krb.realms</filename> ÂÕÄÅÔ ×ÙÇÌÑÄÅÔØ ÔÁË:</para>

      <screen>&prompt.root; <userinput>cat krb.realms</userinput>
grunt.example.com EXAMPLE.COM
.example.com EXAMPLE.COM
.berkeley.edu CS.BERKELEY.EDU
.MIT.EDU ATHENA.MIT.EDU
.mit.edu ATHENA.MIT.EDU</screen>

      <para>ëÁË É × ÐÒÅÄÙÄÕÝÅÍ ÐÒÉÍÅÒÅ, ÄÒÕÇÉÅ ÉÄÅÎÔÉÆÉËÁÔÏÒÙ ÄÏÂÁ×ÌÅÎÙ ÔÏÌØËÏ
	ÄÌÑ ÐÒÉÍÅÒÁ.  ó ÃÅÌØÀ ÕÐÒÏÝÅÎÉÑ ÎÁÓÔÒÏÊËÉ ×Ù ÍÏÖÅÔÅ ÎÅ ×ËÌÀÞÁÔØ
	ÉÈ.</para>

      <para>÷ ÐÅÒ×ÏÊ ÓÔÒÏËÅ <emphasis>ÏÐÒÅÄÅÌÅÎÎÁÑ</emphasis> ÓÉÓÔÅÍÁ
	ÓÏÐÏÓÔÁ×ÌÑÅÔÓÑ Ó ÉÄÅÎÔÉÆÉËÁÔÏÒÏÍ.  ÷ ÏÓÔÁÌØÎÙÈ ÓÔÒÏËÁÈ ÐÏËÁÚÁÎÏ,
	ÓÏÐÏÓÔÁ×ÉÔØ ÉÄÅÎÔÉÆÉËÁÔÏÒÕ ÏÓÔÁÌØÎÙÅ ÓÉÓÔÅÍÙ ÏÐÒÅÄÅÌÅÎÎÏÇÏ
	ÐÏÄÄÏÍÅÎÁ.</para>

      <para>ôÅÐÅÒØ ÍÙ ÇÏÔÏ×Ù Ë ÓÏÚÄÁÎÉÀ ÂÁÚÙ ÄÁÎÎÙÈ.  ðÏÔÒÅÂÕÅÔÓÑ ×ÓÅÇÏ ÌÉÛØ
	ÚÁÐÕÓÔÉÔØ ÓÅÒ×ÅÒ Kerberos (ÉÌÉ ÃÅÎÔÒ ÒÁÓÐÒÏÓÔÒÁÎÅÎÉÑ ËÌÀÞÅÊ).
	éÓÐÏÌØÚÕÊÔÅ ÄÌÑ ÜÔÏÇÏ <command>kdb_init</command>:</para>

      <screen>&prompt.root; <userinput>kdb_init</userinput>
<prompt>Realm name [default  ATHENA.MIT.EDU ]:</prompt> <userinput>EXAMPLE.COM</userinput>
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.

<prompt>÷×ÅÄÉÔÅ ÇÌÁ×ÎÙÊ ËÌÀÞ Kerberos:</prompt> </screen>

      <para>ôÅÐÅÒØ ÍÙ ÄÏÌÖÎÙ ÓÏÈÒÁÎÉÔØ ËÌÀÞ, ÞÔÏÂÙ ÓÅÒ×ÅÒÁ ÎÁ ÌÏËÁÌØÎÙÈ
	ËÏÍÐØÀÔÅÒÁÈ ÍÏÇÌÉ ÅÇÏ ×ÚÑÔØ.  éÓÐÏÌØÚÕÊÔÅ ÄÌÑ ÜÔÏÇÏ ËÏÍÁÎÄÕ
	<command>kstash</command>:</para>

      <screen>&prompt.root; <userinput>kstash</userinput>

<prompt>Enter Kerberos master key:</prompt>

Current Kerberos master key version is 1.

Master key entered. BEWARE!</screen>

      <para>üÔÏÊ ËÏÍÁÎÄÏÊ ÚÁÛÉÆÒÏ×ÁÎÎÙÊ ÇÌÁ×ÎÙÊ ÐÁÒÏÌØ ÓÏÈÒÁÎÅÎ ×
	<filename>/etc/kerberosIV/master_key</filename>.</para>
    </sect2>

    <sect2>
      <title>úÁÐÕÓË Kerberos</title>

      <indexterm>
	<primary>KerberosIV</primary>

	<secondary>ÐÅÒ×ÙÊ ÚÁÐÕÓË</secondary>
      </indexterm>

      <para>äÌÑ ËÁÖÄÏÊ ÓÉÓÔÅÍÙ, ÚÁÝÉÝÁÅÍÏÊ Kerberos, × ÂÁÚÕ ÄÁÎÎÙÈ ÄÏÌÖÎÙ
	ÂÙÔØ ÄÏÂÁ×ÌÅÎÙ Ä×Å ÚÁÐÉÓÉ.  üÔÏ <literal>kpasswd</literal> É
	<literal>rcmd</literal>.  ïÎÉ ÄÏÂÁ×ÌÑÀÔÓÑ ×ÍÅÓÔÅ Ó ÉÍÅÎÅÍ
	ÓÉÓÔÅÍÙ.</para>

      <para>üÔÉ ÄÁÅÍÏÎÙ, <application>kpasswd</application> É
	<application>rcmd</application> ÐÏÚ×ÏÌÑÀÔ ÄÒÕÇÉÍ ÓÉÓÔÅÍÁÍ ÉÚÍÅÎÑÔØ
	ÐÁÒÏÌÉ Kerberos É ÚÁÐÕÓËÁÔØ ÔÁËÉÅ ËÏÍÁÎÄÙ ËÁË &man.rcp.1;,
	&man.rlogin.1;, &man.rsh.1;.</para>

      <para>ôÅÐÅÒØ ÄÏÂÁ×ÉÍ ÜÔÉ ÚÁÐÉÓÉ:</para>

      <screen>&prompt.root; <userinput>kdb_edit</userinput>
Opening database...

<prompt>Enter Kerberos master key:</prompt>

Current Kerberos master key version is 1.

Master key entered.  BEWARE!
Previous or default values are in [brackets] ,
enter return to leave the same, or new value.

<prompt>Principal name:</prompt> <userinput>passwd</userinput>
<prompt>Instance:</prompt> <userinput>grunt</userinput>

&lt;Not found&gt;, <prompt>Create [y] ?</prompt> <userinput>y</userinput>

Principal: passwd, Instance: grunt, kdc_key_ver: 1
<prompt>New Password:</prompt>                    &lt;---- enter RANDOM here
Verifying password

<prompt>New Password:</prompt> &lt;---- enter RANDOM here

<prompt>Random password [y] ?</prompt> <userinput>y</userinput>

Principal's new key version = 1
<prompt>Expiration date (enter yyyy-mm-dd) [ 2000-01-01 ] ?</prompt>
<prompt>Max ticket lifetime (*5 minutes) [ 255 ] ?</prompt>
<prompt>Attributes [ 0 ] ?</prompt>
Edit O.K.
<prompt>Principal name:</prompt> <userinput>rcmd</userinput>
<prompt>Instance:</prompt> <userinput>grunt</userinput>

&lt;Not found&gt;, <prompt>Create [y] ?</prompt>

Principal: rcmd, Instance: grunt, kdc_key_ver: 1
<prompt>New Password:</prompt>		&lt;---- enter RANDOM here
Verifying password

<prompt>New Password:</prompt>           &lt;---- enter RANDOM here

<prompt>Random password [y] ?</prompt>

Principal's new key version = 1
<prompt>Expiration date (enter yyyy-mm-dd) [ 2000-01-01 ] ?</prompt>
<prompt>Max ticket lifetime (*5 minutes) [ 255 ] ?</prompt>
<prompt>Attributes [ 0 ] ?</prompt>
Edit O.K.
<prompt>Principal name:</prompt>         &lt;---- null entry here will cause an exit</screen>
    </sect2>

    <sect2>
      <title>óÏÚÄÁÎÉÅ ÆÁÊÌÁ ÎÁÓÔÒÏÊËÉ ÓÅÒ×ÅÒÁ</title>

      <para>ôÅÐÅÒØ ÎÅÏÂÈÏÄÉÍÏ ÓÏÚÄÁÔØ ×ÓÅ ÚÁÐÉÓÉ ÓÅÒ×ÉÓÏ×, ËÏÔÏÒÙÅ ÂÙÌÉ
	ÏÐÒÅÄÅÌÅÎÙ ÄÌÑ ËÁÖÄÏÇÏ ËÏÍÐØÀÔÅÒÁ.  éÓÐÏÌØÚÕÅÍ ÄÌÑ ÜÔÏÇÏ ËÏÍÁÎÄÕ
	<command>ext_srvtab</command>.  âÕÄÅÔ ÓÏÚÄÁÎ ÆÁÊÌ, ËÏÔÏÒÙÊ ÄÏÌÖÅÎ
	ÂÙÔØ ÓËÏÐÉÒÏ×ÁÎ ÉÌÉ ÐÅÒÅÍÅÝÅÎ <emphasis>ÂÅÚÏÐÁÓÎÙÍ ÓÐÏÓÏÂÏÍ</emphasis>
	× ËÁÔÁÌÏÇ <filename>/etc/kerberosIV</filename> ËÁÖÄÏÇÏ Kerberos
	ËÌÉÅÎÔÁ.  üÔÏÔ ÆÁÊÌ ÄÏÌÖÅÎ ÐÒÉÓÕÔÓÔ×Ï×ÁÔØ ÎÁ ËÁÖÄÏÍ ÓÅÒ×ÅÒÅ É
	ËÌÉÅÎÔÅ, ÏÎ ÎÅÏÂÈÏÄÉÍ ÄÌÑ ÒÁÂÏÔÙ Kerberos.</para>

      <screen>&prompt.root; <userinput>ext_srvtab grunt</userinput>
<prompt>Enter Kerberos master key:</prompt>

Current Kerberos master key version is 1.

Master key entered. BEWARE!
Generating 'grunt-new-srvtab'....</screen>

      <para>üÔÁ ËÏÍÁÎÄÁ ÓÏÚÄÁÓÔ ×ÒÅÍÅÎÎÙÊ ÆÁÊÌ, ËÏÔÏÒÙÊ ÄÏÌÖÅÎ ÂÙÔØ
	ÐÅÒÅÉÍÅÎÏ×ÁÎ × <filename>srvtab</filename>, ÞÔÏÂÙ ÓÅÒ×ÅÒÙ ÓÍÏÇÌÉ
	ÏÂÒÁÔÉÔØÓÑ Ë ÎÅÍÕ.  éÓÐÏÌØÚÕÊÔÅ ËÏÍÁÎÄÕ &man.mv.1; ÄÌÑ ÐÅÒÅÍÅÝÅÎÉÑ
	ÅÇÏ × ÉÓÈÏÄÎÏÊ ÓÉÓÔÅÍÅ:</para>

      <screen>&prompt.root; <userinput>mv grunt-new-srvtab srvtab</userinput></screen>

      <para>åÓÌÉ ÆÁÊÌ ÐÒÅÄÎÁÚÎÁÞÅÎ ÄÌÑ ËÌÉÅÎÔÓËÏÊ ÓÉÓÔÅÍÙ, É ÓÅÔØ ÎÅ
	ÂÅÚÏÐÁÓÎÁ, ÓËÏÐÉÒÕÊÔÅ
	<filename><replaceable>client</replaceable>-new-srvtab</filename>
	ÎÁ ÓßÅÍÎÙÊ ÎÏÓÉÔÅÌØ É ÐÅÒÅÎÅÓÉÔÅ ÆÁÊÌ Ó ÅÇÏ ÐÏÍÏÝØÀ.  õÂÅÄÉÔÅÓØ, ÞÔÏ
	ÐÅÒÅÉÍÅÎÏ×ÁÌÉ ÅÇÏ × <filename>srvtab</filename> × ËÁÔÁÌÏÇÅ
	<filename>/etc/kerberosIV</filename> ËÌÉÅÎÔÁ, É ÞÔÏ ÒÅÖÉÍ ÄÏÓÔÕÐÁ Ë
	ÎÅÍÕ 600:</para>

      <screen>&prompt.root; <userinput>mv grumble-new-srvtab srvtab</userinput>
&prompt.root; <userinput>chmod 600 srvtab</userinput></screen>
    </sect2>

    <sect2>
      <title>ðÏÐÏÌÎÅÎÉÅ ÂÁÚÙ ÄÁÎÎÙÈ</title>

      <para>ôÅÐÅÒØ ÎÅÏÂÈÏÄÉÍÏ ÄÏÂÁ×ÉÔØ × ÂÁÚÕ ÄÁÎÎÙÈ ÐÏÌØÚÏ×ÁÔÅÌÅÊ.
	÷Ï-ÐÅÒ×ÙÈ, ÓÏÚÄÁÄÉÍ ÚÁÐÉÓØ ÄÌÑ ÐÏÌØÚÏ×ÁÔÅÌÑ <username>jane</username>.
	éÓÐÏÌØÚÕÊÔÅ ËÏÍÁÎÄÕ <command>kdb_edit</command>:</para>

      <screen>&prompt.root; <userinput>kdb_edit</userinput>
Opening database...

<prompt>Enter Kerberos master key:</prompt>

Current Kerberos master key version is 1.

Master key entered.  BEWARE!
Previous or default values are in [brackets] ,
enter return to leave the same, or new value.

<prompt>Principal name:</prompt> <userinput>jane</userinput>
<prompt>Instance:</prompt>

&lt;Not found&gt;, <prompt>Create [y] ?</prompt> <userinput>y</userinput>

Principal: jane, Instance: , kdc_key_ver: 1
<prompt>New Password:</prompt>                &lt;---- enter a secure password here
Verifying password

<prompt>New Password:</prompt>                &lt;---- re-enter the password here
Principal's new key version = 1
<prompt>Expiration date (enter yyyy-mm-dd) [ 2000-01-01 ] ?</prompt>
<prompt>Max ticket lifetime (*5 minutes) [ 255 ] ?</prompt>
<prompt>Attributes [ 0 ] ?</prompt>
Edit O.K.
<prompt>Principal name:</prompt>		   &lt;---- null entry here will cause an exit</screen>
    </sect2>

    <sect2>
      <title>ôÅÓÔÉÒÏ×ÁÎÉÅ ×ÓÅÊ ÓÉÓÔÅÍÙ</title>

      <para>÷Ï-ÐÅÒ×ÙÈ, ÚÁÐÕÓÔÉÔÅ ÄÁÅÍÏÎÙ Kerberos.  ðÒÉ ÐÒÁ×ÉÌØÎÏÍ
	ÒÅÄÁËÔÉÒÏ×ÁÎÉÉ ÆÁÊÌÁ <filename>/etc/rc.conf</filename> ÏÎÉ ÚÁÐÕÓÔÑÔÓÑ
	Á×ÔÏÍÁÔÉÞÅÓËÉ ÐÒÉ ÐÅÒÅÚÁÇÒÕÚËÅ.  üÔÏ ÎÅÏÂÈÏÄÉÍÏ ÔÏÌØËÏ ÎÁ ÓÅÒ×ÅÒÅ
	Kerberos.  ëÌÉÅÎÔÙ Kerberos ÐÏÌÕÞÁÔ ×ÓÅ ÎÅÏÂÈÏÄÉÍÙÅ ÄÁÎÎÙÅ ÉÚ
	ËÁÔÁÌÏÇÁ <filename>/etc/kerberosIV</filename>.</para>

      <screen>&prompt.root; <userinput>kerberos &amp;</userinput>
Kerberos server starting
Sleep forever on error
Log file is /var/log/kerberos.log
Current Kerberos master key version is 1.

Master key entered. BEWARE!

Current Kerberos master key version is 1
Local realm: EXAMPLE.COM
&prompt.root; <userinput>kadmind -n &amp;</userinput>
KADM Server KADM0.0A initializing
Please do not use 'kill -9' to kill this job, use a
regular kill instead

Current Kerberos master key version is 1.

Master key entered.  BEWARE!</screen>

      <para>ôÅÐÅÒØ ÄÌÑ ÐÏÌÕÞÅÎÉÑ ÄÏÓÔÕÐÁ ÞÅÒÅÚ ÓÏÚÄÁÎÎÏÇÏ ÐÏÌØÚÏ×ÁÔÅÌÑ
	<username>jane</username> ÉÓÐÏÌØÚÕÊÔÅ <command>kinit</command>:</para>

      <screen>&prompt.user; <userinput>kinit jane</userinput>
MIT Project Athena (grunt.example.com)
Kerberos Initialization for "jane"
<prompt>Password:</prompt> </screen>

      <para>ðÏÐÒÏÂÕÊÔÅ ÐÒÏÓÍÏÔÒÅÔØ ÉÍÅÀÝÉÅÓÑ ÄÁÎÎÙÅ Ó ÐÏÍÏÝØÀ
	<command>klist</command>:</para>

      <screen>&prompt.user; <userinput>klist</userinput>
Ticket file:    /tmp/tkt245
Principal:      jane@EXAMPLE.COM

  Issued           Expires          Principal
Apr 30 11:23:22  Apr 30 19:23:22  krbtgt.EXAMPLE.COM@EXAMPLE.COM</screen>

      <para>ôÅÐÅÒØ ÐÏÐÒÏÂÕÊÔÅ ÉÚÍÅÎÉÔØ ÐÁÒÏÌØ Ó ÐÏÍÏÝØÀ &man.passwd.1;,
	ÞÔÏÂÙ ÕÂÅÄÉÔØÓÑ, ÞÔÏ ÄÁÅÍÏÎ <application>kpasswd</application>
	ÍÏÖÅÔ ÐÏÌÕÞÉÔØ ÉÎÆÏÒÍÁÃÉÀ ÉÚ ÂÁÚÙ ÄÁÎÎÙÈ Kerberos:</para>

      <screen>&prompt.user; <userinput>passwd</userinput>
realm EXAMPLE.COM
<prompt>Old password for jane:</prompt>
<prompt>New Password for jane:</prompt>
Verifying password
<prompt>New Password for jane:</prompt>
Password changed.</screen>
    </sect2>

    <sect2>
      <title>÷ËÌÀÞÅÎÉÅ <command>su</command></title>

      <para>Kerberos ÐÏÚ×ÏÌÑÅÔ ÎÁÚÎÁÞÉÔØ <emphasis>ËÁÖÄÏÍÕ</emphasis>
	ÐÏÌØÚÏ×ÁÔÅÌÀ, ËÏÔÏÒÙÊ ÎÕÖÄÁÅÔÓÑ × ÐÒÉ×ÉÌÅÇÉÑÈ
	<username>root</username>, Ó×ÏÊ <emphasis>ÓÏÂÓÔ×ÅÎÎÙÊ</emphasis>
	ÐÁÒÏÌØ &man.su.1;.  îÅÏÂÈÏÄÉÍÏ ÄÏÂÁ×ÉÔØ ÕÞ£ÔÎÕÀ ÚÁÐÉÓØ, ËÏÔÏÒÏÊ
	ÒÁÚÒÅÛÅÎÏ ÐÏÌÕÞÁÔØ <username>root</username> ÄÏÓÔÕÐ ÞÅÒÅÚ &man.su.1;.
	üÔÏ ÄÅÌÁÅÔÓÑ ÐÕÔÅÍ Ó×ÑÚÙ×ÁÎÉÑ ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ <username>root</username>
	Ó ÐÏÌØÚÏ×ÁÔÅÌØÓËÏÊ ÕÞ£ÔÎÏÊ ÚÁÐÉÓØÀ.  óÏÚÄÁÄÉÍ × ÂÁÚÅ ÄÁÎÎÙÈ Kerberos
	ÚÁÐÉÓØ <literal>jane.root</literal> Ó ÐÏÍÏÝØÀ
	<command>kdb_edit</command>:</para>

      <screen>&prompt.root; <userinput>kdb_edit</userinput>
Opening database...

<prompt>Enter Kerberos master key:</prompt>

Current Kerberos master key version is 1.

Master key entered.  BEWARE!
Previous or default values are in [brackets] ,
enter return to leave the same, or new value.

<prompt>Principal name:</prompt> <userinput>jane</userinput>
<prompt>Instance:</prompt> <userinput>root</userinput>

&lt;Not found&gt;, Create [y] ? y

Principal: jane, Instance: root, kdc_key_ver: 1
<prompt>New Password:</prompt>                    &lt;---- enter a SECURE password here
Verifying password

<prompt>New Password:</prompt>    	 	 &lt;---- re-enter the password here

Principal's new key version = 1
<prompt>Expiration date (enter yyyy-mm-dd) [ 2000-01-01 ] ?</prompt>
<prompt>Max ticket lifetime (*5 minutes) [ 255 ] ?</prompt> <userinput>12</userinput> &lt;--- Keep this short!
<prompt>Attributes [ 0 ] ?</prompt>
Edit O.K.
<prompt>Principal name:</prompt>		         &lt;---- null entry here will cause an exit</screen>

      <para>ôÅÐÅÒØ ÐÒÏ×ÅÒÉÍ ÒÁÂÏÔÏÓÐÏÓÏÂÎÏÓÔØ ÜÔÏÊ ÚÁÐÉÓÉ:</para>

      <screen>&prompt.root; <userinput>kinit jane.root</userinput>
MIT Project Athena (grunt.example.com)
Kerberos Initialization for "jane.root"
<prompt>Password:</prompt></screen>

      <para>îÅÏÂÈÏÄÉÍÏ ÄÏÂÁ×ÉÔØ ÐÏÌØÚÏ×ÁÔÅÌÑ Ë <username>root</username>
	ÆÁÊÌÕ <filename>.klogin</filename>:</para>

      <screen>&prompt.root; <userinput>cat /root/.klogin</userinput>
jane.root@EXAMPLE.COM</screen>

      <para>ôÅÐÅÒØ ÐÏÐÒÏÂÕÊÔÅ ×ÙÐÏÌÎÉÔØ &man.su.1;:</para>

      <screen>&prompt.user; <userinput>su</userinput>
<prompt>Password:</prompt></screen>

      <para>É ÐÏÓÍÏÔÒÉÔÅ ÎÁ ÉÍÅÀÝÉÅÓÑ ÄÁÎÎÙÅ:</para>

      <screen>&prompt.root; <userinput>klist</userinput>
Ticket file:	/tmp/tkt_root_245
Principal:      jane.root@EXAMPLE.COM

  Issued           Expires          Principal
May  2 20:43:12  May  3 04:43:12  krbtgt.EXAMPLE.COM@EXAMPLE.COM</screen>
    </sect2>

    <sect2>
      <title>éÓÐÏÌØÚÏ×ÁÎÉÅ ÄÒÕÇÉÈ ËÏÍÁÎÄ</title>

      <para>÷ ÐÒÉÍÅÒÅ ×ÙÛÅ ÍÙ ÓÏÚÄÁÌÉ ÚÁÐÉÓØ (principal)
	<literal>jane</literal> Ó ÄÏÓÔÕÐÏÍ Ë <literal>root</literal>
	(instance).  ïÎÁ ÏÓÎÏ×ÁÎÁ ÎÁ ÐÏÌØÚÏ×ÁÔÅÌÅ Ó ÔÁËÉÍ ÖÅ ÉÍÅÎÅÍ, ËÁË
	É ÉÄÅÎÔÉÆÉËÁÔÏÒ, ÞÔÏ ÐÒÉÎÑÔÏ Kerberos ÐÏ ÕÍÏÌÞÁÎÉÀ;
	<literal>&lt;principal&gt;.&lt;instance&gt;</literal> × ÆÏÒÍÅ
	<literal>&lt;username&gt;.</literal><username>root</username>
	ÐÏÚ×ÏÌÑÅÔ ÉÓÐÏÌØÚÏ×ÁÔØ &man.su.1; ÄÌÑ ÄÏÓÔÕÐÁ Ë
	<username>root</username>, ÅÓÌÉ ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÉÅ ÚÁÐÉÓÉ ÎÁÈÏÄÑÔÓÑ
	× ÆÁÊÌÅ <filename>.klogin</filename> ÄÏÍÁÛÎÅÇÏ ËÁÔÁÌÏÇÁ
	<username>root</username>:

      <screen>&prompt.root; <userinput>cat /root/.klogin</userinput>
jane.root@EXAMPLE.COM</screen>

      <para>ðÏÄÏÂÎÏ ÜÔÏÍÕ, ÅÓÌÉ × ÆÁÊÌÅ <filename>.klogin</filename>
	ÉÚ ÄÏÍÁÛÎÅÇÏ ËÁÔÁÌÏÇÁ ÐÏÌØÚÏ×ÁÔÅÌÑ ÅÓÔØ ÓÔÒÏËÉ × ÆÏÒÍÅ:</para>

      <screen>&prompt.user; <userinput>cat ~/.klogin</userinput>
jane@EXAMPLE.COM
jack@EXAMPLE.COM</screen>

      <para>ÜÔÏ ÐÏÚ×ÏÌÉÔ ÌÀÂÏÍÕ Ó ÉÄÅÎÔÉÆÉËÁÔÏÒÏÍ
	<literal>EXAMPLE.COM</literal>, ËÔÏ ÁÕÔÅÎÔÉÆÉÃÉÒÏ×ÁÌÓÑ ËÁË
	<username>jane</username> ÉÌÉ <username>jack</username>
	(Ó ÐÏÍÏÝØÀ ËÏÍÁÎÄÙ <command>kinit</command>, ÓÍ. ×ÙÛÅ)
	ÐÏÌÕÞÉÔØ ÄÏÓÔÕÐ Ë ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ ÐÏÌØÚÏ×ÁÔÅÌÑ <username>jane</username>
	ÉÌÉ ÆÁÊÌÁÍ ÜÔÏÊ ÓÉÓÔÅÍÙ (<hostid>grunt</hostid>) ÞÅÒÅÚ
	&man.rlogin.1;, &man.rsh.1; ÉÌÉ &man.rcp.1;.</para>

      <para>îÁÐÒÉÍÅÒ, <username>jane</username> ÍÏÖÅÔ ×ÈÏÄÉÔØ × ÄÒÕÇÕÀ ÓÉÓÔÅÍÕ
	ÉÓÐÏÌØÚÕÑ Kerberos:</para>

	    <screen>&prompt.user; <userinput>kinit</userinput>
MIT Project Athena (grunt.example.com)
<prompt>Password:</prompt>
&prompt.user; <userinput>rlogin grunt</userinput>
Last login: Mon May  1 21:14:47 from grumble
Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994
        The Regents of the University of California.   All rights reserved.

FreeBSD BUILT-19950429 (GR386) #0: Sat Apr 29 17:50:09 SAT 1995</screen>

      <para>éÌÉ <username>jack</username> ×ÈÏÄÉÔ × ÕÞ£ÔÎÕÀ ÚÁÐÉÓØ
	<username>jane</username>'s ÎÁ ÜÔÏÍ ÖÅ ËÏÍÐØÀÔÅÒÅ
	(ÆÁÊÌ <filename>.klogin</filename> <username>jane</username>
	ÎÁÓÔÒÏÅÎ ËÁË ÐÏËÁÚÁÎÏ ×ÙÛÅ, É × Kerberos ÎÁÓÔÒÏÅÎÁ ÕÞ£ÔÎÁÑ
	ÚÁÐÉÓØ <emphasis>jack</emphasis>):</para>

      <screen>&prompt.user; <userinput>kinit</userinput>
&prompt.user; <userinput>rlogin grunt -l jane</userinput>
MIT Project Athena (grunt.example.com)
<prompt>Password:</prompt>
Last login: Mon May  1 21:16:55 from grumble
Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994
        The Regents of the University of California.   All rights reserved.
FreeBSD BUILT-19950429 (GR386) #0: Sat Apr 29 17:50:09 SAT 1995</screen>
    </sect2>
  </sect1>

  <sect1 id="kerberos5">
    <sect1info>
      <authorgroup>
	<author>
	  <firstname>Tillman</firstname>
	  <surname>Hodgson</surname>
	  <contrib>ðÒÅÄÏÓÔÁ×ÉÌ </contrib>
	</author>
      </authorgroup>
      <authorgroup>
	<author>
	  <firstname>Mark</firstname>
	  <surname>Murray</surname>
	  <contrib>ïÒÉÇÉÎÁÌØÎÙÊ ÍÁÔÅÒÉÁÌ ÐÒÅÄÏÓÔÁ×ÉÌ </contrib>
	</author>
      </authorgroup>
    </sect1info>

    <title><application>Kerberos5</application></title>

    <para>÷ÓÅ ÒÅÌÉÚÙ &os; ÐÏÓÌÅ &os;-5.1 ×ËÌÀÞÁÀÔ ÐÏÄÄÅÒÖËÕ ÔÏÌØËÏ
      <application>Kerberos5</application>.  ôÁËÉÍ ÏÂÒÁÚÏÍ,
      <application>Kerberos5</application> ÜÔÏ ÅÄÉÎÓÔ×ÅÎÎÁÑ ×ËÌÀÞÁÅÍÁÑ ×
      ÐÏÓÔÁ×ËÕ ×ÅÒÓÉÑ É ÅÇÏ ËÏÎÆÉÇÕÒÁÃÉÑ ÐÏÈÏÖÁ ÎÁ
      <application>KerberosIV</application> ×Ï ÍÎÏÇÉÈ ÁÓÐÅËÔÁÈ.  üÔÁ
      ÉÎÆÏÒÍÁÃÉÑ ÐÒÉÍÅÎÉÍÁ ÔÏÌØËÏ Ë <application>Kerberos5</application>
      ÉÚ ÒÅÌÉÚÏ× ÐÏÓÌÅ &os;-5.0.  ðÏÌØÚÏ×ÁÔÅÌÉ, ÖÅÌÁÀÝÉÅ ÉÓÐÏÌØÚÏ×ÁÔØ
      ÐÁËÅÔ <application>KerberosIV</application>, ÍÏÇÕÔ ÕÓÔÁÎÏ×ÉÔØ ÅÇÏ ÉÚ
      ÐÏÒÔÁ <filename role="package">security/krb4</filename>.</para>

    <para><application>Kerberos</application> ÜÔÏ ÄÏÐÏÌÎÉÔÅÌØÎÁÑ ÓÅÔÅ×ÁÑ
      ÓÉÓÔÅÍÁ/ÐÒÏÔÏËÏÌ, ÐÏÚ×ÏÌÑÀÝÁÑ ÐÏÌØÚÏ×ÁÔÅÌÑÍ Á×ÔÏÒÉÚÏ×ÁÔØÓÑ ÞÅÒÅÚ
      ÚÁÝÉÝÅÎÎÙÅ ÓÅÒ×ÉÓÙ ÎÁ ÚÁÝÉÝÅÎÎÏÍ ÓÅÒ×ÅÒÅ.  ôÁËÉÅ ÓÅÒ×ÉÓÙ ËÁË
      ÕÄÁÌÅÎÎÙÊ ×ÈÏÄ, ÕÄÁÌÅÎÎÏÅ ËÏÐÉÒÏ×ÁÎÉÅ, ÚÁÝÉÝÅÎÎÏÅ ËÏÐÉÒÏ×ÁÎÉÅ ÆÁÊÌÏ×
      ÍÅÖÄÕ ÓÉÓÔÅÍÁÍÉ É ÄÒÕÇÉÅ ÚÁÄÁÞÉ Ó ×ÙÓÏËÉÍ ÒÉÓËÏÍ ÓÔÁÎÏ×ÑÔÓÑ
      ÄÏÐÕÓÔÉÍÏ ÂÅÚÏÐÁÓÎÙÍÉ É ÂÏÌÅÅ ËÏÎÔÒÏÌÉÒÕÅÍÙÍÉ.</para>

    <para><application>Kerberos</application> ÍÏÖÅÔ ÂÙÔØ ÏÐÉÓÁÎÁ ËÁË
      ÐÒÏËÓÉ ÓÉÓÔÅÍÁ ÉÄÅÎÔÉÆÉËÁÃÉÉ-ÐÒÏ×ÅÒËÉ.  ïÎÁ ÔÁËÖÅ ÍÏÖÅÔ ÂÙÔØ ÏÐÉÓÁÎÁ
      ËÁË ÚÁÝÉÝÅÎÎÁÑ ×ÎÅÛÎÑÑ ÓÉÓÔÅÍÁ ÁÕÔÅÎÔÉÆÉËÁÃÉÉ.
      <application>Kerberos</application> ÐÒÅÄÏÓÔÁ×ÌÑÅÔ ÔÏÌØËÏ ÏÄÎÕ ÆÕÎËÃÉÀ
      &mdash; ÚÁÝÉÝÅÎÎÕÀ ÁÕÔÅÎÔÉÆÉËÁÃÉÀ ÐÏÌØÚÏ×ÁÔÅÌÅÊ ÓÅÔÉ.
      ïÎ ÎÅ ÐÒÅÄÏÓÔÁ×ÌÑÅÔ ÆÕÎËÃÉÊ Á×ÔÏÒÉÚÁÃÉÉ (ÞÔÏ ÒÁÚÒÅÛÅÎÏ ÄÅÌÁÔØ
      ÐÏÌØÚÏ×ÁÔÅÌÑÍ) ÉÌÉ ÆÕÎËÃÉÊ ÁÕÄÉÔÁ (ËÁËÏÊ ÐÏÌØÚÏ×ÁÔÅÌØ ÞÔÏ ÄÅÌÁÅÔ).
      ðÏÓÌÅ ÔÏÇÏ, ËÁË ËÌÉÅÎÔ É ÓÅÒ×ÅÒ ÉÓÐÏÌØÚÏ×ÁÌÉ
      <application>Kerberos</application> ÄÌÑ ÉÄÅÎÔÉÆÉËÁÃÉÉ, ÏÎÉ ÍÏÇÕÔ
      ÚÁÛÉÆÒÏ×ÁÔØ ×ÓÅ ÓÏÅÄÉÎÅÎÉÑ ÄÌÑ ÇÁÒÁÎÔÉÒÏ×ÁÎÉÑ ÓÏÂÓÔ×ÅÎÎÏÊ ÂÅÚÏÐÁÓÎÏÓÔÉ É
      ÃÅÌÏÓÔÎÏÓÔÉ ÄÁÎÎÙÈ.<!--as they go about their business--></para>

    <para>óÌÅÄÏ×ÁÔÅÌØÎÏ ËÒÁÊÎÅ ÒÅËÏÍÅÎÄÕÅÔÓÑ ÉÓÐÏÌØÚÏ×ÁÔØ
      <application>Kerberos</application> Ó ÄÒÕÇÉÍÉ ÍÅÔÏÄÁÍÉ ÂÅÚÏÐÁÓÎÏÓÔÉ,
      ÐÒÅÄÏÓÔÁ×ÌÑÀÝÉÍÉ ÓÅÒ×ÉÓÙ Á×ÔÏÒÉÚÁÃÉÉ É ÁÕÄÉÔÁ.</para>

    <para>ðÏÓÌÅÄÕÀÝÉÅ ÉÎÓÔÒÕËÃÉÉ ÍÏÇÕÔ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ × ËÁÞÅÓÔ×Å ÒÕËÏ×ÏÄÓÔ×Á
      ÐÏ ÎÁÓÔÒÏÊËÅ <application>Kerberos</application>, ÐÏÓÔÁ×ÌÑÅÍÏÇÏ Ó &os;.
      ôÅÍ ÎÅ ÍÅÎÅÅ, ×ÁÍ ÐÏÔÒÅÂÕÅÔÓÑ ÏÂÒÁÔÉÔØÓÑ Ë ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÉÍ ÓÔÒÁÎÉÃÁÍ
      ÓÐÒÁ×ÏÞÎÉËÁ ÚÁ ÐÏÌÎÙÍ ÏÐÉÓÁÎÉÅÍ.</para>

    <para>÷ ÃÅÌÑÈ ÄÅÍÏÎÓÔÒÁÃÉÉ ÕÓÔÁÎÏ×ËÉ <application>Kerberos</application>,
      ÂÕÄÕÔ ÐÒÉÍÅÎÅÎÙ ÓÌÅÄÕÀÝÉÅ ÏÂÏÚÎÁÞÅÎÉÑ:</para>

    <itemizedlist>
      <listitem>
	<para><acronym>DNS</acronym> ÄÏÍÅÎ (<quote>ÚÏÎÁ</quote>)
	  example.org.</para>
      </listitem>

      <listitem>
	<para>õÎÉËÁÌØÎÙÊ ÉÄÅÎÔÉÆÉËÁÔÏÒ <application>Kerberos</application>
	  EXAMPLE.ORG.</para>
      </listitem>
    </itemizedlist>

    <note>
      <para>éÓÐÏÌØÚÕÊÔÅ ÄÅÊÓÔ×ÕÀÝÉÅ ÉÍÅÎÁ ÄÏÍÅÎÏ× ÐÒÉ ÎÁÓÔÒÏÊËÅ
	<application>Kerberos</application> ÄÁÖÅ ÅÓÌÉ ×Ù ÂÕÄÅÔÅ ÉÓÐÏÌØÚÏ×ÁÔØ
	ÅÇÏ ×Ï ×ÎÕÔÒÅÎÎÅÊ ÓÅÔÉ.  üÔÏ ÐÏÚ×ÏÌÉÔ ÉÚÂÅÖÁÔØ ÐÒÏÂÌÅÍ Ó
	<acronym>DNS</acronym> É ÇÁÒÁÎÔÉÒÕÅÔ ×ÏÚÍÏÖÎÏÓÔØ Ó×ÑÚÉ Ó
	<application>Kerberos</application> ÐÏÄ ÄÒÕÇÉÍÉ
	ÉÄÅÎÔÉÆÉËÁÔÏÒÁÍÉ.</para>
    </note>

    <sect2>
      <title>éÓÔÏÒÉÑ</title>
      <indexterm>
	<primary>Kerberos5</primary>
	<secondary>ÉÓÔÏÒÉÑ</secondary>
      </indexterm>

      <para><application>Kerberos</application> ÂÙÌ ÓÏÚÄÁÎ
	<acronym>MIT</acronym> × ËÁÞÅÓÔ×Å ÒÅÛÅÎÉÑ ÐÒÏÂÌÅÍ Ó ÂÅÚÏÐÁÓÎÏÓÔØÀ
	ÓÅÔÉ.  ðÒÏÔÏËÏÌ <application>Kerberos</application> ÉÓÐÏÌØÚÕÅÔ
	ÓÔÏÊËÕÀ ËÒÉÐÔÏÇÒÁÆÉÀ, ÔÁË ÞÔÏ ËÌÉÅÎÔ ÍÏÖÅÔ ÉÄÅÎÔÉÆÉÃÉÒÏ×ÁÔØÓÑ ÎÁ
	ÓÅÒ×ÅÒÅ (É ÏÂÒÁÔÎÏ) ÞÅÒÅÚ ÎÅÚÁÝÉÝÅÎÎÏÅ ÓÅÔÅ×ÏÅ ÓÏÅÄÉÎÅÎÉÅ.</para>

      <para><application>Kerberos</application> ÜÔÏ É ÉÍÑ ÓÅÔÅ×ÏÇÏ ÐÒÏÔÏËÏÌÁ
	ÁÕÔÅÎÔÉÆÉËÁÃÉÉ É ÏÂÝÉÊ ÔÅÒÍÉÎ ÄÌÑ ÏÐÉÓÁÎÉÑ ÐÒÏÇÒÁÍÍ, ÇÄÅ ÏÎ
	ÒÅÁÌÉÚÏ×ÁÎ (ÎÁÐÒÉÍÅÒ, <application>Kerberos</application> telnet).
	ôÅËÕÝÁÑ ×ÅÒÓÉÑ ÐÒÏÔÏËÏÌÁ 5 ÏÐÉÓÁÎÁ ×
	<acronym>RFC</acronym>&nbsp;1510.</para>

      <para>äÏÓÔÕÐÎÏ ÎÅÓËÏÌØËÏ Ó×ÏÂÏÄÎÙÈ ÒÅÁÌÉÚÁÃÉÊ ÜÔÏÇÏ ÐÒÏÔÏËÏÌÁ,
	ÒÁÂÏÔÁÀÝÉÈ ÎÁ ÍÎÏÖÅÓÔ×Å ÏÐÅÒÁÃÉÏÎÎÙÈ ÓÉÓÔÅÍ.  Massachusetts
	Institute of Technology (<acronym>MIT</acronym>), ÇÄÅ
	<application>Kerberos</application> ÂÙÌ ÐÅÒ×ÏÎÁÞÁÌØÎÏ ÒÁÚÒÁÂÏÔÁÎ,
	ÐÒÏÄÏÌÖÁÅÔ ÒÁÚÒÁÂÁÔÙ×ÁÔØ ÓÏÂÓÔ×ÅÎÎÙÊ ÐÁËÅÔ
	<application>Kerberos</application>.  ïÎ ÏÂÙÞÎÏ ÉÓÐÏÌØÚÏ×ÁÌÓÑ
	× <acronym>óûá</acronym> ËÁË ËÒÉÐÔÏÇÒÁÆÉÞÅÓËÉÊ ÐÒÏÄÕËÔ,
	É × ÜÔÏÍ ËÁÞÅÓÔ×Å ÐÏÐÁÄÁÌ ÐÏÄ ÄÅÊÓÔ×ÉÅ ÏÇÒÁÎÉÞÅÎÉÊ ÎÁ ÜËÓÐÏÒÔ.
	<acronym>MIT</acronym> <application>Kerberos</application>
	ÄÏÓÔÕÐÅÎ × ×ÉÄÅ ÐÏÒÔÁ (<filename
	role="package">security/krb5</filename>).  Heimdal
	<application>Kerberos</application> ÜÔÏ ÄÒÕÇÁÑ ÒÅÁÌÉÚÁÃÉÑ ×ÅÒÓÉÉ
	5, ËÏÔÏÒÁÑ ÒÁÚÒÁÂÁÔÙ×ÁÌÁÓØ ÉÓËÌÀÞÉÔÅÌØÎÏ ×ÎÅ <acronym>óûá</acronym>
	ÄÌÑ ÏÂÈÏÄÁ ÜËÓÐÏÒÔÎÙÈ ÏÇÒÁÎÉÞÅÎÉÊ (É ÐÏÜÔÏÍÕ ÞÁÓÔÏ ×ËÌÀÞÁÌÁÓØ ×
	ÎÅËÏÍÍÅÒÞÅÓËÉÅ ÒÅÁÌÉÚÁÃÉÉ &unix;).  Heimdal
	<application>Kerberos</application> ÄÏÓÔÕÐÅÎ × ×ÉÄÅ ÐÏÒÔÁ
	(<filename role="package">security/heimdal</filename>),
	ÅÇÏ ÍÉÎÉÍÁÌØÎÙÊ ËÏÍÐÌÅËÔ ×ËÌÀÞÅÎ × ÂÁÚÏ×ÕÀ ÕÓÔÁÎÏ×ËÕ &os;.</para>

    <para>÷ ÃÅÌÑÈ ÐÏÌÕÞÅÎÉÑ ÎÁÉÂÏÌØÛÅÊ ÁÕÄÉÔÏÒÉÉ, × ÜÔÉÈ ÉÎÓÔÒÕËÃÉÑÈ
	ÐÒÅÄÐÏÌÁÇÁÅÔÓÑ ÉÓÐÏÌØÚÏ×ÁÎÉÅ Heimdal ×ËÌÀÞÁÅÍÏÇÏ × &os;.</para>

    </sect2>

    <sect2>
      <title>îÁÓÔÒÏÊËÁ Heimdal <acronym>KDC</acronym></title>
      <indexterm>
	<primary>Kerberos5</primary>
	<secondary>ÃÅÎÔÒ ÒÁÓÐÒÏÓÔÒÁÎÅÎÉÑ ËÌÀÞÅÊ</secondary>
      </indexterm>

      <para>ãÅÎÔÒ ÒÁÓÐÒÏÓÔÒÁÎÅÎÉÑ ËÌÀÞÅÊ (Key Distribution Center,
	<acronym>KDC</acronym>) ÜÔÏ ÃÅÎÔÒÁÌÉÚÏ×ÁÎÎÙÊ ÓÅÒ×ÉÓ ÁÕÔÅÎÔÉÆÉËÁÃÉÉ,
	ÐÒÅÄÏÓÔÁ×ÌÑÅÍÙÊ <application>Kerberos</application> &mdash;
	ÜÔÏ ËÏÍÐØÀÔÅÒ, ËÏÔÏÒÙÊ ÐÒÅÄÏÓÔÁ×ÌÑÅÔ ÄÏÓÔÕÐ ÞÅÒÅÚ
	<application>Kerberos</application>.  <acronym>KDC</acronym>
	ÓÞÉÔÁÅÔÓÑ ÄÏ×ÅÒÑÅÍÙÍ ×ÓÅÍÉ ÄÒÕÇÉÍÉ ËÏÍÐØÀÔÅÒÁÍÉ Ó ÏÐÒÅÄÅÌÅÎÎÙÍ
	ÉÄÅÎÔÉÆÉËÁÔÏÒÏÍ <application>Kerberos</application> É ÐÏÜÔÏÍÕ
	Ë ÎÅÍÕ ÐÒÅÄßÑ×ÌÑÀÔÓÑ ×ÙÓÏËÉÅ ÔÒÅÂÏ×ÁÎÉÑ ÂÅÚÏÐÁÓÎÏÓÔÉ.</para>

    <para>éÍÅÊÔÅ ××ÉÄÕ, ÞÔÏ ÈÏÔÑ ÒÁÂÏÔÁ ÓÅÒ×ÅÒÁ
	<application>Kerberos</application> ÔÒÅÂÕÅÔ ÏÞÅÎØ ÎÅÍÎÏÇÏ
	×ÙÞÉÓÌÉÔÅÌØÎÙÈ ÒÅÓÕÒÓÏ×, ÉÚ ÓÏÏÂÒÁÖÅÎÉÊ ÂÅÚÏÐÁÓÎÏÓÔÉ ÄÌÑ ÎÅÇÏ
	ÒÅËÏÍÅÎÄÕÅÔÓÑ ÏÔÄÅÌØÎÙÊ ËÏÍÐØÀÔÅÒ, ÒÁÂÏÔÁÀÝÉÊ ÔÏÌØËÏ × ËÁÞÅÓÔ×Å
	<acronym>KDC</acronym>.</para>

    <para>ðÅÒÅÄ ÎÁÞÁÌÏÍ ÎÁÓÔÒÏÊËÉ <acronym>KDC</acronym>, ÕÂÅÄÉÔÅÓØ ÞÔÏ ×
	ÆÁÊÌÅ <filename>/etc/rc.conf</filename> ÓÏÄÅÒÖÁÔÓÑ ÐÒÁ×ÉÌØÎÙÅ
	ÎÁÓÔÒÏÊËÉ ÄÌÑ ÒÁÂÏÔÙ × ËÁÞÅÓÔ×Å <acronym>KDC</acronym> (×ÁÍ ÍÏÖÅÔ
	ÐÏÔÒÅÂÏ×ÁÔØÓÑ ÉÚÍÅÎÉÔØ ÐÕÔÉ × ÓÏÏÔ×ÅÔÓÔ×ÉÉ Ó ÓÏÂÓÔ×ÅÎÎÏÊ
	ÓÉÓÔÅÍÏÊ):</para>

    <programlisting>kerberos5_server_enable="YES"
kadmind5_server_enable="YES"</programlisting>

      <para>úÁÔÅÍ ÐÒÉÓÔÕÐÉÍ Ë ÒÅÄÁËÔÉÒÏ×ÁÎÉÀ ÆÁÊÌÁ ÎÁÓÔÒÏÊËÉ
	<application>Kerberos</application>,
	<filename>/etc/krb5.conf</filename>:</para>

      <programlisting>[libdefaults]
    default_realm = EXAMPLE.ORG
[realms]
    EXAMPLE.ORG = {
        kdc = kerberos.example.org
        admin_server = kerberos.example.org
    }
[domain_realm]
    .example.org = EXAMPLE.ORG</programlisting>

      <para>ïÂÒÁÔÉÔÅ ×ÎÉÍÁÎÉÅ ÞÔÏ × ÆÁÊÌÅ <filename>/etc/krb5.conf</filename>
	ÐÏÄÒÁÚÕÍÅ×ÁÅÔÓÑ ÎÁÌÉÞÉÅ Õ <acronym>KDC</acronym> ÐÏÌÎÏÇÏ ÉÍÅÎÉ
	<hostid role="fqdn">kerberos.example.org</hostid>.  ÷ÁÍ ÐÏÔÒÅÂÕÅÔÓÑ
	ÄÏÂÁ×ÉÔØ CNAME (ÓÉÎÏÎÉÍ) Ë ÆÁÊÌÕ ÚÏÎÙ, ÅÓÌÉ Õ
	<acronym>KDC</acronym> ÄÒÕÇÏÅ ÉÍÑ.</para>

      <note>
	<para>äÌÑ ÂÏÌØÛÉÈ ÓÅÔÅÊ Ó ÐÒÁ×ÉÌØÎÏ ÎÁÓÔÒÏÅÎÎÙÍ ÓÅÒ×ÅÒÏÍ
	  <acronym>BIND</acronym> <acronym>DNS</acronym> ÐÒÉÍÅÒ ×ÙÛÅ
	  ÍÏÖÅÔ ÂÙÔØ ÕÒÅÚÁÎ ÄÏ:</para>

	<programlisting>[libdefaults]
      default_realm = EXAMPLE.ORG</programlisting>

	<para>óÏ ÓÌÅÄÕÀÝÉÍÉ ÓÔÒÏËÁÍÉ, ÄÏÂÁ×ÌÅÎÎÙÍÉ × ÆÁÊÌ ÚÏÎÙ
	  <hostid role="fqdn">example.org</hostid>:</para>

	<programlisting>_kerberos._udp      IN  SRV     01 00 88 kerberos.example.org.
_kerberos._tcp      IN  SRV     01 00 88 kerberos.example.org.
_kpasswd._udp       IN  SRV     01 00 464 kerberos.example.org.
_kerberos-adm._tcp  IN  SRV     01 00 749 kerberos.example.org.
_kerberos           IN  TXT     EXAMPLE.ORG</programlisting></note>

      <note>
	<para>þÔÏÂÙ ËÌÉÅÎÔÙ ÍÏÇÌÉ ÎÁÊÔÉ ÓÅÒ×ÉÓÙ
	  <application>Kerberos</application>,
	  <emphasis>ÎÅÏÂÈÏÄÉÍÏ</emphasis> ÎÁÌÉÞÉÅ ÉÌÉ ÐÏÌÎÏÓÔØÀ
	  ÎÁÓÔÒÏÅÎÎÏÇÏ <filename>/etc/krb5.conf</filename> ÉÌÉ ÍÉÎÉÍÁÌØÎÏ
	  ÎÁÓÔÒÏÅÎÎÏÇÏ <filename>/etc/krb5.conf</filename>
	  <emphasis>É</emphasis> ÐÒÁ×ÉÌØÎÏ ÎÁÓÔÒÏÅÎÎÏÇÏ DNS
	ÓÅÒ×ÅÒÁ.</para>
      </note>

      <para>óÏÚÄÁÄÉÍ ÔÅÐÅÒØ ÂÁÚÕ ÄÁÎÎÙÈ <application>Kerberos</application>.
	üÔÁ ÂÁÚÁ ÄÁÎÎÙÈ ÓÏÄÅÒÖÉÔ ËÌÀÞÉ ×ÓÅÈ ÏÓÎÏ×ÎÙÈ ÈÏÓÔÏ×, ÚÁÛÉÆÒÏ×ÁÎÎÙÈ
	Ó ÐÏÍÏÝØÀ ÇÌÁ×ÎÏÇÏ ÐÁÒÏÌÑ.  ÷ÁÍ ÎÅ ÔÒÅÂÕÅÔÓÑ ÐÏÍÎÉÔØ ÜÔÏÔ ÐÁÒÏÌØ,
	ÏÎ ÈÒÁÎÉÔÓÑ × ÆÁÊÌÅ (<filename>/var/heimdal/m-key</filename>).
	äÌÑ ÓÏÚÄÁÎÉÑ ÇÌÁ×ÎÏÇÏ ËÌÀÞÁ ÚÁÐÕÓÔÉÔÅ <command>kstash</command>
	É ××ÅÄÉÔÅ ÐÁÒÏÌØ.</para>

      <para>ëÁË ÔÏÌØËÏ ÂÕÄÅÔ ÓÏÚÄÁÎ ÇÌÁ×ÎÙÊ ËÌÀÞ, ×Ù ÍÏÖÅÔÅ ÉÎÉÃÉÁÌÉÚÉÒÏ×ÁÔØ
	ÂÁÚÕ ÄÁÎÎÙÈ Ó ÐÏÍÏÝØÀ ÐÒÏÇÒÁÍÍÙ <command>kadmin</command> Ó ËÌÀÞÏÍ
	<literal>-l</literal> (ÏÚÎÁÞÁÀÝÉÍ <quote>local</quote>).  üÔÏÔ
	ËÌÀÞ ÓÏÏÂÝÁÅÔ <command>kadmin</command> ÏÂÒÁÝÁÔØÓÑ Ë ÆÁÊÌÁÍ ÂÁÚÙ
	ÄÁÎÎÙÈ ÎÅÐÏÓÒÅÄÓÔ×ÅÎÎÏ ×ÍÅÓÔÏ ÉÓÐÏÌØÚÏ×ÁÎÉÑ ÓÅÔÅ×ÏÇÏ ÓÅÒ×ÉÓÁ
	<command>kadmind</command>.  üÔÏ ÐÏÍÏÇÁÅÔ ÒÅÛÉÔØ <quote>ÐÒÏÂÌÅÍÕ
	ËÕÒÉÃÙ É ÑÊÃÁ</quote>, ËÏÇÄÁ ÏÂÒÁÝÅÎÉÅ ÉÄÅÔ Ë ÅÝÅ ÎÅ ÓÏÚÄÁÎÎÏÊ ÂÁÚÅ
	ÄÁÎÎÙÈ.  ëÁË ÔÏÌØËÏ ×Ù Õ×ÉÄÉÔÅ ÐÒÉÇÌÁÛÅÎÉÅ <command>kadmin</command>,
	ÉÓÐÏÌØÚÕÊÔÅ ËÏÍÁÎÄÕ <command>init</command> ÄÌÑ ÓÏÚÄÁÎÉÑ ÂÁÚÙ
	ÄÁÎÎÙÈ ÉÄÅÎÔÉÆÉËÁÔÏÒÏ×.</para>

      <para>îÁËÏÎÅÃ, ÏÓÔÁ×ÁÑÓØ × ÐÒÉÇÌÁÛÅÎÉÉ <command>kadmin</command>,
	ÓÏÚÄÁÊÔÅ ÐÅÒ×ÕÀ ÚÁÐÉÓØ Ó ÐÏÍÏÝØÀ ËÏÍÁÎÄÙ <command>add</command>.
	ïÓÔÁ×ØÔÅ ÎÅÉÚÍÅÎÎÙÍÉ ÐÁÒÁÍÅÔÒÙ ÐÏ ÕÍÏÌÞÁÎÉÀ, ×Ù ×ÓÅÇÄÁ ÓÍÏÖÅÔÅ
	ÉÚÍÅÎÉÔØ ÉÈ ÐÏÚÖÅ Ó ÐÏÍÏÝØÀ ËÏÍÁÎÄÙ <command>modify</command>.
	ïÂÒÁÔÉÔÅ ×ÎÉÍÁÎÉÅ, ÞÔÏ ×Ù ×ÓÅÇÄÁ ÍÏÖÅÔÅ ÉÓÐÏÌØÚÏ×ÁÔØ ËÏÍÁÎÄÕ
	<literal>?</literal> ÄÌÑ ÐÒÏÓÍÏÔÒÁ ÄÏÓÔÕÐÎÙÈ ÐÁÒÁÍÅÔÒÏ×.</para>

      <para>ðÒÉÍÅÒ ÓÏÚÄÁÎÉÑ ÂÁÚÙ ÄÁÎÎÙÈ ÐÏËÁÚÁÎ ÎÉÖÅ:</para>

      <screen>&prompt.root; <userinput>kstash</userinput>
Master key: <userinput>xxxxxxxx</userinput>
Verifying password - Master key: <userinput>xxxxxxxx</userinput>

&prompt.root; <userinput>kadmin -l</userinput>
kadmin> <userinput>init EXAMPLE.ORG</userinput>
Realm max ticket life [unlimited]:
kadmin> <userinput>add tillman</userinput>
Max ticket life [unlimited]:
Max renewable life [unlimited]:
Attributes []:
Password: <userinput>xxxxxxxx</userinput>
Verifying password - Password: <userinput>xxxxxxxx</userinput></screen>

      <para>ôÅÐÅÒØ ÐÒÉÛÌÏ ×ÒÅÍÑ ÚÁÐÕÓÔÉÔØ ÓÅÒ×ÉÓÙ <acronym>KDC</acronym>.
	÷ÙÐÏÌÎÉÔÅ ËÏÍÁÎÄÙ <command>/etc/rc.d/kerberos start</command> É
	<command>/etc/rc.d/kadmind start</command> ÄÌÑ ÚÁÐÕÓËÁ ÓÅÒ×ÉÓÏ×.
	úÁÍÅÔØÔÅ, ÞÔÏ ÎÉ ÏÄÉÎ ÉÚ ÐÏÄÄÅÒÖÉ×ÁÀÝÉÈ
	<application>Kerberos</application>
	ÄÁÅÍÏÎÏ× ÎÁ ÜÔÏÔ ÍÏÍÅÎÔ ÚÁÐÕÝÅÎ ÎÅ ÂÕÄÅÔ, ÎÏ Õ ×ÁÓ ÄÏÌÖÎÁ ÂÙÔØ
	×ÏÚÍÏÖÎÏÓÔØ ÕÂÅÄÉÔØÓÑ × ÔÏÍ, ÞÔÏ <acronym>KDC</acronym> ÆÕÎËÃÉÏÎÉÒÕÅÔ
	ÐÕÔÅÍ ÐÏÌÕÞÅÎÉÑ ÓÐÉÓËÁ ÄÏÓÔÕÐÁ ÄÌÑ ÐÏÌØÚÏ×ÁÔÅÌÑ, ËÏÔÏÒÏÇÏ ×Ù ÔÏÌØËÏ
	ÞÔÏ ÓÁÍÏÓÔÏÑÔÅÌØÎÏ ÓÏÚÄÁÌÉ ÉÚ ËÏÍÁÎÄÎÏÊ ÓÔÒÏËÉ ÓÁÍÏÇÏ
	<acronym>KDC</acronym>:</para>

      <screen>&prompt.user; <userinput>k5init <replaceable>tillman</replaceable></userinput>
tillman@EXAMPLE.ORG's Password:

&prompt.user; <userinput>k5list</userinput>
Credentials cache: FILE:<filename>/tmp/krb5cc_500</filename>
        Principal: tillman@EXAMPLE.ORG

  Issued           Expires          Principal
Aug 27 15:37:58  Aug 28 01:37:58  krbtgt/EXAMPLE.ORG@EXAMPLE.ORG</screen>

      </sect2>

      <sect2>
	<title>óÅÒ×ÅÒ <application>Kerberos</application> Ó ÓÅÒ×ÉÓÁÍÉ
	  Heimdal</title>

	<indexterm>
	  <primary>Kerberos5</primary>
	  <secondary>×ËÌÀÞÅÎÉÅ ÓÅÒ×ÉÓÏ×</secondary>
	</indexterm>

	<para>äÌÑ ÎÁÞÁÌÁ ÎÁÍ ÐÏÔÒÅÂÕÅÔÓÑ ËÏÐÉÑ ÆÁÊÌÁ ÎÁÓÔÒÏÊËÉ
	  <application>Kerberos</application>,
	  <filename>/etc/krb5.conf</filename>.
	  ðÒÏÓÔÏ ÓËÏÐÉÒÕÊÔÅ ÅÇÏ Ó <acronym>KDC</acronym> ÎÁ ËÌÉÅÎÔÓËÉÊ
	  ËÏÍÐØÀÔÅÒ ÂÅÚÏÐÁÓÎÙÍ ÓÐÏÓÏÂÏÍ (ÉÓÐÏÌØÚÕÑ ÓÅÔÅ×ÙÅ ÕÔÉÌÉÔÙ, ÔÁËÉÅ
	  ËÁË &man.scp.1;, ÉÌÉ ÆÉÚÉÞÅÓËÉ, Ó ÐÏÍÏÝØÀ ÄÉÓËÅÔÙ).</para>

	<para>úÁÔÅÍ ×ÁÍ ÐÏÎÁÄÏÂÉÔÓÑ ÆÁÊÌ <filename>/etc/krb5.keytab</filename>.
	  üÔÏ ÏÓÎÏ×ÎÏÅ ÒÁÚÌÉÞÉÅ ÍÅÖÄÕ ÓÅÒ×ÅÒÏÍ, ÐÏÄÄÅÒÖÉ×ÁÀÝÉÍ
	  <application>Kerberos</application> É ÒÁÂÏÞÉÍÉ ÓÔÁÎÃÉÑÍÉ &mdash;
	  ÎÁ ÓÅÒ×ÅÒÅ ÄÏÌÖÅÎ ÂÙÔØ ÆÁÊÌ <filename>keytab</filename>.
	  ÷ ÜÔÏÍ ÆÁÊÌÅ ÎÁÈÏÄÉÔÓÑ ÃÅÎÔÒÁÌØÎÙÊ ËÌÀÞ ÓÅÒ×ÅÒÁ, ËÏÔÏÒÙÊ ÐÏÚ×ÏÌÑÅÔ
	  <acronym>KDC</acronym> ÐÒÏ×ÅÒÑÔØ ×ÓÅ ÄÒÕÇÉÅ ÉÄÅÎÔÉÆÉËÁÔÏÒÙ.  ïÎ
	  ÄÏÌÖÅÎ ÂÙÔØ ÐÏÍÅÝÅÎ ÎÁ ÓÅÒ×ÅÒ ÂÅÚÏÐÁÓÎÙÍ ÓÐÏÓÏÂÏÍ, ÐÏÓËÏÌØËÕ
	  ÂÅÚÏÐÁÓÎÏÓÔØ ÓÅÒ×ÅÒÁ ÍÏÖÅÔ ÂÙÔØ ÎÁÒÕÛÅÎÁ, ÅÓÌÉ ËÌÀÞ ÓÔÁÎÅÔ
	  ÏÂÝÅÄÏÓÔÕÐÅÎ.  üÔÏ ÏÚÎÁÞÁÅÔ, ÞÔÏ ÅÇÏ ÐÅÒÅÄÁÞÁ ÞÅÒÅÚ ÐÒÏÚÒÁÞÎÙÊ
	  ËÁÎÁÌ, ÔÁËÏÊ ËÁË <acronym>FTP</acronym> &mdash; ÏÞÅÎØ ÐÌÏÈÁÑ
	  ÉÄÅÑ.</para>

	<para>ïÂÙÞÎÏ ÐÅÒÅÎÏÓ ÆÁÊÌÁ <filename>keytab</filename> ÎÁ ÓÅÒ×ÅÒ
	  ÐÒÏÉÚ×ÏÄÉÔÓÑ Ó ÐÏÍÏÝØÀ ÐÒÏÇÒÁÍÍÙ <command>kadmin</command>.
	  üÔÏ ÕÄÏÂÎÏ, ÐÏÓËÏÌØËÕ ×ÁÍ ÐÏÔÒÅÂÕÅÔÓÑ ÔÁËÖÅ ÓÏÚÄÁÔØ ÚÁÐÉÓØ ÈÏÓÔÁ
	  (<acronym>KDC</acronym> ÞÁÓÔØ <filename>krb5.keytab</filename>)
	  Ó ÐÏÍÏÝØÀ <command>kadmin</command>.</para>

	<para>ïÂÒÁÔÉÔÅ ×ÎÉÍÁÎÉÅ, ÞÔÏ ÄÏÌÖÎÙ ÂÙÔØ ÕÖÅ ÚÁÒÅÇÉÓÔÒÉÒÏ×ÁÎÙ ×
	  ÓÉÓÔÅÍÅ É ÎÅÏÂÈÏÄÉÍÏ ÎÁÌÉÞÉÅ ÐÒÁ× ÎÁ ÉÓÐÏÌØÚÏ×ÁÎÉÅ ÉÎÔÅÒÆÅÊÓÁ
	  <command>kadmin</command> × ÆÁÊÌÅ <filename>kadmind.acl</filename>.
	  ïÂÒÁÔÉÔÅÓØ Ë ÒÁÚÄÅÌÕ <quote>Remote administration</quote> × info
	  ÓÔÒÁÎÉÃÁÈ Heimdal (<command>info heimdal</command>) ÚÁ ÄÅÔÁÌÑÍÉ ÐÏ
	  ÓÏÓÔÁ×ÌÅÎÉÀ ÓÐÉÓËÁ ÄÏÓÔÕÐÁ.  åÓÌÉ ×Ù ÎÅ ÈÏÔÉÔÅ ×ËÌÀÞÁÔØ ÕÄÁÌÅÎÎÙÊ
	  ÄÏÓÔÕÐ <command>kadmin</command>, ÍÏÖÅÔÅ ÐÒÏÓÔÏ ÐÏÄËÌÀÞÉÔØÓÑ Ë
	  <acronym>KDC</acronym> ÞÅÒÅÚ ÚÁÝÉÝÅÎÎÏÅ ÓÏÅÄÉÎÅÎÉÅ (ÌÏËÁÌØÎÕÀ
	  ËÏÎÓÏÌØ, &man.ssh.1; ÉÌÉ <application>Kerberos</application>
	  &man.telnet.1;) É ×ÙÐÏÌÎÑÔØ ÁÄÍÉÎÉÓÔÒÉÒÏ×ÁÎÉÅ ÌÏËÁÌØÎÏ Ó ÐÏÍÏÝØÀ
	  <command>kadmin -l</command>.</para>

	<para>ðÏÓÌÅ ÄÏÂÁ×ÌÅÎÉÑ ÆÁÊÌÁ <filename>/etc/krb5.conf</filename>,
	  ×Ù ÍÏÖÅÔÅ ÉÓÐÏÌØÚÏ×ÁÔØ <command>kadmin</command> Ó ÓÅÒ×ÅÒÁ
	  <application>Kerberos</application>.  ëÏÍÁÎÄÁ
	  <command>add --random-key</command> ÐÏÚ×ÏÌÉÔ ×ÁÍ ÄÏÂÁ×ÉÔØ ÚÁÐÉÓØ
	  ÄÌÑ ÓÅÒ×ÅÒÁ, Á ËÏÍÁÎÄÁ <command>ext</command> ÐÏÚ×ÏÌÉÔ ÐÅÒÅÎÅÓÔÉ
	  ÜÔÕ ÚÁÐÉÓØ × ÓÏÂÓÔ×ÅÎÎÙÊ keytab ÆÁÊÌ ÓÅÒ×ÅÒÁ. îÁÐÒÉÍÅÒ:</para>

	<screen>&prompt.root; <userinput>kadmin</userinput>
kadmin><userinput> add --random-key host/myserver.example.org</userinput>
Max ticket life [unlimited]:
Max renewable life [unlimited]:
Attributes []:
kadmin><userinput> ext host/myserver.example.org</userinput>
kadmin><userinput> exit</userinput></screen>

	<para>ïÂÒÁÔÉÔÅ ×ÎÉÍÁÎÉÅ, ÞÔÏ ËÏÍÁÎÄÁ <command>ext</command>
	  (ÓÏËÒÁÝÅÎÉÅ ÏÔ <quote>extract</quote>) ÓÏÈÒÁÎÑÅÔ ÐÏÌÕÞÅÎÎÙÊ ËÌÀÞ ×
	  ÆÁÊÌÅ <filename>/etc/krb5.keytab</filename> ÐÏ ÕÍÏÌÞÁÎÉÀ.</para>

	<para>åÓÌÉ ÎÁ <acronym>KDC</acronym> ÎÅ ÚÁÐÕÝÅÎ
	  <command>kadmind</command> (×ÏÚÍÏÖÎÏ ÐÏ ÓÏÏÂÒÁÖÅÎÉÑÍ ÂÅÚÏÐÁÓÎÏÓÔÉ)
	  É ×Ù ÎÅ ÍÏÖÅÔÅ ÐÏÌÕÞÉÔØ ÄÏÓÔÕÐ Ë <command>kadmin</command>
	  ÕÄÁÌÅÎÎÏ, ×ÏÚÍÏÖÎÏ ÄÏÂÁ×ÌÅÎÉÅ ÚÁÐÉÓÉ ÈÏÓÔÁ
	  (<username>host/myserver.EXAMPLE.ORG</username>) ÎÅÐÏÓÒÅÄÓÔ×ÅÎÎÏ
	  ÎÁ <acronym>KDC</acronym> Ó ÐÏÓÌÅÄÕÀÝÉÍ ÉÚ×ÌÅÞÅÎÉÅÍ ÅÅ ×Ï ×ÒÅÍÅÎÎÙÊ
	  ÆÁÊÌ (É ÐÅÒÅÚÁÐÉÓØÀ <filename>/etc/krb5.keytab</filename> ÎÁ
	  <acronym>KDC</acronym>) ÐÒÉÍÅÒÎÏ ÔÁË:</para>

	<screen>&prompt.root; <userinput>kadmin</userinput>
kadmin><userinput> ext --keytab=/tmp/example.keytab host/myserver.example.org</userinput>
kadmin><userinput> exit</userinput></screen>

	<para>úÁÔÅÍ ×Ù ÍÏÖÅÔÅ ÓËÏÐÉÒÏ×ÁÔØ keytab ÎÁ ÓÅÒ×ÅÒ ÚÁÝÉÝÅÎÎÙÍ ÓÐÏÓÏÂÏÍ
	  (ÎÁÐÒÉÍÅÒ, ÉÓÐÏÌØÚÕÑ <command>scp</command> ÉÌÉ ÄÉÓËÅÔÕ).
	  õÂÅÄÉÔÅÓØ, ÞÔÏ ÉÓÐÏÌØÚÕÅÍÏÅ ÉÍÑ keytab ÎÅ ÓÏ×ÐÁÄÁÅÔ Ó ÉÍÅÎÅÍ
	  ÐÏ ÕÍÏÌÞÁÎÉÀ ×Ï ÉÚÂÅÖÁÎÉÅ ÐÅÒÅÚÁÐÉÓÙ×ÁÎÉÑ  keytab ÎÁ
	  <acronym>KDC</acronym>.</para>

	<para>ôÅÐÅÒØ ×ÁÛ ÓÅÒ×ÅÒ ÍÏÖÅÔ Ó×ÑÚÙ×ÁÔØÓÑ Ó <acronym>KDC</acronym>
	  (ÄÏÂÁ×ÌÅÎ ÆÁÊÌ <filename>krb5.conf</filename>) É ÉÄÅÎÔÉÆÉÃÉÒÏ×ÁÔØ
	  ÓÅÂÑ (ÄÏÂÁ×ÌÅÎ ÆÁÊÌ <filename>krb5.keytab</filename>).  ôÅÐÅÒØ ×Ù
	  ÇÏÔÏ×Ù Ë ×ËÌÀÞÅÎÉÀ ÎÅËÏÔÏÒÙÈ ÓÅÒ×ÉÓÏ×
	  <application>Kerberos</application>.  ÷ ÜÔÏÍ ÐÒÉÍÅÒÅ ÍÙ ×ËÌÀÞÉÍ
	  ÓÅÒ×ÉÓ <command>telnet</command>, ÐÏÍÅÓÔÉ× ×
	  <filename>/etc/inetd.conf</filename> ÎÉÖÅÐÒÉ×ÅÄÅÎÎÕÀ ÓÔÒÏËÕ É
	  ÐÅÒÅÚÁÐÕÓÔÉ× ÓÅÒ×ÉÓ &man.inetd.8; ËÏÍÁÎÄÏÊ
	  <command>/etc/rc.d/inetd restart</command>:</para>

	<programlisting>telnet    stream  tcp     nowait  root    /usr/libexec/telnetd  telnetd -a user</programlisting>

	<para>ïÞÅÎØ ×ÁÖÎÏ ÕÓÔÁÎÏ×ÉÔØ ËÌÀÞ <command>-a</command> (ÔÉÐ
	  ÁÕÔÅÎÔÉÆÉËÁÃÉÉ) × user.  ïÂÒÁÔÉÔÅÓØ Ë ÓÔÒÁÎÉÃÅ ÓÐÒÁ×ÏÞÎÉËÁ
	  &man.telnetd.8; ÚÁ ÐÏÄÒÏÂÎÏÊ ÉÎÆÏÒÍÁÃÉÅÊ.</para>

      </sect2>

      <sect2>
	<title>ëÌÉÅÎÔ <application>Kerberos</application> Ó Heimdal</title>

	<indexterm>
	  <primary>Kerberos5</primary>
	  <secondary>ÎÁÓÔÒÏÊËÁ ËÌÉÅÎÔÏ×</secondary>
	</indexterm>

	<para>îÁÓÔÒÏÊËÁ ËÌÉÅÎÔÓËÏÇÏ ËÏÍÐØÀÔÅÒÁ ÐÏÞÔÉ ÔÒÉ×ÉÁÌØÎÏ ÐÒÏÓÔÁ.
	  ëÁË ÔÏÌØËÏ ÎÁÓÔÒÏÊËÁ <application>Kerberos</application> ÚÁËÏÎÞÅÎÁ,
	  ×ÁÍ ÐÏÔÒÅÂÕÅÔÓÑ ÔÏÌØËÏ ÆÁÊÌ ÎÁÓÔÒÏÊËÉ
	  <application>Kerberos</application>,
	  <filename>/etc/krb5.conf</filename>.  ðÒÏÓÔÏ ÓËÏÐÉÒÕÊÔÅ ÅÇÏ
	  ÂÅÚÏÐÁÓÎÙÍ ÓÐÏÓÏÂÏÍ ÎÁ ËÌÉÅÎÔÓËÉÊ ËÏÍÐØÀÔÅÒ Ó
	  <acronym>KDC</acronym>.</para>

	<para>ðÒÏÔÅÓÔÉÒÕÊÔÅ ËÌÉÅÎÔÓËÉÊ ËÏÍÐØÀÔÅÒ, ÐÏÐÙÔÁ×ÛÉÓØ ÉÓÐÏÌØÚÏ×ÁÔØ
	  <command>kinit</command>, <command>klist</command>, É
	  <command>kdestroy</command> ÄÌÑ ÐÏÌÕÞÅÎÉÑ, ÏÔÏÂÒÁÖÅÎÉÑ É ÕÄÁÌÅÎÉÑ
	  ÓÐÉÓËÁ ÄÏÓÔÕÐÁ.  óÏÅÄÉÎÉÔÅÓØ Ó <application>Kerberos</application>
	  ÓÅ×ÅÒÏÍ ÉÓÐÏÌØÚÕÑ ËÌÉÅÎÔ <application>Kerberos</application>, ÅÓÌÉ
	  ÓÏÅÄÉÎÅÎÉÅ ÎÅ ÒÁÂÏÔÁÅÔ É ÐÏÌÕÞÅÎÉÅ ÄÏÓÔÕÐÁ Ñ×ÌÑÅÔÓÑ ÐÒÏÂÌÅÍÏÊ,
	  ÜÔÏ ÓËÏÒÅÅ ×ÓÅÇÏ ÐÒÏÂÌÅÍÁ ÓÅÒ×ÅÒÁ, Á ÎÅ ËÌÉÅÎÔÁ ÉÌÉ
	  <acronym>KDC</acronym>.</para>

	<para>ðÒÉ ÔÅÓÔÉÒÏ×ÁÎÉÉ ÐÒÉÌÏÖÅÎÉÑ ×ÒÏÄÅ <command>telnet</command>,
	  ÐÏÐÒÏÂÕÊÔÅ ÉÓÐÏÌØÚÏ×ÁÔØ ÐÒÏÇÒÁÍÍÕ ÐÅÒÅÈ×ÁÔÁ ÐÁËÅÔÏ× (ÔÁËÕÀ
	  ËÁË &man.tcpdump.1;), ÞÔÏÂÙ ÕÂÅÄÉÔØÓÑ, ÞÔÏ ×ÁÛ ÐÁÒÏÌØ ÎÅ ÐÅÒÅÄÁÅÔÓÑ
	  ÎÅÚÁÛÉÆÒÏ×ÁÎÎÙÍ.  ðÏÐÒÏÂÕÊÔÅ ÉÓÐÏÌØÚÏ×ÁÔØ <command>telnet</command>
	  Ó ÐÁÒÁÍÅÔÒÏÍ <literal>-x</literal>, ÞÔÏÂÙ ÚÁÛÉÆÒÏ×ÁÔØ ×ÅÓØ ÐÏÔÏË
	  ÄÁÎÎÙÈ (ÐÏÄÏÂÎÏ <command>ssh</command>).</para>

	<para>ïÓÎÏ×ÎÙÅ ËÌÉÅÎÔÓËÉÅ ÐÒÉÌÏÖÅÎÉÑ
	  <application>Kerberos</application> (ÔÒÁÄÉÃÉÏÎÎÏ ÎÁÚÙ×ÁÀÝÉÅÓÑ
	  <command>kinit</command>, <command>klist</command>,
	  <command>kdestroy</command>, É
	  <command>kpasswd</command>) ÎÁÈÏÄÑÔÓÑ × ÂÁÚÏ×ÏÊ ÕÓÔÁÎÏ×ËÅ &os;.
	  ïÂÒÁÔÉÔÅ ×ÎÉÍÁÎÉÅ, ÞÔÏ × &os; ×ÅÒÓÉÊ ÄÏ 5.0 ÏÎÉ ÂÙÌÉ ÐÅÒÅÉÍÅÎÏ×ÁÎÙ
	  × <command>k5init</command>, <command>k5list</command>,
	  <command>k5destroy</command>, <command>k5passwd</command>, É
	  <command>k5stash</command> (ÈÏÔÑ ÉÈ ÏÂÙÞÎÏ ÉÓÐÏÌØÚÏ×ÁÌÉ ÌÉÛØ
	  ÏÄÎÏËÒÁÔÎÏ).</para>

	<para>òÁÚÌÉÞÎÙÅ ÎÅÏÓÎÏ×ÎÙÅ ËÌÉÅÎÔÓËÉÅ ÐÒÉÌÏÖÅÎÉÑ
	  <application>Kerberos</application> ÔÁËÖÅ ÕÓÔÁÎÁ×ÌÉ×ÁÀÔÓÑ ÐÏ
	  ÕÍÏÌÞÁÎÉÀ.  úÄÅÓØ ÐÒÏÑ×ÌÑÅÔÓÑ <quote>ÍÉÎÉÍÁÌØÎÏÓÔØ</quote>
	  ÂÁÚÏ×ÏÊ ÕÓÔÁÎÏ×ËÉ Heimdal: <command>telnet</command> ÜÔÏ
	  ÅÄÉÎÓÔ×ÅÎÎÏÅ ÐÒÉÌÏÖÅÎÉÅ, ÐÏÄÄÅÒÖÉ×ÁÀÝÅÅ
	  <application>Kerberos</application>.</para>

	<para>ðÏÒÔ Heimdal ÄÏÂÁ×ÌÑÅÔ ÎÅËÏÔÏÒÙÅ ÏÔÓÕÔÓÔ×ÕÀÝÉÅ ËÌÉÅÎÔÓËÉÅ
	  ÐÒÉÌÏÖÅÎÉÑ: ÐÏÄÄÅÒÖÉ×ÁÀÝÉÅ
	  <application>Kerberos</application> ×ÅÒÓÉÉ
	  <command>ftp</command>, <command>rsh</command>,
	  <command>rcp</command>, <command>rlogin</command>, É ÎÅËÏÔÏÒÙÅ
	  ÄÒÕÇÉÅ ÒÅÖÅ ÉÓÐÏÌØÚÕÅÍÙÅ ÐÒÏÇÒÁÍÍÙ.  ðÏÒÔ <acronym>MIT</acronym>
	  ÔÁËÖÅ ÓÏÄÅÒÖÉÔ ÐÏÌÎÙÊ ÐÁËÅÔ ËÌÉÅÎÔÓËÉÈ ÐÒÉÌÏÖÅÎÉÊ
	  <application>Kerberos</application>.</para>

      </sect2>

      <sect2>
	<title>ðÏÌØÚÏ×ÁÔÅÌØÓËÉÅ ÆÁÊÌÙ ÎÁÓÔÒÏÊËÉ: <filename>.k5login</filename>
	  É <filename>.k5users</filename></title>

	<indexterm>
	  <primary><filename>.k5login</filename></primary>
	</indexterm>

	<indexterm>
	  <primary><filename>.k5users</filename></primary>
	</indexterm>

	<para>õÞ£ÔÎÙÅ ÚÁÐÉÓÉ ÐÏÌØÚÏ×ÁÔÅÌÑ ×
	  <application>Kerberos</application> (ÎÁÐÒÉÍÅÒ
	  <username>tillman@EXAMPLE.ORG</username>) ÏÂÙÞÎÏ Ó×ÑÚÁÎÙ Ó
	  ÌÏËÁÌØÎÙÍÉ ÕÞ£ÔÎÙÍÉ ÚÁÐÉÓÑÍÉ (ÎÁÐÒÉÍÅÒ Ó ÌÏËÁÌØÎÏÊ ÕÞ£ÔÎÏÊ ÚÁÐÉÓØÀ6
	  <username>tillman</username>).  ëÌÉÅÎÔÓËÉÅ ÐÒÉÌÏÖÅÎÉÑ, ÔÁËÉÅ ËÁË
	  <command>telnet</command>, ÏÂÙÞÎÏ ÎÅ ÔÒÅÂÕÀÔ ÕËÁÚÁÎÉÑ ÉÍÅÎÉ
	  ÐÏÌØÚÏ×ÁÔÅÌÑ ÉÌÉ ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ.</para>

	<para>ôÅÍ ÎÅ ÍÅÎÅÅ, ×ÒÅÍÑ ÏÔ ×ÒÅÍÅÎÉ ×ÁÍ ÍÏÖÅÔ ÐÏÔÒÅÂÏ×ÁÔØÓÑ ÄÁÔØ
	  ÄÏÓÔÕÐ Ë ÌÏËÁÌØÎÏÊ ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ ËÏÍÕ-ÔÏ, Õ ËÏÇÏ ÎÅÔ
	  ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÅÊ ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ <application>Kerberos</application>.
	  îÁÐÒÉÍÅÒ, ÐÏÌØÚÏ×ÁÔÅÌÀ <username>tillman@EXAMPLE.ORG</username>
	  ÍÏÖÅÔ ÐÏÔÒÅÂÏ×ÁÔØÓÑ ÄÏÓÔÕÐ Ë ÌÏËÁÌØÎÏÊ ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ
	  <username>webdevelopers</username>.  äÒÕÇÉÍ ÕÞ£ÔÎÙÍ ÚÁÐÉÓÑÍ
	  ÔÁËÖÅ ÍÏÖÅÔ ÐÏÔÒÅÂÏ×ÁÔØÓÑ ÄÏÓÔÕÐ Ë ÜÔÏÊ ÌÏËÁÌØÎÏÊ ÕÞ£ÔÎÏÊ
	  ÚÁÐÉÓÉ.</para>

	<para>æÁÊÌÙ <filename>.k5login</filename> É
	  <filename>.k5users</filename>, ÐÏÍÅÝÅÎÎÙÅ × ÄÏÍÁÛÎÉÊ ËÁÔÁÌÏÇ
	  ÐÏÌØÚÏ×ÁÔÅÌÑ, ÍÏÇÕÔ ÂÙÔØ ÉÓÐÏÌØÚÏ×ÁÎÙ ÐÏÄÏÂÎÏ ÄÅÊÓÔ×ÅÎÎÏÊ
	  ËÏÍÂÉÎÁÃÉÉ <filename>.hosts</filename> É
	  <filename>.rhosts</filename> ÄÌÑ ÒÅÛÅÎÉÑ ÜÔÏÊ ÐÒÏÂÌÅÍÙ.
	  îÁÐÒÉÍÅÒ, ÆÁÊÌ <filename>.k5login</filename>
	  ÓÏ ÓÌÅÄÕÀÝÉÍ ÓÏÄÅÒÖÁÎÉÅÍ:</para>

	<screen>tillman@example.org
jdoe@example.org</screen>

	<para>ÐÏÍÅÝÅÎ × ÄÏÍÁÛÎÉÊ ËÁÔÁÌÏÇ ÌÏËÁÌØÎÏÇÏ ÐÏÌØÚÏ×ÁÔÅÌÑ
	  <username>webdevelopers</username>, ÔÏ ÏÂÅ ÕÐÏÍÑÎÕÔÙÅ ÕÞ£ÔÎÙÅ
	  ÚÁÐÉÓÉ ÐÏÌÕÞÁÔ ÄÏÓÔÕÐ Ë ÜÔÏÊ ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ ÂÅÚ ÎÅÏÂÈÏÄÉÍÏÓÔÉ
	  ÎÁÌÉÞÉÑ ÏÂÝÅÇÏ ÐÁÒÏÌÑ.</para>

	<para>òÅËÏÍÅÎÄÕÅÔÓÑ ÐÒÏÞÉÔÁÔØ ÓÔÒÁÎÉÃÕ ÓÐÒÁ×ÏÞÎÉËÁ ÐÏ ÜÔÉÍ ËÏÍÁÎÄÁÍ.
	  ïÂÒÁÔÉÔÅ ×ÎÉÍÁÎÉÅ, ÞÔÏ ÓÔÒÁÎÉÃÁ ÓÐÒÁ×ÏÞÎÉËÁ Ï
	  <command>ksu</command> ÓÏÄÅÒÖÉÔ ÉÎÆÏÒÍÁÃÉÀ ÐÏ
	  <filename>.k5users</filename>.</para>

      </sect2>

      <sect2>
	<title>ðÏÄÓËÁÚËÉ, ÓÏ×ÅÔÙ É ÒÅÛÅÎÉÅ ÐÒÏÂÌÅÍ Ó
	  <application>Kerberos</application></title>

	<indexterm>
	  <primary>Kerberos5</primary>
	  <secondary>ÒÅÛÅÎÉÅ ÐÒÏÂÌÅÍ</secondary>
	</indexterm>

	<itemizedlist>
	  <listitem>
	    <para>ðÒÉ ÉÓÐÏÌØÚÏ×ÁÎÉÉ ÐÏÒÔÏ× ËÁË Heimdal ÔÁË É
	      <acronym>MIT</acronym> <application>Kerberos</application>
	      ÕÂÅÄÉÔÅÓØ, ÞÔÏ × <envar>PATH</envar> ×ÅÒÓÉÉ
	      <application>Kerberos</application> ËÌÉÅÎÔÏ× ÕËÁÚÁÎÙ ÐÅÒÅÄ
	      ÉÈ ×ÅÒÓÉÑÍÉ × ÂÁÚÏ×ÏÊ ÓÉÓÔÅÍÅ.</para>
	  </listitem>

	  <listitem>
	    <para>÷ÓÅ ÌÉ ËÏÍÐØÀÔÅÒÙ × ÐÒÅÄÅÌÁÈ ÄÁÎÎÏÇÏ realm
	      ÓÉÎÈÒÏÎÉÚÉÒÏ×ÁÎÙ ÐÏ ×ÒÅÍÅÎÉ?  åÓÌÉ ÎÅÔ, ÁÕÔÅÎÔÉÆÉËÁÃÉÑ ÍÏÖÅÔ
	      ÚÁ×ÅÒÛÉÔØÓÑ ÎÅÕÄÁÞÎÏ.  <xref linkend="network-ntp"> ÏÐÉÓÙ×ÁÅÔ
	      ËÁË ÓÉÎÈÒÏÎÉÚÉÒÏ×ÁÔØ ÞÁÓÙ Ó ÉÓÐÏÌØÚÏ×ÁÎÉÅÍ
	      <acronym>NTP</acronym>.</para>
	  </listitem>

	  <listitem>
	    <para><acronym>MIT</acronym> É Heimdal ÕÓÐÅÛÎÏ ×ÚÁÉÍÏÄÅÊÓÔ×ÕÀÔ.
	      úÁ ÉÓËÌÀÞÅÎÉÅÍ <command>kadmin</command>, ÐÒÏÔÏËÏÌ ÄÌÑ ËÏÔÏÒÏÇÏ
	      ÎÅ ÓÔÁÎÄÁÒÔÉÚÏ×ÁÎ.</para>
	  </listitem>

	  <listitem>
	    <para>åÓÌÉ ×Ù ÉÚÍÅÎÑÅÔÅ hostname, ÐÏÔÒÅÂÕÅÔÓÑ ÔÁËÖÅ ÉÚÍÅÎÉÔØ
	      ÕÞ£ÔÎÕÀ ÚÁÐÉÓØ <username>host/</username> É ÏÂÎÏ×ÉÔØ keytab.
	      üÔÏ ÔÁËÖÅ ÎÅÏÂÈÏÄÉÍÏ ÄÌÑ ÓÐÅÃÉÁÌØÎÙÈ ÚÁÐÉÓÅÊ × keytab, ÔÁËÉÈ
	      ËÁË <username>www/</username> ÚÁÐÉÓØ ÍÏÄÕÌÑ Apache
	      <filename role="package">www/mod_auth_kerb</filename>.</para>
	  </listitem>

	  <listitem>
	    <para>÷ÓÅ ÈÏÓÔÙ ÐÏÄ ÏÂÝÉÍ ÉÄÅÎÔÉÆÉËÁÔÏÒÏÍ ÄÏÌÖÎÙ ÒÁÚÒÅÛÁÔØÓÑ
	      <acronym>DNS</acronym> (ÐÒÑÍÏÅ É ÏÂÒÁÔÎÏÅ ÒÁÚÒÅÛÅÎÉÅ), ÉÌÉ
	      ËÁË ÍÉÎÉÍÕÍ ÞÅÒÅÚ <filename>/etc/hosts</filename>. úÁÐÉÓÉ
	      CNAME ÂÕÄÕÔ ÒÁÂÏÔÁÔØ, ÎÏ ÚÁÐÉÓÉ A É PTR ÄÏÌÖÎÙ ÂÙÔØ ËÏÒÒÅËÔÎÙ
	      É ÎÁÈÏÄÉÔØÓÑ ÎÁ Ó×ÏÅÍ ÍÅÓÔÅ.  óÏÏÂÝÅÎÉÅ Ï ÏÛÉÂËÅ ÎÅ ×ÓÅÇÄÁ
	      ÉÎÔÕÉÔÉ×ÎÏ ÐÏÎÑÔÎÏ:
	      <errorname>Kerberos5 refuses authentication because Read req
	      failed: Key table entry not found</errorname>.</para>
	  </listitem>

	  <listitem>
	    <para>îÅËÏÔÏÒÙÅ ÏÐÅÒÁÃÉÏÎÎÙÅ ÓÉÓÔÅÍÙ, ÓÐÏÓÏÂÎÙÅ ÒÁÂÏÔÁÔØ × ËÁÞÅÓÔ×Å
	      ËÌÉÅÎÔÏ× <acronym>KDC</acronym> ÎÅ ÕÓÔÁÎÁ×ÌÉ×ÁÀÔ ÐÒÁ×Á
	      ÄÌÑ <command>ksu</command> × setuid <username>root</username>.
	      üÔÏ ÏÚÎÁÞÁÅÔ, ÞÔÏ <command>ksu</command> ÎÅ ÒÁÂÏÔÁÅÔ, ÞÔÏ ÈÏÒÏÛÏ
	      Ñ×ÌÑÅÔÓÑ ÈÏÒÏÛÅÊ ÉÄÅÅÊ ÄÌÑ ÂÅÚÏÐÁÓÎÏÓÔÉ, ÎÏ ÎÅÕÄÏÂÎÏ.  üÔÏ ÎÅ
	      ÏÛÉÂËÁ <acronym>KDC</acronym>.</para>
	  </listitem>

	  <listitem>
	    <para>ó <acronym>MIT</acronym>
	      <application>Kerberos</application>, ÅÓÌÉ ×Ù ÈÏÔÉÔÅ ÐÒÏÄÌÉÔØ
	      ÄÅÊÓÔ×ÉÅ ÄÏÓÔÕÐÁ ÄÏ ÚÎÁÞÅÎÉÑ ÂÏÌØÛÅÇÏ, ÞÅÍ ÄÅÓÑÔØ ÞÁÓÏ× ÐÏ
	      ÕÍÏÌÞÁÎÉÀ, ÉÓÐÏÌØÚÕÊÔÅ ËÏÍÁÎÄÕ
	      <command>modify_principal</command> ×
	      <command>kadmin</command> ÄÌÑ ÉÚÍÅÎÅÎÉÑ maxlife ÄÏÓÔÕÐÁ Ë ÓÁÍÏÊ
	      ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ É Ë ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ <username>krbtgt</username>.
	      úÁÔÅÍ ×ÏÚÍÏÖÎÏ ÉÓÐÏÌØÚÏ×ÁÎÉÅ <command>kinit</command>
	      Ó ÐÁÒÁÍÅÔÒÏÍ <literal>-l</literal> ÄÌÑ ÚÁÐÒÏÓÁ ÄÏÓÔÕÐÁ Ó ÂÏÌØÛÉÍ
	      ×ÒÅÍÅÎÅÍ ÄÅÊÓÔ×ÉÑ.</para>
	  </listitem>

	  <listitem>
	    <note><para>åÓÌÉ ×Ù ÚÁÐÕÓËÁÅÔÅ ÐÅÒÅÈ×ÁÔÞÉË ÐÁËÅÔÏ× ÎÁ
	      <acronym>KDC</acronym> ÄÌÑ ÒÁÚÒÅÛÅÎÉÑ ÐÒÏÂÌÅÍ, Á ÚÁÔÅÍ
	      ÚÁÐÕÓËÁÅÔÅ <command>kinit</command> Ó ÒÁÂÏÞÅÊ ÓÔÁÎÃÉÉ, ÔÏ
	      Õ×ÉÄÉÔÅ, ÞÔÏ <acronym>TGT</acronym> ÐÏÓÙÌÁÅÔÓÑ ÎÅÐÏÓÒÅÄÓÔ×ÅÎÎÏ
	      ÐÒÉ ÚÁÐÕÓËÅ <command>kinit</command> &mdash; ÄÁÖÅ ÄÏ ÔÏÇÏ, ËÁË
	      ×Ù ××ÅÄÅÔÅ ÐÁÒÏÌØ!  ïÂßÑÓÎÅÎÉÅ × ÔÏÍ, ÞÔÏ ÓÅÒ×ÅÒ
	      <application>Kerberos</application> Ó×ÏÂÏÄÎÏ ÒÁÓÐÒÏÓÔÒÁÎÑÅÔ
	      <acronym>TGT</acronym> (Ticket Granting Ticket) ÎÁ ËÁÖÄÙÊ
	      ÎÅÁ×ÔÏÒÉÚÏ×ÁÎÎÙÊ ÚÁÐÒÏÓ; ÏÄÎÁËÏ, ËÁÖÄÙÊ <acronym>TGT</acronym>
	      ÚÁÛÉÆÒÏ×ÁÎ ËÌÀÞÏÍ, ÐÏÌÕÞÅÎÎÙÍ ÉÚ ÐÁÒÏÌÑ ÐÏÌØÚÏ×ÁÔÅÌÑ.
	      óÌÅÄÏ×ÁÔÅÌØÎÏ, ËÏÇÄÁ ÐÏÌØÚÏ×ÁÔÅÌØ ××ÏÄÉÔ Ó×ÏÊ ÐÁÒÏÌØ, ÏÎ ÎÅ
	      ÏÔÐÒÁ×ÌÑÅÔÓÑ ÎÁ <acronym>KDC</acronym>, Á ÉÓÐÏÌØÚÕÅÔÓÑ ÄÌÑ
	      ÒÁÓÛÉÆÒÏ×ËÁ <acronym>TGT</acronym>, ËÏÔÏÒÙÊ ÕÖÅ ÐÏÌÕÞÅÎ
	      <command>kinit</command>.  åÓÌÉ × ÐÒÏÃÅÓÓÅ ÒÁÓÛÉÆÒÏ×ËÉ
	      ÐÏÌÕÞÁÅÔÓÑ ÐÒÁ×ÉÌØÎÙÊ ÂÉÌÅÔ Ó ÐÒÁ×ÉÌØÎÙÍ ÚÎÁÞÅÎÉÅÍ ×ÒÅÍÅÎÉ,
	      Õ ÐÏÌØÚÏ×ÁÔÅÌÑ ÅÓÔØ ÄÅÊÓÔ×ÕÀÝÅÅ <quote>ÕÄÏÓÔÏ×ÅÒÅÎÉÅ</quote>.
	      üÔÏ ÕÄÏÓÔÏ×ÅÒÅÎÉÅ ÓÏÄÅÒÖÉÔ ËÌÀÞ ÓÅÓÓÉÉ ÄÌÑ ÕÓÔÁÎÏ×ÌÅÎÉÑ
	      ÂÅÚÏÐÁÓÎÏÇÏ ÓÏÅÄÉÎÅÎÉÑ Ó ÓÅÒ×ÅÒÏÍ
	      <application>Kerberos</application>, ËÁË É ÄÅÊÓÔ×ÕÀÝÉÊ
	      <acronym>TGT</acronym>, ÚÁÛÉÆÒÏ×ÁÎÎÙÊ ËÌÀÞÏÍ ÓÅÒ×ÅÒÁ
	      <application>Kerberos</application>.  ÷ÔÏÒÏÊ ÕÒÏ×ÅÎØ ÛÉÆÒÏ×ÁÎÉÑ
	      ÎÅÄÏÓÔÕÐÅÎ ÐÏÌØÚÏ×ÁÔÅÌÀ, ÎÏ ÐÏÚ×ÏÌÑÅÔ ÓÅÒ×ÅÒÕ
	      <application>Kerberos</application> ÐÒÏ×ÅÒÑÔØ ÐÒÁ×ÉÌØÎÏÓÔØ
	      ËÁÖÄÏÇÏ <acronym>TGT</acronym>.</para></note>
	  </listitem>

	  <listitem>
	    <para>åÓÌÉ ×Ù ÈÏÔÉÔÅ ÕÓÔÁÎÏ×ÉÔØ ÂÏÌØÛÏÅ ×ÒÅÍÑ ÖÉÚÎÉ ÄÏÓÔÕÐÁ
	      (ÎÁÐÒÉÍÅÒ, ÎÅÄÅÌÀ), É ÉÓÐÏÌØÚÕÅÔÅ
	      <application>OpenSSH</application> ÄÌÑ ÓÏÅÄÉÎÅÎÉÑ Ó ËÏÍÐØÀÔÅÒÏÍ,
	      ÇÄÅ ÈÒÁÎÉÔÓÑ <quote>ÂÉÌÅÔ</quote>, ÕÂÅÄÉÔÅÓØ, ÞÔÏ ÐÁÒÁÍÅÔÒ
	      <application>Kerberos</application>
	      <option>TicketCleanup</option> ÕÓÔÁÎÏ×ÌÅÎ ×
	      <literal>no</literal> × ÆÁÊÌÅ <filename>sshd_config</filename>,
	      ÉÌÉ ÂÉÌÅÔÙ ÂÕÄÕÔ ÕÎÉÞÔÏÖÅÎÙ ÐÒÉ ×ÙÈÏÄÅ ÉÚ ÓÅÁÎÓÁ.</para>
	  </listitem>

	  <listitem>
	    <para>úÁÐÏÍÎÉÔÅ, ÞÔÏ ×ÒÅÍÑ ÖÉÚÎÉ ÂÉÌÅÔÏ× ÈÏÓÔÏ× ÂÏÌØÛÅ.
	      åÓÌÉ ×ÒÅÍÑ ÖÉÚÎÉ ÂÉÌÅÔÁ ÄÌÑ ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ ÐÏÌØÚÏ×ÁÔÅÌÑ
	      ÓÏÓÔÁ×ÌÑÅÔ ÎÅÄÅÌÀ, Á ×ÒÅÍÑ ÖÉÚÎÉ ÕÞ£ÔÎÏÊ ÚÁÐÉÓÉ ÈÏÓÔÁ, Ë
	      ËÏÔÏÒÏÍÕ ×Ù ÐÏÄÓÏÅÄÉÎÑÅÔÅÓØ ÄÅ×ÑÔØ ÞÁÓÏ×, ÕÞ£ÔÎÁÑ ÚÁÐÉÓØ ÈÏÓÔÁ
	      × ËÜÛÅ ÕÓÔÁÒÅÅÔ É ËÜÛ ÂÉÌÅÔÏ× ÂÕÄÅÔ ÒÁÂÏÔÁÔØ ÎÅ ÔÁË, ËÁË
	      ÏÖÉÄÁÅÔÓÑ.</para>
	  </listitem>

	  <listitem>
	    <para>ðÒÉ ÎÁÓÔÒÏÊËÅ ÆÁÊÌÁ <filename>krb5.dict</filename> ÎÁ
	    ÐÒÅÄÏÔ×ÒÁÝÅÎÉÅ ÉÓÐÏÌØÚÏ×ÁÎÉÑ ÏÐÒÅÄÅÌÅÎÎÙÈ ÐÌÏÈÉÈ ÐÁÒÏÌÅÊ
	    (ÓÔÒÁÎÉÃÁ ÓÐÒÁ×ÏÞÎÉËÁ ÄÌÑ <command>kadmind</command> ËÒÁÔËÏ
	    ÒÁÓÓËÁÚÙ×ÁÅÔ Ï ÜÔÏÍ), ÚÁÐÏÍÎÉÔÅ, ÞÔÏ ÜÔÏ ÐÒÉÍÅÎÉÍÏ ÔÏÌØËÏ
	    Ë ÕÞ£ÔÎÙÍ ÚÁÐÉÓÑÍ, ÄÌÑ ËÏÔÏÒÙÈ ÄÅÊÓÔ×ÕÅÔ ÐÏÌÉÔÉËÁ ÐÁÒÏÌÅÊ.
	    æÏÒÍÁÔ ÆÁÊÌÁ <filename>krb5.dict</filename> ÐÒÏÓÔ: ÏÄÎÏ ÓÌÏ×Ï
	    ÎÁ ÓÔÒÏËÕ.  íÏÖÅÔ ÐÏÍÏÞØ ÓÏÚÄÁÎÉÅ ÓÉÍ×ÏÌÉÞÅÓËÏÊ ÓÓÙÌËÉ ÎÁ
	    <filename>/usr/share/dict/words</filename>.</para>
	  </listitem>
	</itemizedlist>

      </sect2>

      <sect2>
	<title>ïÔÌÉÞÉÑ ÏÔ ÐÏÒÔÁ <acronym>MIT</acronym></title>

	<para>ïÓÎÏ×ÎÏÅ ÒÁÚÌÉÞÉÅ ÍÅÖÄÕ ÕÓÔÁÎÏ×ËÁÍÉ <acronym>MIT</acronym> É
	  Heimdal ÏÔÎÏÓÉÔÓÑ Ë ÐÒÏÇÒÁÍÍÅ <command>kadmin</command>,
	  ËÏÔÏÒÁÑ ÉÍÅÅÔ ÄÒÕÇÏÊ (ÎÏ ÜË×É×ÁÌÅÎÔÎÙÊ) ÎÁÂÏÒ ËÏÍÁÎÄ É
	  ÉÓÐÏÌØÚÕÅÔ ÄÒÕÇÏÊ ÐÒÏÔÏËÏÌ.  åÓÌÉ ×ÁÛ <acronym>KDC</acronym>
	  ÒÁÂÏÔÁÅÔ ÎÁ <acronym>MIT</acronym>, ×Ù ÎÅ ÓÍÏÖÅÔÅ ÉÓÐÏÌØÚÏ×ÁÔØ
	  <command>kadmin</command> ÄÌÑ ÕÄÁÌÅÎÎÏÇÏ ÁÄÍÉÎÉÓÔÒÉÒÏ×ÁÎÉÑ
	  <acronym>KDC</acronym> (É ÎÁÏÂÏÒÏÔ, ÐÏ ÜÔÏÊ ÖÅ ÐÒÉÞÉÎÅ).</para>

	<para>ïÐÃÉÉ ËÏÍÁÎÄÎÏÊ ÓÔÒÏËÉ ËÌÉÅÎÔÏ× ÔÁËÖÅ ÍÏÇÕÔ ÎÅÍÎÏÇÏ ÏÔÌÉÞÁÔØÓÑ
	  ÄÌÑ ÏÄÉÎÁËÏ×ÙÈ ÚÁÄÁÞ.  òÅËÏÍÅÎÄÕÅÔÓÑ ÓÌÅÄÏ×ÁÎÉÅ ÉÎÓÔÒÕËÃÉÑÍ
	  ÎÁ <acronym>MIT</acronym> <application>Kerberos</application>
	  Web-ÓÁÊÔÅ (<ulink url="http://web.mit.edu/Kerberos/www/"></ulink>).
	  âÕÄØÔÅ ×ÎÉÍÁÔÅÌØÎÙ ÐÒÉ ÏÐÒÅÄÅÌÅÎÉÉ <envar>PATH</envar>:
	  ÐÏÒÔ <acronym>MIT</acronym> ÕÓÔÁÎÁ×ÌÉ×ÁÅÔÓÑ ÐÏ ÕÍÏÌÞÁÎÉÀ ×
	  <filename>/usr/local/</filename>, É ÅÓÌÉ × <envar>PATH</envar>
	  ×ÎÁÞÁÌÅ ÕËÁÚÁÎÙ ÓÉÓÔÅÍÎÙÅ ËÁÔÁÌÏÇÉ, ×ÍÅÓÔÏ ÐÒÉÌÏÖÅÎÉÊ
	  <acronym>MIT</acronym> ÍÏÇÕÔ ÂÙÔØ ÚÁÐÕÝÅÎÙ ÓÉÓÔÅÍÎÙÅ
	  ÐÒÉÌÏÖÅÎÉÑ.</para>

	<note><para>ó ÐÏÒÔÏÍ <acronym>MIT</acronym>
	  <filename role="package">security/krb5</filename>, ÐÒÅÄÏÓÔÁ×ÌÑÅÍÙÍ
	  &os;, ÕÂÅÄÉÔÅÓØ ÞÔÏ ÆÁÊÌ
	  <filename>/usr/local/share/doc/krb5/README.FreeBSD</filename>
	  ÕÓÔÁÎÏ×ÌÅÎ ÐÏÒÔÏÍ, ÅÓÌÉ ×Ù ÈÏÔÉÔÅ ÐÏÎÑÔØ ÐÏÞÅÍÕ ×ÈÏÄ ÞÅÒÅÚ
	  <command>telnetd</command> É <command>klogind</command>
	  ÉÎÏÇÄÁ ÐÒÏÉÓÈÏÄÉÔ ÔÁË ÓÔÒÁÎÎÏ.  îÁÉÂÏÌÅÅ ×ÁÖÎÏ, ÉÓÐÒÁ×ÌÅÎÉÅ
	  <quote>incorrect permissions on cache file</quote> ÔÒÅÂÕÅÔ
	  ÉÓÐÏÌØÚÏ×ÁÎÉÑ ÂÉÎÁÒÎÏÇÏ ÆÁÊÌÁ <command>login.krb5</command>
	  ÄÌÑ ÁÕÔÅÎÔÉÆÉËÁÃÉÉ, ÞÔÏÂÙ ÐÒÁ×Á ÎÁ ÐÅÒÅÄÁÎÎÏÅ ÕÄÏÓÔÏ×ÅÒÅÎÉÅ
	  ÐÅÒÅÄÁ×ÁÌÉÓØ ÐÒÁ×ÉÌØÎÏ.</para></note>

      </sect2>

      <sect2>
	<title>ðÒÅÏÄÏÌÅÎÉÅ ÏÇÒÁÎÉÞÅÎÉÊ, ÏÂÎÁÒÕÖÅÎÎÙÈ ×
	  <application>Kerberos</application></title>

	<indexterm>
	  <primary>Kerberos5</primary>
	  <secondary>ÏÇÒÁÎÉÞÅÎÉÑ É ÎÅÄÏÓÔÁÔËÉ</secondary>
	</indexterm>

	<sect3>
	 <title><application>Kerberos</application> ÜÔÏ ×ÓÅ ÉÌÉ ÎÉÞÅÇÏ</title>

	  <para>ëÁÖÄÙÊ ÓÅÒ×ÉÓ, ÒÁÂÏÔÁÀÝÉÊ × ÓÅÔÉ, ÄÏÌÖÅÎ ÂÙÔØ ÍÏÄÉÆÉÃÉÒÏ×ÁÎ
	    ÄÌÑ ÒÁÂÏÔÙ Ó <application>Kerberos</application> (ÉÌÉ ÄÒÕÇÉÍ
	    ÓÐÏÓÏÂÏÍ ÚÁÝÉÝÅÎ ÏÔ ÁÔÁË ÐÏ ÓÅÔÉ) ÉÌÉ ÕÄÏÓÔÏ×ÅÒÅÎÉÑ ÐÏÌØÚÏ×ÁÔÅÌÅÊ
	    ÍÏÇÕÔ ÂÙÔØ ÕËÒÁÄÅÎÙ ÉÌÉ ÉÓÐÏÌØÚÏ×ÁÎÙ ÐÏ×ÔÏÒÎÏ.  ÷ ËÁÞÅÓÔ×Å ÐÒÉÍÅÒÁ
	    ÍÏÖÅÔ ÂÙÔØ ÐÒÉ×ÅÄÅÎÏ ÉÓÐÏÌØÚÏ×ÁÎÉÅ
	    <application>Kerberos</application> ×ÅÒÓÉÊ
	    ÏÂÏÌÏÞÅË ÄÌÑ ÕÄÁÌÅÎÎÏÊ ÒÁÂÏÔÙ (ÎÁÐÒÉÍÅÒ ÞÅÒÅÚ
	    <command>rsh</command> É <command>telnet</command>), ÐÒÉ
	    ÎÁÌÉÞÉÉ <acronym>POP3</acronym> ÓÅÒ×ÅÒÁ, ÐÏÌÕÞÁÀÝÅÇÏ ÐÁÒÏÌÉ ×
	    ÎÅÚÁÛÉÆÒÏ×ÁÎÎÏÍ ×ÉÄÅ.</para>

	</sect3>

	<sect3>
	  <title><application>Kerberos</application> ÐÒÅÄÎÁÚÎÁÞÅÎ ÄÌÑ
	    ÏÄÎÏÐÏÌØÚÏ×ÁÔÅÌØÓËÉÈ ÒÁÂÏÞÉÈ ÓÔÁÎÃÉÊ</title>

	  <para>÷ ÍÎÏÇÏÐÏÌØÚÏ×ÁÔÅÌØÓËÏÊ ÓÒÅÄÅ
	    <application>Kerberos</application> ÍÅÎÅÅ ÂÅÚÏÐÁÓÅÎ.
	    üÔÏ ÐÏÔÏÍÕ, ÞÔÏ ÏÎ ÈÒÁÎÉÔ ÂÉÌÅÔÙ × ËÁÔÁÌÏÇÅ
	    <filename>/tmp</filename>, ËÏÔÏÒÁÑ ÄÏÓÔÕÐÎÁ ÄÌÑ ÞÔÅÎÉÑ ×ÓÅÍ.
	    åÓÌÉ ÐÏÌØÚÏ×ÁÔÅÌØ ÒÁÂÏÔÁÅÔ Ó ÎÅÓËÏÌØËÉÍÉ ÄÒÕÇÉÍÉ ÐÏÌØÚÏ×ÁÔÅÌÑÍÉ
	    ÏÄÎÏ×ÒÅÍÅÎÎÏ ÎÁ ÏÄÎÏÍ ËÏÍÐØÀÔÅÒÅ (Ô.Å. × ÍÎÏÇÏÐÏÌØÚÏ×ÁÔÅÌØÓËÏÊ
	    ÓÒÅÄÅ), ×ÏÚÍÏÖÎÁ ËÒÁÖÁ (ËÏÐÉÒÏ×ÁÎÉÅ) ÂÉÌÅÔÁ ÄÒÕÇÉÍ
	    ÐÏÌØÚÏ×ÁÔÅÌÅÍ.</para>

	  <para>òÅÛÉÔØ ÐÒÏÂÌÅÍÕ ÍÏÖÎÏ Ó ÐÏÍÏÝØÀ ÐÁÒÁÍÅÔÒÁ ËÏÍÁÎÄÎÏÊ
	    ÓÔÒÏËÉ <literal>-c</literal> ÉÌÉ (ÐÒÅÄÐÏÞÔÉÔÅÌØÎÏ) Ó ÐÏÍÏÝØÀ
	    ÐÅÒÅÍÅÎÎÏÊ ÏËÒÕÖÅÎÉÑ <envar>KRB5CCNAME</envar>, ÎÏ ÜÔÏ ÄÅÌÁÅÔÓÑ
	    ÒÅÄËÏ.  äÌÑ ÐÒÅÏÄÏÌÅÎÉÑ ÏÇÒÁÎÉÞÅÎÉÑ ÄÏÓÔÁÔÏÞÎÏ ÓÏÈÒÁÎÑÔØ ÂÉÌÅÔ
	    × ÄÏÍÁÛÎÅÍ ËÁÔÁÌÏÇÅ ÐÏÌØÚÏ×ÁÔÅÌÑ É ÉÓÐÏÌØÚÏ×ÁÔØ ÐÒÏÓÔÙÅ
	    ÏÇÒÁÎÉÞÅÎÉÑ ÎÁ ÄÏÓÔÕÐ Ë ÆÁÊÌÁÍ.</para>

	</sect3>

	<sect3>
	  <title>ïÔ KDC ÚÁ×ÉÓÉÔ ×ÓÑ ÓÉÓÔÅÍÁ</title>

	  <para>áÒÈÉÔÅËÔÕÒÁ ÓÉÓÔÅÍÙ ÔÁËÏ×Á, ÞÔÏ <acronym>KDC</acronym> ÄÏÌÖÅÎ
	    ÂÙÔØ ÍÁËÓÉÍÁÌØÎÏ ÚÁÝÉÝÅÎ, ÐÏÓËÏÌØËÕ ÇÌÁ×ÎÙÊ ÐÁÒÏÌØ ÂÁÚÙ ÄÁÎÎÙÈ
	    ÓÏÄÅÒÖÉÔÓÑ × ÎÅÍ.  îÁ <acronym>KDC</acronym> ÎÅ ÄÏÌÖÎÏ ÂÙÔØ
	    ÚÁÐÕÝÅÎÏ ÎÉËÁËÉÈ ÄÒÕÇÉÈ ÓÅÒ×ÉÓÏ× É ÏÎ ÄÏÌÖÅÎ ÂÙÔØ ÚÁÝÉÝÅÎ
	    ÆÉÚÉÞÅÓËÉ.  ïÐÁÓÎÏÓÔØ ×ÅÌÉËÁ, ÐÏÓËÏÌØËÕ
	    <application>Kerberos</application> ÈÒÁÎÉÔ ×ÓÅ ÐÁÒÏÌÉ
	    ÚÁÛÉÆÒÏ×ÁÎÎÙÍÉ ÏÄÎÉÍ ËÌÀÞÏÍ (<quote>ÇÌÁ×ÎÙÍ</quote> ËÌÀÞÏÍ),
	    ËÏÔÏÒÙÊ ÈÒÁÎÉÔÓÑ × ÆÁÊÌÅ ÎÁ <acronym>KDC</acronym>.</para>

	  <para>èÏÒÏÛÅÊ ÎÏ×ÏÓÔØÀ Ñ×ÌÑÅÔÓÑ ÔÏ, ÞÔÏ ËÒÁÖÁ ÇÌÁ×ÎÏÇÏ ËÌÀÞÁ
	    ÎÅ ÓÔÁÎÅÔ ÔÁËÏÊ ÐÒÏÂÌÅÍÏÊ, ËÁË ÍÏÖÅÔ ÐÏËÁÚÁÔØÓÑ.  çÌÁ×ÎÙÊ ËÌÀÞ
	    ÉÓÐÏÌØÚÕÅÔÓÑ ÔÏÌØËÏ ÄÌÑ ÛÉÆÒÏ×ÁÎÉÑ ÂÁÚÙ ÄÁÎÎÙÈ
	    <application>Kerberos</application> É × ËÁÞÅÓÔ×Å seed ÄÌÑ
	    ÇÅÎÅÒÁÔÏÒÁ ÓÌÕÞÁÊÎÙÈ ÞÉÓÅÌ.  ðÏÓËÏÌØËÕ ÄÏÓÔÕÐ Ë
	    <acronym>KDC</acronym> ÚÁÝÉÝÅÎ, ÁÔÁËÕÀÝÉÊ ÍÁÌÏ ÞÔÏ ÓÍÏÖÅÔ ÓÄÅÌÁÔØ
	    Ó ÇÌÁ×ÎÙÍ ËÌÀÞÏÍ.</para>

	  <para>ëÒÏÍÅ ÔÏÇÏ, ÅÓÌÉ <acronym>KDC</acronym> ÓÔÁÎÅÔ ÎÅÄÏÓÔÕÐÅÎ
	    (×ÏÚÍÏÖÎÏ ÐÏ ÐÒÉÞÉÎÅ ÁÔÁË DoS ÉÌÉ ÐÒÏÂÌÅÍ × ÓÅÔÉ) ÓÅÔÅ×ÙÅ ÓÅÒ×ÉÓÙ
	    ÂÕÄÅÔ ÎÅ×ÏÚÍÏÖÎÏ ÉÓÐÏÌØÚÏ×ÁÔØ, ÐÏÓËÏÌØËÕ ÁÕÔÅÎÔÉÆÉËÁÃÉÑ ÎÅ
	    ÍÏÖÅÔ ÂÙÔØ ×ÙÐÏÌÎÅÎÁ.<!-- recipe for a denial-of-service attack-->
	    õÍÅÎØÛÉÔØ ÐÏÓÌÅÄÓÔ×ÉÑ ÍÏÖÎÏ ÐÒÉ ÎÁÌÉÞÉÉ ÎÅÓËÏÌØËÉÈ
	    <acronym>KDC</acronym> (ÏÄÉÎ ÇÌÁ×ÎÙÊ É ÏÄÉÎ ÉÌÉ ÎÅÓËÏÌØËÏ
	    ÒÅÚÅÒ×ÎÙÈ) É Ó ÁËËÕÒÁÔÎÏ ÒÅÁÌÉÚÏ×ÁÎÎÏÊ ÒÅÚÅÒ×ÎÏÊ ÁÕÔÅÎÔÉÆÉËÁÃÉÅÊ
	    (ÏÔÌÉÞÎÏ ÐÏÄÏÊÄÅÔ <acronym>PAM</acronym>).</para>

	</sect3>

	<sect3>
	  <title>îÅÄÏÓÔÁÔËÉ <application>Kerberos</application></title>

	  <para><application>Kerberos</application> ÐÏÚ×ÏÌÑÅÔ ÐÏÌØÚÏ×ÁÔÅÌÑÍ,
	    ÈÏÓÔÁÍ É ÓÅÒ×ÉÓÁÍ ÐÒÏÉÚ×ÏÄÉÔØ ÁÕÔÅÎÔÉÆÉËÁÃÉÀ ÄÒÕÇ ÄÒÕÇÁ.
	    ÷ ÎÅÍ ÎÅÔ ÍÅÈÁÎÉÚÍÁ ÁÕÔÅÎÔÉÆÉËÁÃÉÉ <acronym>KDC</acronym>
	    ÄÌÑ ÐÏÌØÚÏ×ÁÔÅÌÅÊ, ÈÏÓÔÏ× ÉÌÉ ÓÅÒ×ÉÓÏ×.  üÔÏ ÏÚÎÁÞÁÅÔ, ÞÔÏ
	    ÐÏÄÄÅÌØÎÙÊ <command>kinit</command> (ÎÁÐÒÉÍÅÒ) ÍÏÖÅÔ ÚÁÐÉÓÙ×ÁÔØ
	    ×ÓÅ ÉÍÅÎÁ ÐÏÌØÚÏ×ÁÔÅÌÅÊ É ÐÁÒÏÌÅÊ.  ðÏÍÏÞØ ÒÅÛÉÔØ ÐÒÏÂÌÅÍÕ ÍÏÖÅÔ
	    <filename role="package">security/tripwire</filename> ÉÌÉ
	    ÄÒÕÇÏÊ ÉÎÓÔÒÕÍÅÎÔ ÐÒÏ×ÅÒËÉ ÃÅÌÏÓÔÎÏÓÔÉ ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÙ.</para>

	</sect3>
      </sect2>

      <sect2>
	<title>òÅÓÕÒÓÙ É ÉÎÆÏÒÍÁÃÉÑ ÄÌÑ ÄÁÌØÎÅÊÛÅÇÏ ÉÚÕÞÅÎÉÑ</title>

	<indexterm>
	  <primary>Kerberos5</primary>
	  <secondary>×ÎÅÛÎÉÅ ÒÅÓÕÒÓÙ</secondary>
	</indexterm>

	<itemizedlist>
	  <listitem>
	  <para><ulink
	    url="http://www.faqs.org/faqs/Kerberos-faq/general/preamble.html">
	    <application>Kerberos</application> FAQ</ulink></para>
	</listitem>

	<listitem>
	  <para><ulink
	    url="http://web.mit.edu/Kerberos/www/dialogue.html">òÁÚÒÁÂÏÔËÁ
	    ÓÉÓÔÅÍÙ ÁÕÔÅÎÔÉÆÉËÁÃÉÉ: ÄÉÁÌÏÇ × ÞÅÔÙÒÅÈ ÓÃÅÎÁÈ</ulink></para>
	</listitem>

	<listitem>
	  <para><ulink
	    url="http://www.ietf.org/rfc/rfc1510.txt?number=1510">RFC 1510,
	    <application>Kerberos</application> Network Authentication Service
	    (V5)</ulink></para>
	</listitem>

	<listitem>
	  <para><ulink
	    url="http://web.mit.edu/Kerberos/www/">äÏÍÁÛÎÑÑ ÓÔÒÁÎÉÃÁ
	    <acronym>MIT</acronym>
	    <application>Kerberos</application></ulink></para>
	</listitem>

	<listitem>
	<para><ulink
	  url="http://www.pdc.kth.se/heimdal/">äÏÍÁÛÎÑÑ ÓÔÒÁÎÉÃÁ
	  Heimdal <application>Kerberos</application></ulink></para>
	</listitem>

	</itemizedlist>
    </sect2>
  </sect1>

  <sect1 id="openssl">
    <sect1info>
      <authorgroup>
	<author>
	  <firstname>Tom</firstname>
	  <surname>Rhodes</surname>
	  <contrib>îÁÐÉÓÁÌ: </contrib>
	</author>
      </authorgroup>
    </sect1info>
    <title>OpenSSL</title>
    <indexterm>
      <primary>ÂÅÚÏÐÁÓÎÏÓÔØ</primary>
      <secondary>OpenSSL</secondary>
    </indexterm>

    <para>ïÄÎÏÊ ÉÚ ÐÒÏÇÒÁÍÍ, ÔÒÅÂÕÀÝÉÈ ÏÓÏÂÏÇÏ ×ÎÉÍÁÎÉÑ ÐÏÌØÚÏ×ÁÔÅÌÅÊ,
      Ñ×ÌÑÅÔÓÑ ÎÁÂÏÒ ÐÒÏÇÒÁÍÍ <application>OpenSSL</application>,
      ×ËÌÀÞÅÎÎÙÊ × &os;.  <application>OpenSSL</application> ÐÒÅÄÏÓÔÁ×ÌÑÅÔ
      ÕÒÏ×ÅÎØ ÛÉÆÒÏ×ÁÎÉÑ ÐÏ×ÅÒÈ ÏÂÙÞÎÙÈ ÕÒÏ×ÎÅÊ ÓÏÅÄÉÎÅÎÉÑ; ÓÌÅÄÏ×ÁÔÅÌØÎÏ,
      ÏÎ ÍÏÖÅÔ ÂÙÔØ ÉÓÐÏÌØÚÏ×ÁÎ ÍÎÏÇÉÍÉ ÓÅÔÅ×ÙÍÉ ÐÒÉÌÏÖÅÎÉÑÍÉ É
      ÓÅÒ×ÉÓÁÍÉ.</para>

    <para><application>OpenSSL</application> ÍÏÖÅÔ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ ÄÌÑ
      ÛÉÆÒÏ×ÁÎÉÑ ÓÏÅÄÉÎÅÎÉÊ ÐÏÞÔÏ×ÙÈ ËÌÉÅÎÔÏ×, ÔÒÁÎÚÁËÃÉÊ ÞÅÒÅÚ ÉÎÔÅÒÎÅÔ,
      ÎÁÐÒÉÍÅÒ ÄÌÑ ËÒÅÄÉÔÎÙÈ ËÁÒÔ, É ÍÎÏÇÏÇÏ ÄÒÕÇÏÇÏ.  íÎÏÇÉÅ ÐÏÒÔÙ,
      ÔÁËÉÅ ËÁË <filename role="package">www/apache13-ssl</filename> É
      <filename role="package">mail/sylpheed-claws</filename> ÓÏÂÉÒÁÀÔÓÑ
      Ó <application>OpenSSL</application>.</para>

    <note>
      <para>÷ ÂÏÌØÛÉÎÓÔ×Å ÓÌÕÞÁÅ× × ëÏÌÌÅËÃÉÉ ðÏÒÔÏ× ÂÕÄÅÔ ÓÄÅÌÁÎÁ ÐÏÐÙÔËÁ
	ÐÏÓÔÒÏÅÎÉÑ ÐÏÒÔÁ <filename role="package">security/openssl</filename>,
	ÅÓÌÉ ÔÏÌØËÏ ÐÅÒÅÍÅÎÎÁÑ <makevar>WITH_OPENSSL_BASE</makevar>
	ÎÅ ÕÓÔÁÎÏ×ÌÅÎÁ Ñ×ÎÏ × <quote>yes</quote>.</para>
    </note>

    <para>÷ÅÒÓÉÑ <application>OpenSSL</application>, ×ËÌÀÞÁÅÍÁÑ
      × &os;, ÐÏÄÄÅÒÖÉ×ÁÅÔ ÓÅÔÅ×ÙÅ ÐÒÏÔÏËÏÌÙ ÂÅÚÏÐÁÓÎÏÓÔÉ
      Secure Sockets Layer v2/v3 (SSLv2/SSLv3),
      Transport Layer Security v1 (TLSv1) É ÍÏÖÅÔ ÂÙÔØ ÉÓÐÏÌØÚÏ×ÁÎÁ
      × ËÁÞÅÓÔ×Å ÏÓÎÏ×ÎÏÊ ËÒÉÐÔÏÇÒÁÆÉÞÅÓËÏÊ ÂÉÂÌÉÏÔÅËÉ.</para>

    <note>
      <para>èÏÔÑ <application>OpenSSL</application> ÐÏÄÄÅÒÖÉ×ÁÅÔ ÁÌÇÏÒÉÔÍ
	<acronym>IDEA</acronym>, ÐÏ ÕÍÏÌÞÁÎÉÀ ÏÎ ÏÔËÌÀÞÅÎ ÉÚ-ÚÁ ÐÁÔÅÎÔÎÙÈ
	ÏÇÒÁÎÉÞÅÎÉÊ óÏÅÄÉÎÅÎÎÙÈ ûÔÁÔÏ×.  äÌÑ ÅÇÏ ÉÓÐÏÌØÚÏ×ÁÎÉÑ ÎÅÏÂÈÏÄÉÍÏ
	ÏÚÎÁËÏÍÉÔØÓÑ Ó ÌÉÃÅÎÚÉÅÊ, É, ÅÓÌÉ ÏÇÒÁÎÉÞÅÎÉÑ ÐÒÉÅÍÌÅÍÙ,
	ÕÓÔÁÎÏ×ÉÔØ × <filename>make.conf</filename> ÐÅÒÅÍÅÎÎÕÀ
	<makevar>MAKE_IDEA</makevar>.</para>
    </note>

    <para>îÁÉÂÏÌÅÅ ÞÁÓÔÏ <application>OpenSSL</application>
      ÉÓÐÏÌØÚÕÅÔÓÑ ÄÌÑ ÓÏÚÄÁÎÉÑ ÓÅÒÔÉÆÉËÁÔÏ×, ÉÓÐÏÌØÚÕÅÍÙÈ ÐÒÏÇÒÁÍÍÎÙÍÉ
      ÐÁËÅÔÁÍÉ.  üÔÉ ÓÅÒÔÉÆÉËÁÔÙ ÐÏÄÔ×ÅÒÖÄÁÀÔ, ÞÔÏ ÄÁÎÎÙÅ ËÏÍÐÁÎÉÉ
      ÉÌÉ ÞÁÓÔÎÏÇÏ ÌÉÃÁ ×ÅÒÎÙ É ÎÅ ÐÏÄÄÅÌÁÎÙ.  åÓÌÉ ÒÁÓÓÍÁÔÒÉ×ÁÅÍÙÊ
      ÓÅÒÔÉÆÉËÁÔ ÎÅ ÂÙÌ ÐÒÏ×ÅÒÅÎ ÏÄÎÉÍ ÉÚ ÎÅÓËÏÌØËÉÈ ÓÅÒÔÉÆÉËÁÃÉÏÎÎÙÈ ÃÅÎÔÒÏ×
      (<quote>Certificate Authorities</quote> - <acronym>CA</acronym>), ÏÂÙÞÎÏ
      ×Ù×ÏÄÉÔÓÑ ÐÒÅÄÕÐÒÅÖÄÅÎÉÅ.  ãÅÎÔÒ ÓÅÒÔÉÆÉËÁÃÉÉ ÐÒÅÄÓÔÁ×ÌÑÅÔ ÓÏÂÏÊ
      ËÏÍÐÁÎÉÀ, ÔÁËÕÀ, ËÁË <ulink url="http://www.verisign.com">
      VeriSign</ulink>, ËÏÔÏÒÁÑ ÐÏÄÐÉÓÙ×ÁÅÔ ÓÅÒÔÉÆÉËÁÔÙ ÄÌÑ ÐÏÄÔ×ÅÒÖÄÅÎÉÑ
      ÄÁÎÎÙÈ ÞÁÓÔÎÙÈ ÌÉÃ ÉÌÉ ËÏÍÐÁÎÉÊ.  üÔÁ ÐÒÏÃÅÄÕÒÁ ÎÅ ÂÅÓÐÌÁÔÎÁ
      É ÎÅ Ñ×ÌÑÅÔÓÑ ÁÂÓÏÌÀÔÎÏ ÎÅÏÂÈÏÄÉÍÏÊ ÄÌÑ ÉÓÐÏÌØÚÏ×ÁÎÉÑ ÓÅÒÔÉÆÉËÁÔÏ×;
      ÏÄÎÁËÏ ÍÏÖÅÔ ÕÓÐÏËÏÉÔØ ÎÅËÏÔÏÒÙÈ ÏÓÏÂÏ ÏÓÔÏÒÏÖÎÙÈ
      ÐÏÌØÚÏ×ÁÔÅÌÅÊ.</para>

    <sect2>
      <title>çÅÎÅÒÉÒÏ×ÁÎÉÅ ÓÅÒÔÉÆÉËÁÔÏ×</title>

      <indexterm>
	<primary>OpenSSL</primary>
	<secondary>ÇÅÎÅÒÉÒÏ×ÁÎÉÅ ÓÅÒÔÉÆÉËÁÔÏ×</secondary>
      </indexterm>

      <para>äÌÑ ÇÅÎÅÒÉÒÏ×ÁÎÉÑ ÓÅÒÔÉÆÉËÁÔÏ× ÄÏÓÔÕÐÎÁ ÓÌÅÄÕÀÝÁÑ
	ËÏÍÁÎÄÁ:</para>

      <screen>&prompt.root; <userinput>openssl req -new -nodes -out req.pem -keyout cert.pem</userinput>
Generating a 1024 bit RSA private key
................++++++
.......................................++++++
writing new private key to 'cert.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:<userinput><replaceable>US</replaceable></userinput>
State or Province Name (full name) [Some-State]:<userinput><replaceable>PA</replaceable></userinput>
Locality Name (eg, city) []:<userinput><replaceable>Pittsburgh</replaceable></userinput>
Organization Name (eg, company) [Internet Widgits Pty Ltd]:<userinput><replaceable>My Company</replaceable></userinput>
Organizational Unit Name (eg, section) []:<userinput><replaceable>Systems Administrator</replaceable></userinput>
Common Name (eg, YOUR name) []:<userinput><replaceable>localhost.example.org</replaceable></userinput>
Email Address []:<userinput><replaceable>trhodes@FreeBSD.org</replaceable></userinput>

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:<userinput><replaceable>SOME PASSWORD</replaceable></userinput>
An optional company name []:<userinput><replaceable>Another Name</replaceable></userinput></screen>

      <para>÷×ÏÄ ÐÏÓÌÅ ÐÒÉÇÌÁÛÅÎÉÑ <quote>Common Name</quote>
	ÓÏÄÅÒÖÉÔ ÉÍÑ ÄÏÍÅÎÁ.  úÄÅÓØ ××ÏÄÉÔÓÑ ÉÍÑ ÓÅÒ×ÅÒÁ ÄÌÑ
	×ÅÒÉÆÉËÁÃÉÉ; ÐÏÍÅÝÅÎÉÅ × ÜÔÏ ÐÏÌÅ ÞÅÇÏ-ÌÉÂÏ ËÒÏÍÅ
	ÜÔÏÇÏ ÉÍÅÎÉ ÐÒÉ×ÅÄÅÔ Ë ÓÏÚÄÁÎÉÀ ÂÅÓÐÏÌÅÚÎÏÇÏ ÓÅÒÔÉÆÉËÁÔÁ.
	äÏÓÔÕÐÎÙ É ÄÒÕÇÉÅ ÐÁÒÁÍÅÔÒÙ, ÎÁÐÒÉÍÅÒ ÓÒÏË ÄÅÊÓÔ×ÉÑ,
	ÁÌØÔÅÒÎÁÔÉ×ÎÙÅ ÁÌÇÏÒÉÔÍÙ ÛÉÆÒÏ×ÁÎÉÑ É Ô.Ä.  ðÏÌÎÙÊ ÓÐÉÓÏË
	ÎÁÈÏÄÉÔÓÑ ÎÁ ÓÔÒÁÎÉÃÅ ÓÐÒÁ×ÏÞÎÏÇÏ ÒÕËÏ×ÏÄÓÔ×Á
	&man.openssl.1;.</para>

      <para>÷ ÔÅËÕÝÅÍ ËÁÔÁÌÏÇÅ, ÉÚ ËÏÔÏÒÏÇÏ ÂÙÌÁ ×ÙÚ×ÁÎÁ ×ÙÛÅÕËÁÚÁÎÎÁÑ
	ËÏÍÁÎÄÁ, ÄÏÌÖÎÙ ÐÏÑ×ÉÔØÓÑ Ä×Á ÆÁÊÌÁ.  æÁÊÌ
	<filename>req.pem</filename> Ó ÚÁÐÒÏÓÏÍ ÎÁ ÓÅÒÔÉÆÉËÁÃÉÀ ÍÏÖÅÔ ÂÙÔØ
	ÐÏÓÌÁÎ × ÃÅÎÔÒ ×ÙÄÁÞÉ ÓÅÒÔÉÆÉËÁÔÏ×, ËÏÔÏÒÙÊ ÐÒÏ×ÅÒÉÔ ××ÅÄ£ÎÎÙÅ ×ÁÍÉ
	ÐÏÄÔ×ÅÒÖÄÁÀÝÉÅ ÄÁÎÎÙÅ, ÐÏÄÐÉÛÅÔ ÚÁÐÒÏÓ É ×ÏÚ×ÒÁÔÉÔ ÓÅÒÔÉÆÉËÁÔ ×ÁÍ.
	÷ÔÏÒÏÊ ÓÏÚÄÁÎÎÙÊ ÆÁÊÌ ÂÕÄÅÔ ÉÍÅÔØ ÎÁÚ×ÁÎÉÅ
	<filename>cert.pem</filename> É ÓÏÄÅÒÖÁÔØ ÐÒÉ×ÁÔÎÙÊ ÓÅÒÔÉÆÉËÁÃÉÏÎÎÙÊ
	ËÌÀÞ, ËÏÔÏÒÙÊ ÎÅÏÂÈÏÄÉÍÏ ÔÝÁÔÅÌØÎÏ ÚÁÝÉÝÁÔØ; ÅÓÌÉ ÏÎ ÐÏÐÁÄ£Ô × ÒÕËÉ
	ÐÏÓÔÏÒÏÎÎÉÈ ÌÉÃ, ÔÏ ÍÏÖÅÔ ÂÙÔØ ÉÓÐÏÌØÚÏ×ÁÎ ÄÌÑ ÉÍÉÔÁÃÉÉ ÌÉÞÎÏ ×ÁÓ (ÉÌÉ
	×ÁÛÅÇÏ ÓÅÒ×ÅÒÁ).</para>

      <para>ëÏÇÄÁ ÐÏÄÐÉÓØ <acronym>CA</acronym> ÎÅ ÔÒÅÂÕÅÔÓÑ, ÍÏÖÅÔ
	ÂÙÔØ ÓÏÚÄÁÎ ÓÁÍÏÐÏÄÐÉÓÁÎÎÙÊ ÓÅÒÔÉÆÉËÁÔ.  óÎÁÞÁÌÁ ÓÏÚÄÁÊÔÅ ËÌÀÞ
	<acronym>RSA</acronym>:</para>

      <screen>&prompt.root; <userinput>openssl dsaparam -rand -genkey -out <filename>myRSA.key</filename> 1024</userinput></screen>

      <para>ôÅÐÅÒØ ÓÏÚÄÁÊÔÅ ËÌÀÞ <acronym>CA</acronym>:</para>

      <screen>&prompt.root; <userinput>openssl gendsa -des3 -out <filename>myca.key</filename> <filename>myRSA.key</filename></userinput></screen>

      <para>éÓÐÏÌØÚÕÊÔÅ ÜÔÏÔ ËÌÀÞ ÐÒÉ ÓÏÚÄÁÎÉÉ ÓÅÒÔÉÆÉËÁÔÁ:</para>

      <screen>&prompt.root; <userinput>openssl req -new -x509 -days 365 -key <filename>myca.key</filename> -out <filename>new.crt</filename></userinput></screen>

      <para>÷ ËÁÔÁÌÏÇÅ ÄÏÌÖÎÏ ÐÏÑ×ÉÔØÓÑ Ä×Á ÎÏ×ÙÈ ÆÁÊÌÁ: ÐÏÄÐÉÓØ ÓÅÒÔÉÆÉËÁÔÁ,
	<filename>myca.key</filename> É ÓÁÍ ÓÅÒÔÉÆÉËÁÔ,
	<filename>new.crt</filename>.  ïÎÉ ÄÏÌÖÎÙ ÂÙÔØ ÐÏÍÅÝÅÎÙ × ËÁÔÁÌÏÇ,
	ÄÏÓÔÕÐÎÙÊ ÄÌÑ ÞÔÅÎÉÑ ÔÏÌØËÏ <username>root</username>,
	ÖÅÌÁÔÅÌØÎÏ ×ÎÕÔÒÉ <filename class="directory">/etc</filename>.
	ðÒÁ×Á ÎÁ ËÁÔÁÌÏÇ ÍÏÖÎÏ ÉÚÍÅÎÉÔØ <command>chmod</command> Ó ÐÁÒÁÍÅÔÒÁÍÉ
	0700.</para>
    </sect2>

    <sect2>
      <title>éÓÐÏÌØÚÏ×ÁÎÉÅ ÓÅÒÔÉÆÉËÁÔÏ×, ÐÒÉÍÅÒ</title>

      <para>éÔÁË, ÞÔÏ ÍÏÇÕÔ ÓÄÅÌÁÔØ ÜÔÉ ÆÁÊÌÙ?  èÏÒÏÛÉÍ ÐÒÉÍÅÎÅÎÉÅÍ
	ÍÏÖÅÔ ÓÔÁÔØ ÛÉÆÒÏ×ÁÎÉÅ ÓÏÅÄÉÎÅÎÉÊ ÄÌÑ
	<application>Sendmail</application> <acronym>MTA</acronym>.
	üÔÏ ÓÄÅÌÁÅÔ ÎÅÎÕÖÎÙÍ ÉÓÐÏÌØÚÏ×ÁÎÉÅ ÐÒÏÓÔÏÊ ÔÅËÓÔÏ×ÏÊ
	ÁÕÔÅÎÔÉÆÉËÁÃÉÉ ÄÌÑ ÔÅÈ, ËÔÏ ÏÔÐÒÁ×ÌÑÅÔ ÐÏÞÔÕ ÞÅÒÅÚ
	ÌÏËÁÌØÎÙÊ <acronym>MTA</acronym>.</para>

      <note>
	<para>üÔÏ ÎÅ ÌÕÞÛÅÅ ÉÚ ×ÏÚÍÏÖÎÙÈ ÉÓÐÏÌØÚÏ×ÁÎÉÊ, ÐÏÓËÏÌØËÕ
	  ÎÅËÏÔÏÒÙÅ <acronym>MUA</acronym> ×ÙÄÁÄÕÔ ÏÛÉÂËÕ, ÅÓÌÉ
	  ÓÅÒÔÉÆÉËÁÔ ÎÅ ÕÓÔÁÎÏ×ÌÅÎ ÌÏËÁÌØÎÏ.  ïÂÒÁÔÉÔÅÓØ Ë
	  ÐÏÓÔÁ×ÌÑÅÍÏÊ Ó ÐÒÏÇÒÁÍÍÏÊ ÄÏËÕÍÅÎÔÁÃÉÉ ÚÁ ÉÎÆÏÒÍÁÃÉÅÊ ÐÏ
	  ÕÓÔÁÎÏ×ËÅ ÓÅÒÔÉÆÉËÁÔÁ.</para>
      </note>

      <para>óÌÅÄÕÀÝÉÅ ÓÔÒÏËÉ ÄÏÌÖÎÙ ÂÙÔØ ÐÏÍÅÝÅÎÙ × ÌÏËÁÌØÎÙÊ ÆÁÊÌ
	<filename>.mc</filename>:</para>

      <programlisting>dnl SSL Options
define(`confCACERT_PATH',`/etc/certs')dnl
define(`confCACERT',`/etc/certs/new.crt')dnl
define(`confSERVER_CERT',`/etc/certs/new.crt')dnl
define(`confSERVER_KEY',`/etc/certs/myca.key')dnl
define(`confTLS_SRV_OPTIONS', `V')dnl</programlisting>

      <para>çÄÅ <filename class="directory">/etc/certs/</filename>
	ÜÔÏ ËÁÔÁÌÏÇ ÄÌÑ ÌÏËÁÌØÎÏÇÏ ÈÒÁÎÅÎÉÑ ÓÅÒÔÉÆÉËÁÔÁ É
	ËÌÀÞÅÊ.  ðÏÓÌÅ ÎÁÓÔÒÏÊËÉ ÎÅÏÂÈÏÄÉÍÏ ÓÏÂÒÁÔØ ÌÏËÁÌØÎÙÊ
	ÆÁÊÌ <filename>.cf</filename>.  üÔÏ ÌÅÇËÏ ÓÄÅÌÁÔØ,
	ÎÁÂÒÁ× <command>make</command> <parameter>install</parameter>
	× ËÁÔÁÌÏÇÅ <filename class="directory">/etc/mail</filename>.
	úÁÔÅÍ ×ÙÐÏÌÎÉÔÅ ËÏÍÁÎÄÕ <command>make</command>
	<parameter>restart</parameter>, ËÏÔÏÒÁÑ ÄÏÌÖÎÁ ÚÁÐÕÓÔÉÔØ
	ÄÁÅÍÏÎ <application>Sendmail</application>.</para>

      <para>åÓÌÉ ×ÓÅ ÐÒÏÊÄÅÔ ÎÏÒÍÁÌØÎÏ, × ÆÁÊÌÅ
	<filename>/var/log/maillog</filename> ÎÅ ÐÏÑ×ÑÔÓÑ ÓÏÏÂÝÅÎÉÑ
	ÏÂ ÏÛÉÂËÁÈ É ÚÁÐÕÓÔÉÔÓÑ ÐÒÏÃÅÓÓ
	<application>Sendmail</application>.</para>

      <para>äÌÑ ÐÒÏ×ÅÄÅÎÉÑ ÐÒÏÓÔÏÇÏ ÔÅÓÔÁ ÐÏÄËÌÀÞÉÔÅÓØ Ë ÐÏÞÔÏ×ÏÍÕ ÓÅÒ×ÅÒÕ
	ÐÒÏÇÒÁÍÍÏÊ &man.telnet.1;:</para>

      <screen>&prompt.root; <userinput>telnet <replaceable>example.com</replaceable> 25</userinput>
Trying 192.0.34.166...
Connected to <hostid role="fqdn">example.com</hostid>.
Escape character is '^]'.
220 <hostid role="fqdn">example.com</hostid> ESMTP Sendmail 8.12.10/8.12.10; Tue, 31 Aug 2004 03:41:22 -0400 (EDT)
<userinput>ehlo <replaceable>example.com</replaceable></userinput>
250-example.com Hello example.com [192.0.34.166], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE
250-DSN
250-ETRN
250-AUTH LOGIN PLAIN
250-STARTTLS
250-DELIVERBY
250 HELP
<userinput>quit</userinput>
221 2.0.0 <hostid role="fqdn">example.com</hostid> closing connection
Connection closed by foreign host.</screen>

      <para>åÓÌÉ × ×Ù×ÏÄÅ ÐÏÑ×ÉÌÁÓØ ÓÔÒÏËÁ <quote>STARTTLS</quote>,
	×ÓÅ ÒÁÂÏÔÁÅÔ ÐÒÁ×ÉÌØÎÏ.</para>
    </sect2>
  </sect1>

  <sect1 id="ipsec">
    <sect1info>
      <authorgroup>
	<author>
  	  <firstname>Nik</firstname>
	  <surname>Clayton</surname>
	  <affiliation>
	    <address><email>nik@FreeBSD.org</email></address>
	  </affiliation>
	  <contrib>îÁÐÉÓÁÌ </contrib>
	</author>
      </authorgroup>
    </sect1info>

    <indexterm>
      <primary>IPsec</primary>
    </indexterm>

    <title>VPN ÞÅÒÅÚ IPsec</title>

    <para>óÏÚÄÁÎÉÅ VPN ÍÅÖÄÕ Ä×ÕÍÑ ÓÅÔÑÍÉ, ÓÏÅÄÉÎÅÎÎÙÍÉ ÞÅÒÅÚ ÉÎÔÅÒÎÅÔ,
      Ó ÉÓÐÏÌØÚÏ×ÁÎÉÅÍ ÛÌÀÚÏ× FreeBSD.</para>

    <sect2>
      <sect2info>
	<authorgroup>
	  <author>
	    <firstname>Hiten M.</firstname>
	    <surname>Pandya</surname>
	    <affiliation>
	      <address><email>hmp@FreeBSD.org</email></address>
	    </affiliation>
	    <contrib>îÁÐÉÓÁÌ </contrib>
	  </author>
	</authorgroup>
      </sect2info>

      <title>ðÒÉÎÃÉÐÙ ÒÁÂÏÔÙ IPsec</title>

      <para>üÔÏÔ ÒÁÚÄÅÌ ÐÏÓÌÕÖÉÔ ×ÁÍ ÒÕËÏ×ÏÄÓÔ×ÏÍ ÐÏ ÎÁÓÔÒÏÊËÅ IPsec É ÅÇÏ
	ÉÓÐÏÌØÚÏ×ÁÎÉÀ × ÓÒÅÄÅ FreeBSD É <application>&microsoft.windows;
	2000/XP</application>, ÓÏÅÄÉÎÑÅÍÙÈ ÂÅÚÏÐÁÓÎÙÍ ÓÐÏÓÏÂÏÍ.
	äÌÑ ÎÁÓÔÒÏÊËÉ IPsec ÎÅÏÂÈÏÄÉÍÏ ÏÚÎÁËÏÍÉÔØÓÑ Ó ÐÒÏÃÅÓÓÏÍ
	ÓÂÏÒËÉ ÑÄÒÁ (<xref linkend="kernelconfig">).</para>

      <para><emphasis>IPsec</emphasis> ÜÔÏ ÐÒÏÔÏËÏÌ, ÒÁÓÐÏÌÏÖÅÎÎÙÊ ÐÏ×ÅÒÈ
	ÓÌÏÑ Internet Protocol (IP).  ïÎ ÐÏÚ×ÏÌÑÅÔ Ä×ÕÍ ÉÌÉ ÂÏÌÅÅ ÈÏÓÔÁÍ
	Ó×ÑÚÙ×ÁÔØÓÑ ÚÁÝÉÝÅÎÎÙÍ ÓÐÏÓÏÂÏÍ (ÏÔÓÀÄÁ É ÎÁÚ×ÁÎÉÅ ÐÒÏÔÏËÏÌÁ).
	<quote>óÅÔÅ×ÏÊ ÓÔÅË</quote> FreeBSD IPsec ÏÓÎÏ×ÁÎ ÎÁ
	ÒÅÁÌÉÚÁÃÉÉ <ulink url="http://www.kame.net/">KAME</ulink>,
	ÐÏÄÄÅÒÖÉ×ÁÀÝÅÊ ÏÂÁ ÓÅÍÅÊÓÔ×Á ÐÒÏÔÏËÏÌÏ×, IPv4 É IPv6.</para>

      <note>
	<para>FreeBSD ÓÏÄÅÒÖÉÔ <quote>ÁÐÐÁÒÁÔÎÏ
	  ÐÏÄÄÅÒÖÉ×ÁÅÍÙÊ</quote> ÓÔÅË IPsec, ÉÚ×ÅÓÔÎÙÊ ËÁË <quote>Fast
	  IPsec</quote>, ÚÁÉÍÓÔ×Ï×ÁÎÎÙÊ ÉÚ OpenBSD.  äÌÑ ÏÐÔÉÍÉÚÁÃÉÉ
	  ÐÒÏÉÚ×ÏÄÉÔÅÌØÎÏÓÔÉ IPsec ÏÎ ÚÁÄÅÊÓÔ×ÕÅÔ ËÒÉÐÔÏÇÒÁÆÉÞÅÓËÏÅ
	  ÏÂÏÒÕÄÏ×ÁÎÉÅ (ËÏÇÄÁ ÏÎÏ ÄÏÓÔÕÐÎÏ) ÞÅÒÅÚ ÐÏÄÓÉÓÔÅÍÕ &man.crypto.4;.
	  üÔÏ ÎÏ×ÁÑ ÐÏÄÓÉÓÔÅÍÁ É ÏÎÁ ÎÅ ÐÏÄÄÅÒÖÉ×ÁÅÔ ×ÓÅÈ ×ÏÚÍÏÖÎÏÓÔÅÊ,
	  ÄÏÓÔÕÐÎÙÈ × KAME ×ÅÒÓÉÉ IPsec.  äÌÑ ×ËÌÀÞÅÎÉÑ IPsec Ó ÁÐÐÁÒÁÔÎÏÊ
	  ÐÏÄÄÅÒÖËÏÊ ÎÅÏÂÈÏÄÉÍÏ ÄÏÂÁ×ÉÔØ × ÆÁÊÌ ÎÁÓÔÒÏÊËÉ ÑÄÒÁ ÓÌÅÄÕÀÝÉÊ
	  ÐÁÒÁÍÅÔÒ:</para>

	<indexterm>
	  <primary>ÐÁÒÁÍÅÔÒÙ ÑÄÒÁ</primary>

	  <secondary>FAST_IPSEC</secondary>
	</indexterm>

	<screen>options	  FAST_IPSEC  # new IPsec (cannot define w/ IPSEC)</screen>

	<para>ïÂÒÁÔÉÔÅ ×ÎÉÍÁÎÉÅ, ÞÔÏ ÎÁ ÄÁÎÎÙÊ ÍÏÍÅÎÔ ÎÅ×ÏÚÍÏÖÎÏ
	  ÉÓÐÏÌØÚÏ×ÁÔØ ÐÏÄÓÉÓÔÅÍÕ <quote>Fast IPsec</quote> ×ÍÅÓÔÅ
	  Ó KAME ÒÅÁÌÉÚÁÃÉÅÊ IPsec.  ïÂÒÁÔÉÔÅÓØ Ë ÓÔÒÁÎÉÃÅ ÓÐÒÁ×ÏÞÎÉËÁ
	  &man.fast.ipsec.4; ÚÁ ÄÁÌØÎÅÊÛÅÊ ÉÎÆÏÒÍÁÃÉÅÊ.</para>
      </note>

      <note>
	<para>äÌÑ ÔÏÇÏ, ÞÔÏÂÙ ÐÒÉÍÅÎÑÔØ Ë ÔÕÎÎÅÌÑÍ &man.gif.4;
	  ÍÅÖÓÅÔÅ×ÙÅ ÜËÒÁÎÙ, ×ÁÍ ÐÏÔÒÅÂÕÅÔÓÑ ×ËÌÀÞÉÔØ × ÑÄÒÏ ÏÐÃÉÀ
	  <option>IPSEC_FILTERGIF</option>:</para>

	<screen>
options   IPSEC_FILTERGIF  #filter ipsec packets from a tunnel
	</screen>
       </note>
   
      <indexterm>
	<primary>IPsec</primary>

	<secondary>ESP</secondary>
      </indexterm>

      <indexterm>
	<primary>IPsec</primary>

	<secondary>AH</secondary>
      </indexterm>

      <para>IPsec ÓÏÓÔÏÉÔ ÉÚ Ä×ÕÈ ÐÏÄÐÒÏÔÏËÏÌÏ×:</para>

      <itemizedlist>
	<listitem>
	  <para><emphasis>Encapsulated Security Payload
	    (ESP)</emphasis>, ÚÁÝÉÝÁÀÝÅÊ ÄÁÎÎÙÅ IP ÐÁËÅÔÁ ÏÔ ×ÍÅÛÁÔÅÌØÓÔ×Á
	    ÔÒÅÔØÅÊ ÓÔÏÒÏÎÙ ÐÕÔÅÍ ÛÉÆÒÏ×ÁÎÉÑ ÓÏÄÅÒÖÉÍÏÇÏ Ó ÐÏÍÏÝØÀ
	    ÓÉÍÍÅÔÒÉÞÎÙÈ ËÒÉÐÔÏÇÒÁÆÉÞÅÓËÉÈ ÁÌÇÏÒÉÔÍÏ× (ÔÁËÉÈ ËÁË
	    Blowfish,3DES).</para>
	</listitem>
	<listitem>
	  <para><emphasis>Authentication Header (AH)</emphasis>,
	    ÚÁÝÉÝÁÀÝÉÊ ÚÁÇÏÌÏ×ÏË IP ÐÁËÅÔÁ ÏÔ ×ÍÅÛÁÔÅÌØÓÔ×Á ÔÒÅÔØÅÊ ÓÔÏÒÏÎÙ
	    É ÐÏÄÄÅÌËÉ ÐÕÔÅÍ ×ÙÞÉÓÌÅÎÉÑ ËÒÉÐÔÏÇÒÁÆÉÞÅÓËÏÊ ËÏÎÔÒÏÌØÎÏÊ ÓÕÍÍÙ
	    É ÈÅÛÉÒÏ×ÁÎÉÑ ÐÏÌÅÊ ÚÁÇÏÌÏ×ËÁ IP ÐÁËÅÔÁ ÚÁÝÉÝÅÎÎÏÊ ÆÕÎËÃÉÅÊ
	    ÈÅÛÉÒÏ×ÁÎÉÑ.  ë ÐÁËÅÔÕ ÄÏÂÁ×ÌÑÅÔÓÑ ÄÏÐÏÌÎÉÔÅÌØÎÙÊ ÚÁÇÏÌÏ×ÏË
	    Ó ÈÜÛÅÍ, ÐÏÚ×ÏÌÑÀÝÉÊ ÁÕÔÅÎÔÉÆÉËÁÃÉÀ ÉÎÆÏÒÍÁÃÉÉ ÐÁËÅÔÁ.</para>
	</listitem>
      </itemizedlist>

      <para><acronym>ESP</acronym> É <acronym>AH</acronym> ÍÏÇÕÔ ÂÙÔØ
	ÉÓÐÏÌØÚÏ×ÁÎÙ ×ÍÅÓÔÅ ÉÌÉ ÐÏ ÏÔÄÅÌØÎÏÓÔÉ, × ÚÁ×ÉÓÉÍÏÓÔÉ ÏÔ
	ÏÂÓÔÏÑÔÅÌØÓÔ×.</para>

      <indexterm>
	<primary>VPN</primary>
      </indexterm>

      <indexterm>
	<primary>×ÉÒÔÕÁÌØÎÁÑ ÞÁÓÔÎÁÑ ÓÅÔØ</primary>

	<see>VPN</see>
      </indexterm>

      <para>IPsec ÍÏÖÅÔ ÂÙÔØ ÉÓÐÏÌØÚÏ×ÁÎ ÉÌÉ ÄÌÑ ÎÅÐÏÓÒÅÄÓÔ×ÅÎÎÏÇÏ ÛÉÆÒÏ×ÁÎÉÑ
	ÔÒÁÆÉËÁ ÍÅÖÄÕ Ä×ÕÍÑ ÈÏÓÔÁÍÉ (<emphasis>ÔÒÁÎÓÐÏÒÔÎÙÊ
	ÒÅÖÉÍ</emphasis>); ÉÌÉ ÄÌÑ ÐÏÓÔÒÏÅÎÉÑ <quote>×ÉÒÔÕÁÌØÎÙÈ
	ÔÕÎÎÅÌÅÊ</quote> ÍÅÖÄÕ Ä×ÕÍÑ ÐÏÄÓÅÔÑÍÉ, ËÏÔÏÒÙÅ ÍÏÇÕÔ ÂÙÔØ
	ÉÓÐÏÌØÚÏ×ÁÎÙ ÄÌÑ ÚÁÝÉÔÙ ÓÏÅÄÉÎÅÎÉÊ ÍÅÖÄÕ Ä×ÕÍÑ ËÏÒÐÏÒÁÔÉ×ÎÙÍÉ
	ÓÅÔÑÍÉ (<emphasis>ÔÕÎÎÅÌØÎÙÊ ÒÅÖÉÍ</emphasis>).  ðÏÓÌÅÄÎÉÊ ÏÂÙÞÎÏ
	ÎÁÚÙ×ÁÀÔ <emphasis>×ÉÒÔÕÁÌØÎÏÊ ÞÁÓÔÎÏÊ ÓÅÔØÀ</emphasis>
	(Virtual Private Network, VPN).  úÁ ÄÅÔÁÌØÎÏÊ ÉÎÆÏÒÍÁÃÉÅÊ Ï
	ÐÏÄÓÉÓÔÅÍÅ IPsec × FreeBSD ÏÂÒÁÔÉÔÅÓØ Ë ÓÔÒÁÎÉÃÅ ÓÐÒÁ×ÏÞÎÉËÁ
	&man.ipsec.4;.</para>

      <para>äÌÑ ×ËÌÀÞÅÎÉÑ ÐÏÄÄÅÒÖËÉ IPsec × ÑÄÒÅ, ÄÏÂÁ×ØÔÅ ÓÌÅÄÕÀÝÉÅ
	ÐÁÒÁÍÅÔÒÙ Ë ÆÁÊÌÕ ÎÁÓÔÒÏÊËÉ ÑÄÒÁ:</para>

      <indexterm>
	<primary>ÐÁÒÁÍÅÔÒÙ ÑÄÒÁ</primary>

	<secondary>IPSEC</secondary>
      </indexterm>

      <indexterm>
	<primary>ÐÁÒÁÍÅÔÒÙ ÑÄÒÁ</primary>

	<secondary>IPSEC_ESP</secondary>
      </indexterm>

      <screen>options   IPSEC        #IP security
options   IPSEC_ESP    #IP security (crypto; define w/ IPSEC)</screen>

      <indexterm>
	<primary>ÐÁÒÁÍÅÔÒÙ ÑÄÒÁ</primary>

	<secondary>IPSEC_DEBUG</secondary>
      </indexterm>

      <para>åÓÌÉ ÖÅÌÁÔÅÌØÎÁ ÐÏÄÄÅÒÖËÁ ÏÔÌÁÄËÉ IPsec, ÄÏÌÖÎÁ ÂÙÔØ ÔÁËÖÅ
	ÄÏÂÁ×ÌÅÎÁ ÓÌÅÄÕÀÝÁÑ ÓÔÒÏËÁ:</para>

      <screen>
options   IPSEC_DEBUG  #debug for IP security
      </screen>
    </sect2>

    <sect2>
      <title>ðÒÏÂÌÅÍÁ</title>

      <para>îÅ ÓÕÝÅÓÔ×ÕÅÔ ÓÔÁÎÄÁÒÔÁ VPN.  ïÎÉ ÍÏÇÕÔ ÂÙÔØ ÒÅÁÌÉÚÏ×ÁÎÙ
	ÍÎÏÖÅÓÔ×ÏÍ ÒÁÚÌÉÞÎÙÈ ÔÅÈÎÏÌÏÇÉÊ, ËÁÖÄÁÑ ÉÚ ËÏÔÏÒÙÈ ÉÍÅÅÔ Ó×ÏÉ
	ÓÉÌØÎÙÅ É ÓÌÁÂÙÅ ÓÔÏÒÏÎÙ.  üÔÏÔ ÒÁÚÄÅÌ ÐÒÅÄÓÔÁ×ÌÑÅÔ
	ÓÃÅÎÁÒÉÊ É ÓÔÒÁÔÅÇÉÀ ÒÅÁÌÉÚÁÃÉÉ VPN ÄÌÑ ÜÔÏÇÏ ÓÃÅÎÁÒÉÑ.</para>
    </sect2>

    <sect2>
      <title>óÃÅÎÁÒÉÊ: ä×Å ÓÅÔÉ, ÐÏÄËÌÀÞÅÎÎÙÈ Ë ÉÎÔÅÒÎÅÔ, ÒÁÂÏÔÁÀÝÉÅ ËÁË
	ÏÄÎÁ</title>

      <indexterm>
	<primary>VPN</primary>

	<secondary>ÓÏÚÄÁÎÉÅ</secondary>
      </indexterm>

      <para>éÓÈÏÄÎÙÅ ÕÓÌÏ×ÉÑ ÔÁËÏ×Ù:</para>

      <itemizedlist>
	<listitem>
	  <para>óÕÝÅÓÔ×ÕÅÔ ËÁË ÍÉÎÉÍÕÍ Ä×Å ÓÅÔÉ</para>
	</listitem>
	<listitem>
	  <para>÷ÎÕÔÒÉ ÏÂÅÉÈ ÓÅÔÅÊ ÉÓÐÏÌØÚÕÅÔÓÑ IP</para>
	</listitem>
	<listitem>
	  <para>ïÂÅ ÓÅÔÉ ÓÏÅÄÉÎÅÎÙ ÞÅÒÅÚ ÉÎÔÅÒÎÅÔ ÞÅÒÅÚ ÛÌÀÚ,
	    ÒÁÂÏÔÁÀÝÉÊ ÎÁ FreeBSD.</para>
	</listitem>
	<listitem>
	  <para>õ ÛÌÀÚÁ ËÁÖÄÏÊ ÉÚ ÓÅÔÅÊ ÅÓÔØ ËÁË ÍÉÎÉÍÕÍ ÏÄÉÎ ÐÕÂÌÉÞÎÙÊ
	    IP ÁÄÒÅÓ.</para>
	</listitem>
	<listitem>
	  <para>÷ÎÕÔÒÅÎÎÉÅ IP ÁÄÒÅÓÁ Ä×ÕÈ ÓÅÔÅÊ ÍÏÇÕÔ ÂÙÔØ ÐÕÂÌÉÞÎÙÍÉ ÉÌÉ
	    ÐÒÉ×ÁÔÎÙÍÉ, ÎÅ ÉÍÅÅÔ ÚÎÁÞÅÎÉÑ.  îÁ ÛÌÀÚÅ ÍÏÖÅÔ ÒÁÂÏÔÁÔØ
	    NAT, ÅÓÌÉ ÜÔÏ ÎÅÏÂÈÏÄÉÍÏ.</para>
	</listitem>
	<listitem>
	  <para>÷ÎÕÔÒÅÎÎÉÅ IP ÁÄÒÅÓÁ Ä×ÕÈ ÓÅÔÅÊ <emphasis>ÎÅ ÄÏÌÖÎÙ
	    ÐÅÒÅÓÅËÁÔØÓÑ</emphasis>.  èÏÔÑ ×ÅÒÏÑÔÎÏ ÔÅÏÒÅÔÉÞÅÓËÉ ×ÏÚÍÏÖÎÏ
	    ÉÓÐÏÌØÚÏ×ÁÎÉÅ ËÏÍÂÉÎÁÃÉÉ VPN ÔÅÈÎÏÌÏÇÉÉ É NAT ÄÌÑ ÎÁÓÔÒÏÊËÉ
	    ÔÁËÏÊ ËÏÎÆÉÇÕÒÁÃÉÉ, ÜÔÁ ËÏÎÆÉÇÕÒÁÃÉÑ ÂÕÄÅÔ ËÏÛÍÁÒÎÁ.</para>
	</listitem>
      </itemizedlist>

      <para>åÓÌÉ Ä×Å ÓÅÔÉ, ËÏÔÏÒÙÅ ×Ù ÐÙÔÁÅÔÅÓØ ÓÏÅÄÉÎÉÔØ, ÉÓÐÏÌØÚÕÀÔ ÏÄÉÎ
	É ÔÏÔ ÖÅ ÄÉÁÐÁÚÏÎ ÐÒÉ×ÁÔÎÙÈ ÁÄÒÅÓÏ× (ÎÁÐÒÉÍÅÒ, ÏÂÅ ÉÓÐÏÌØÚÕÀÔ
	<hostid role="ipaddr">192.168.1.x</hostid>), ÎÏÍÅÒÁ × ÏÄÎÏÊ ÉÚ
	ÓÅÔÅÊ ÎÅÏÂÈÏÄÉÍÏ ÉÚÍÅÎÉÔØ.</para>

      <para>ôÏÐÏÌÏÇÉÑ ÓÅÔÉ ÍÏÖÅÔ ×ÙÇÌÑÄÅÔØ ÐÒÉÍÅÒÎÏ ÔÁË:</para>

      <mediaobject>
	<imageobject>
	  <imagedata fileref="security/ipsec-network" align="center">
	</imageobject>

	<textobject>
<literallayout class="monospaced">óÅÔØ #1               [ ÷ÎÕÔÒÅÎÎÉÅ ÈÏÓÔÙ ]    ðÒÉ×ÁÔÎÁÑ ÓÅÔØ, 192.168.1.2-254
	              [    Win9x/NT/2K   ]
	              [       UNIX       ]
	                       |
	                       |
	                .---[fxp1]---.        ðÒÉ×ÁÔÎÙÊ IP, 192.168.1.1
	                |   FreeBSD  |
	                `---[fxp0]---'        ðÕÂÌÉÞÎÙÊ IP, A.B.C.D
	                       |
	                       |
	              -=-=- éÎÔÅÒÎÅÔ -=-=-
	                       |
	                       |
	                .---[fxp0]---.        ðÕÂÌÉÞÎÙÊ IP, W.X.Y.Z
	                |   FreeBSD  |
	                `---[fxp1]---'        ðÒÉ×ÁÔÎÙÊ IP, 192.168.2.1
	                       |
	                       |
óÅÔØ #2               [ ÷ÎÕÔÒÅÎÎÉÅ ÈÏÓÔÙ ]
	              [    Win9x/NT/2K   ]    ðÒÉ×ÁÔÎÁÑ ÓÅÔØ, 192.168.2.2-254
	              [       UNIX       ]</literallayout>
	</textobject>
      </mediaobject>

      <para>úÁÍÅÔØÔÅ, ÞÔÏ ÚÄÅÓØ ÐÒÉÓÕÔÓÔ×ÕÀÔ Ä×Á ÐÕÂÌÉÞÎÙÈ IP-ÁÄÒÅÓÁ.  ÷
	ÄÁÌØÎÅÊÛÅÍ ÄÌÑ ÉÈ ÏÂÏÚÎÁÞÅÎÉÑ
	ÂÕÄÕÔ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ ÂÕË×Ù.  åÓÌÉ ×Ù Õ×ÉÄÉÔÅ ÜÔÉ ÂÕË×Ù, ÚÁÍÅÎÉÔÅ
	ÉÈ ÎÁ Ó×ÏÉ ÐÕÂÌÉÞÎÙÅ IP ÁÄÒÅÓÁ.  ôÁËÖÅ ÏÂÒÁÔÉÔÅ ×ÎÉÍÁÎÉÅ, ÞÔÏ
	Õ ÏÂÅÉÈ ÛÌÀÚÏ× ×ÎÕÔÒÅÎÎÉÊ ÁÄÒÅÓ ÚÁËÁÎÞÉ×ÁÅÔÓÑ ÎÁ .1 É ÄÉÁÐÁÚÏÎÙ
	ÐÒÉ×ÁÔÎÙÈ ÁÄÒÅÓÏ× Ä×ÕÈ ÓÅÔÅÊ ÒÁÚÌÉÞÎÙ (<hostid
	role="ipaddr">192.168.1.x</hostid> É <hostid
	role="ipaddr">192.168.2.x</hostid> ÓÏÏÔ×ÅÔÓÔ×ÅÎÎÏ).  ÷ÓÅ ËÏÍÐØÀÔÅÒÙ
	ÌÏËÁÌØÎÙÈ ÓÅÔÅÊ ÎÁÓÔÒÏÅÎÙ ÎÁ ÉÓÐÏÌØÚÏ×ÁÎÉÅ × ËÁÞÅÓÔ×Å ÛÌÀÚÁ ÐÏ
	ÕÍÏÌÞÁÎÉÀ ËÏÍÐØÀÔÅÒÁ Ó ÁÄÒÅÓÏÍ, ÏËÁÎÞÉ×ÁÀÝÉÍÓÑ ÎÁ
	<hostid role="ipaddr">.1</hostid>.</para>

      <para>ó ÓÅÔÅ×ÏÊ ÔÏÞËÉ ÚÒÅÎÉÑ ÚÁÍÙÓÅÌ × ÔÏÍ, ÞÔÏÂÙ ËÁÖÄÁÑ ÓÅÔØ
	×ÉÄÅÌÁ ËÏÍÐØÀÔÅÒÙ ÉÚ ÄÒÕÇÏÊ ÓÅÔÉ ÔÁË, ËÁË ÅÓÌÉ ÂÙ ÏÎÉ ÂÙÌÉ
	ÎÅÐÏÓÒÅÄÓÔ×ÅÎÎÏ ÐÏÄËÌÀÞÅÎÙ Ë ÔÏÍÕ ÖÅ ÓÁÍÏÍÕ ÍÁÒÛÒÕÔÉÚÁÔÏÒÕ &mdash;
	ÈÏÔÑ É ÎÅÍÎÏÇÏ ÍÅÄÌÅÎÎÏÍÕ ÍÁÒÛÒÕÔÉÚÁÔÏÒÕ, ÉÎÏÇÄÁ ÔÅÒÑÀÝÅÍÕ
	ÐÁËÅÔÙ.</para>

      <para>üÔÏ ÏÚÎÁÞÁÅÔ, ÞÔÏ (ÎÁÐÒÉÍÅÒ) ËÏÍÐØÀÔÅÒ <hostid
	role="ipaddr">192.168.1.20</hostid> ÍÏÖÅÔ ÚÁÐÕÓÔÉÔØ</para>

      <programlisting>ping 192.168.2.34</programlisting>

      <para>É ÜÔÏ ÂÕÄÅÔ ÐÒÏÚÒÁÞÎÏ ÒÁÂÏÔÁÔØ.  ëÏÍÐØÀÔÅÒÙ Ó &windows;
	ÄÏÌÖÎÙ ×ÉÄÅÔØ ËÏÍÐØÀÔÅÒÙ × ÄÒÕÇÏÊ ÓÅÔÉ, ÐÒÏÓÍÁÔÒÉ×ÁÔØ ÓÅÔÅ×ÙÅ
	ÒÅÓÕÒÓÙ, É ÔÁË ÄÁÌÅÅ, ÔÏÞÎÏ ÔÁË ÖÅ, ËÁË É ÄÌÑ ËÏÍÐØÀÔÅÒÏ× ×
	ÌÏËÁÌØÎÏÊ ÓÅÔÉ.</para>

      <para>é ×ÓÅ ÜÔÏ ÂÅÚÏÐÁÓÎÙÍ ÓÐÏÓÏÂÏÍ.  üÔÏ ÏÚÎÁÞÁÅÔ, ÞÔÏ ÔÒÁÆÉË
	ÍÅÖÄÕ ÓÅÔÑÍÉ ÚÁÛÉÆÒÏ×ÁÎ.</para>

      <para>óÏÚÄÁÎÉÅ VPN ÍÅÖÄÕ ÜÔÉÍÉ Ä×ÕÍÑ ÓÅÔÑÍÉ ÜÔÏ ÍÎÏÇÏÛÁÇÏ×ÙÊ
	ÐÒÏÃÅÓÓ.  üÔÁÐÙ ÓÏÚÄÁÎÉÑ VPN ÔÁËÏ×Ù:</para>

      <orderedlist>
	<listitem>
	  <para>óÏÚÄÁÎÉÅ <quote>×ÉÒÔÕÁÌØÎÏÇÏ</quote> ÓÅÔÅ×ÏÇÏ ÐÏÄËÌÀÞÅÎÉÑ
	    ÍÅÖÄÕ Ä×ÕÍÑ ÓÅÔÑÍÉ ÞÅÒÅÚ ÉÎÔÅÒÎÅÔ.  ôÅÓÔÉÒÏ×ÁÎÉÅ ÐÏÄËÌÀÞÅÎÉÑ Ó
	    ÐÏÍÏÝØÀ ÔÁËÉÈ ÉÎÓÔÒÕÍÅÎÔÏ× ËÁË &man.ping.8;, ÞÔÏÂÙ ÕÂÅÄÉÔØÓÑ, ÞÔÏ
	    ÏÎÏ ÒÁÂÏÔÁÅÔ.</para>
	</listitem>

	<listitem>
	  <para>ðÒÉÍÅÎÅÎÉÅ ÐÏÌÉÔÉËÉ ÂÅÚÏÐÁÓÎÏÓÔÉ ÞÔÏÂÙ ÕÂÅÄÉÔØÓÑ, ÞÔÏ ÔÒÁÆÉË
	    ÍÅÖÄÕ Ä×ÕÍÑ ÓÅÔÑÍÉ ÐÒÏÚÒÁÞÎÏ ÛÉÆÒÕÅÔÓÑ É ÒÁÓÛÉÆÒÏ×Ù×ÁÅÔÓÑ ÅÓÌÉ
	    ÎÅÏÂÈÏÄÉÍÏ.  ôÅÓÔÉÒÏ×ÁÎÉÅ Ó ÐÏÍÏÝØÀ ÔÁËÉÈ ÉÎÓÔÒÕÍÅÎÔÏ× ËÁË
	    &man.tcpdump.1;, ÞÔÏÂÙ ÕÂÅÄÉÔØÓÑ, ÞÔÏ ÔÒÁÆÉË ÛÉÆÒÕÅÔÓÑ.</para>
	</listitem>

	<listitem>
	  <para>îÁÓÔÒÏÊËÁ ÄÏÐÏÌÎÉÔÅÌØÎÙÈ ÐÒÏÇÒÁÍÍ ÎÁ ÛÌÀÚÁÈ &os;,
	    ÞÔÏÂÙ ËÏÍÐØÀÔÅÒÙ &windows; ÉÚ ÏÄÎÏÊ ÓÅÔÉ ×ÉÄÅÌÉ ËÏÍÐØÀÔÅÒÙ
	    × ÄÒÕÇÏÊ ÞÅÒÅÚ VPN.</para>
	</listitem>
      </orderedlist>

    <sect3>
      <title>ûÁÇ 1: óÏÚÄÁÎÉÅ É ÔÅÓÔÉÒÏ×ÁÎÉÅ <quote>×ÉÒÔÕÁÌØÎÏÇÏ</quote>
	ÓÅÔÅ×ÏÇÏ ÐÏÄËÌÀÞÅÎÉÑ</title>

      <para>ðÒÅÄÐÏÌÏÖÉÍ, ÞÔÏ ×Ù ÒÁÂÏÔÁÅÔÅ ÎÁ ÛÌÀÚÅ ÓÅÔÉ #1 (Ó ÐÕÂÌÉÞÎÙÍ
	ÁÄÒÅÓÏÍ <hostid role="ipaddr">A.B.C.D</hostid>, ÐÒÉ×ÁÔÎÙÍ
	ÁÄÒÅÓÏÍ <hostid role="ipaddr">192.168.1.1</hostid>) É ÚÁÐÕÓËÁÅÔÅ
	<command>ping 192.168.2.1</command>, Ô.Å. ÎÁ ÐÒÉ×ÁÔÎÙÊ ÁÄÒÅÓ
	ÍÁÛÉÎÙ Ó IP ÁÄÒÅÓÏÍ <hostid role="ipaddr">W.X.Y.Z</hostid>.
	þÔÏ ÄÏÌÖÎÏ ÐÒÏÉÚÏÊÔÉ, ÞÔÏÂÙ ÜÔÏ ÓÒÁÂÏÔÁÌÏ?</para>

      <orderedlist>
	<listitem>
	  <para>ûÌÀÚ ÄÏÌÖÅÎ ÚÎÁÔØ, ËÁË ÄÏÓÔÉÞØ <hostid
	    role="ipaddr">192.168.2.1</hostid>.  äÒÕÇÉÍÉ ÓÌÏ×ÁÍÉ, Õ ÎÅÇÏ
	    ÄÏÌÖÅÎ ÂÙÔØ ÍÁÒÛÒÕÔ Ë <hostid
	    role="ipaddr">192.168.2.1</hostid>.</para>
	</listitem>
	<listitem>
	  <para>ðÒÉ×ÁÔÎÙÅ IP ÁÄÒÅÓÁ, ÔÁËÉÅ ËÁË ÄÉÁÐÁÚÏÎ <hostid
	    role="ipaddr">192.168.x</hostid> ÎÅ ÁÄÒÅÓÕÀÔÓÑ ×
	    ÉÎÔÅÒÎÅÔ.  ëÁÖÄÙÊ ÐÁËÅÔ, ÏÔÐÒÁ×ÌÑÅÍÙÊ ÎÁ
	    <hostid role="ipaddr">192.168.2.1</hostid> ÄÏÌÖÅÎ ÂÙÔØ
	    <quote>ÚÁ×ÅÒÎÕÔ</quote> × ÄÒÕÇÏÊ ÐÁËÅÔ.  éÓÈÏÄÎÙÍ ÁÄÒÅÓÏÍ ÐÁËÅÔÁ
	    ÄÏÌÖÅÎ ÂÙÔØ <hostid role="ipaddr">A.B.C.D</hostid>,
	    Á ÁÄÒÅÓÏÍ ÎÁÚÎÁÞÅÎÉÑ <hostid role="ipaddr">W.X.Y.Z</hostid>.
	    üÔÏÔ ÐÒÏÃÅÓÓ ÎÁÚÙ×ÁÅÔÓÑ
	    <firstterm>ÉÎËÁÐÓÕÌÑÃÉÅÊ</firstterm>.</para>
	</listitem>
	<listitem>
	  <para>ëÁË ÔÏÌØËÏ ÜÔÏÔ ÐÁËÅÔ ÄÏÓÔÉÇÎÅÔ <hostid
	    role="ipaddr">W.X.Y.Z</hostid>, ÎÅÏÂÈÏÄÉÍÏ ÂÕÄÅÔ
	    <quote>ÄÅËÁÐÓÕÌÉÒÏ×ÁÔØ</quote> ÅÇÏ É ÄÏÓÔÁ×ÉÔØ Ë <hostid
	    role="ipaddr">192.168.2.1</hostid>.</para>
	</listitem>
      </orderedlist>

      <para>ëÁË ×Ù ÍÏÖÅÔÅ Õ×ÉÄÅÔØ, ÜÔÏ ÔÒÅÂÕÅÔ <quote>ÔÕÎÎÅÌÑ</quote>
	ÍÅÖÄÕ Ä×ÕÍÑ ÓÅÔÑÍÉ.  ä×Á ËÏÎÃÁ <quote>ÔÕÎÎÅÌÑ</quote>
	ÜÔÏ IP ÁÄÒÅÓÁ <hostid role="ipaddr">A.B.C.D</hostid> É
	<hostid role="ipaddr">W.X.Y.Z</hostid>.  ôÕÎÎÅÌØ ÉÓÐÏÌØÚÕÅÔÓÑ ÄÌÑ
	ÐÅÒÅÄÁÞÉ ÔÒÁÆÉËÁ Ó ÐÒÉ×ÁÔÎÙÍÉ IP ÁÄÒÅÓÁÍÉ ÞÅÒÅÚ ÉÎÔÅÒÎÅÔ.</para>

      <para>÷ FreeBSD ÜÔÏÔ ÔÕÎÎÅÌØ ÓÏÚÄÁÅÔÓÑ Ó ÐÏÍÏÝØÀ ÕÓÔÒÏÊÓÔ×Á generic
	interface, ÉÌÉ <devicename>gif</devicename>.  ëÁË ×Ù ÍÏÖÅÔÅ
	ÄÏÇÁÄÁÔØÓÑ, ÉÎÔÅÒÆÅÊÓ <devicename>gif</devicename> ÎÁ ËÁÖÄÏÍ ÈÏÓÔÅ
	ÄÏÌÖÅÎ ÂÙÔØ ÎÁÓÔÒÏÅÎ Ó ÞÅÔÙÒØÍÑ IP ÁÄÒÅÓÁÍÉ; Ä×Á ÄÌÑ ÐÕÂÌÉÞÎÙÈ
	IP ÁÄÒÅÓÏ× É Ä×Á ÄÌÑ ÐÒÉ×ÁÔÎÙÈ IP ÁÄÒÅÓÏ×.</para>

      <para>÷ ÑÄÒÏ ÏÂÅÉÈ ËÏÍÐØÀÔÅÒÏ× FreeBSD ÄÏÌÖÎÁ ÂÙÔØ ×ÓÔÒÏÅÎÁ
	ÐÏÄÄÅÒÖËÁ ÕÓÔÒÏÊÓÔ×Á gif.  ÷Ù ÍÏÖÅÔÅ ÓÄÅÌÁÔØ ÜÔÏ, ÄÏÂÁ×É×
	ÓÔÒÏËÕ:</para>

      <programlisting>device gif</programlisting>

      <para>Ë ÆÁÊÌÕ ÎÁÓÔÒÏÊËÉ ÑÄÒÁ ÎÁ ÏÂÅÉÈ ËÏÍÐØÀÔÅÒÁÈ, Ó ÐÏÓÌÅÄÕÀÝÅÊ
	ËÏÍÐÉÌÑÃÉÅÊ, ÕÓÔÁÎÏ×ËÏÊ É ÐÅÒÅÚÁÇÒÕÚËÏÊ.</para>

      <para>îÁÓÔÒÏÊËÁ ÔÕÎÎÅÌÑ ÜÔÏ Ä×ÕÈÛÁÇÏ×ÙÊ ÐÒÏÃÅÓÓ.  ÷Ï-ÐÅÒ×ÙÈ,
	ÎÅÏÂÈÏÄÉÍÏ ÚÁÄÁÔØ Ó×ÅÄÅÎÉÑ Ï ×ÎÅÛÎÅÍ (ÉÌÉ ÐÕÂÌÉÞÎÏÍ) IP ÁÄÒÅÓÅ
	Ó ÐÏÍÏÝØÀ &man.ifconfig.8;.  úÁÔÅÍ Ï ÐÒÉ×ÁÔÎÏÍ IP ÁÄÒÅÓÅ, ÔÁËÖÅ
	Ó ÐÏÍÏÝØÀ &man.ifconfig.8;.</para>

      <para>îÁ ÛÌÀÚÅ ÓÅÔÉ #1 ÄÌÑ ÎÁÓÔÒÏÊËÉ ÔÕÎÎÅÌÑ ×ÁÍ ÐÏÔÒÅÂÕÅÔÓÑ ÚÁÐÕÓÔÉÔØ
	ÓÌÅÄÕÀÝÉÅ Ä×Å ËÏÍÁÎÄÙ.</para>

      <programlisting>ifconfig gif0 A.B.C.D W.X.Y.Z
ifconfig gif0 inet 192.168.1.1 192.168.2.1 netmask 0xffffffff
      </programlisting>

      <para>îÁ ÄÒÕÇÏÍ ÛÌÀÚÅ ÐÏÄÏÂÎÙÅ ËÏÍÁÎÄÙ, ÎÏ Ó IP ÁÄÒÅÓÁÍÉ × ÏÂÒÁÔÎÏÍ
	ÐÏÒÑÄËÅ.</para>

      <programlisting>ifconfig gif0 W.X.Y.Z A.B.C.D
ifconfig gif0 inet 192.168.2.1 192.168.1.1 netmask 0xffffffff
      </programlisting>

      <para>úÁÔÅÍ ×Ù ÍÏÖÅÔÅ ÚÁÐÕÓÔÉÔØ:</para>

      <programlisting>ifconfig gif0</programlisting>

      <para>ÄÌÑ ÐÒÏÓÍÏÔÒÁ ÎÁÓÔÒÏÊËÉ.  îÁÐÒÉÍÅÒ, ÎÁ ÛÌÀÚÅ ÓÅÔÉ #1
	×Ù Õ×ÉÄÉÔÅ:</para>

      <screen>&prompt.root; <userinput>ifconfig gif0</userinput>
gif0: flags=8011&lt;UP,POINTTOPOINT,MULTICAST&gt; mtu 1280
inet 192.168.1.1 --&gt; 192.168.2.1 netmask 0xffffffff
physical address inet A.B.C.D --&gt; W.X.Y.Z
      </screen>

      <para>ëÁË ×Ù ÍÏÖÅÔÅ ×ÉÄÅÔØ, ÂÙÌ ÓÏÚÄÁÎ ÔÕÎÎÅÌØ ÍÅÖÄÕ ÆÉÚÉÞÅÓËÉÍÉ
	ÁÄÒÅÓÁÍÉ <hostid role="ipaddr">A.B.C.D</hostid> É
	<hostid role="ipaddr">W.X.Y.Z</hostid>, ÄÌÑ ÔÕÎÎÅÌÉÒÏ×ÁÎÉÑ ÒÁÚÒÅÛÅÎ
	ÔÒÁÆÉË ÍÅÖÄÕ <hostid
	role="ipaddr">192.168.1.1</hostid> É <hostid
	role="ipaddr">192.168.2.1</hostid>.</para>

      <para>üÔÏ ÔÁËÖÅ ÄÏÂÁ×ÌÑÅÔ ÚÁÐÉÓØ Ë ÔÁÂÌÉÃÅ ÍÁÒÛÒÕÔÉÚÁÃÉÉ ÎÁ ÏÂÅÉÈ
	ÍÁÛÉÎÁÈ, ×Ù ÍÏÖÅÔÅ ÐÒÏ×ÅÒÉÔØ ÚÁÐÉÓØ ËÏÍÁÎÄÏÊ <command>netstat
	-rn</command>.  ÷ÏÔ ×Ù×ÏÄ ÜÔÏÊ ËÏÍÁÎÄÙ ÎÁ ÛÌÀÚÅ ÓÅÔÉ #1.</para>

      <screen>&prompt.root; <userinput>netstat -rn</userinput>
Routing tables

Internet:
Destination      Gateway       Flags    Refs    Use    Netif  Expire
...
192.168.2.1      192.168.1.1   UH        0        0    gif0
...
      </screen>

      <para>ëÁË ÐÏËÁÚÙ×ÁÅÔ ÚÎÁÞÅÎÉÅ ÐÏÌÑ <quote>Flags</quote>, ÜÔÏ ÍÁÒÛÒÕÔ
	Ë ÈÏÓÔÕ, ÞÔÏ ÏÚÎÁÞÁÅÔ, ÞÔÏ ËÁÖÄÙÊ ÛÌÀÚ ÚÎÁÅÔ, ËÁË ÄÏÓÔÉÞØ ÄÒÕÇÏÇÏ
	ÛÌÀÚÁ, ÎÏ ÎÅ ÚÎÁÅÔ ËÁË ÄÏÓÔÉÞØ ÏÓÔÁÌØÎÏÊ ÞÁÓÔÉ ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÅÊ ÓÅÔÉ.
	üÔÁ ÐÒÏÂÌÅÍÁ ÂÕÄÅÔ ÂÙÓÔÒÏ ÒÅÛÅÎÁ.</para>

      <para>÷ÅÒÏÑÔÎÏ, ÎÁ ÏÂÅÉÈ ÍÁÛÉÎÁÈ ÚÁÐÕÝÅÎ ÂÒÁÎÄÍÁÕÜÒ.  VPN
	ÄÏÌÖÅÎ ÏÂÈÏÄÉÔØ ÅÇÏ.  ÷Ù ÍÏÖÅÔÅ ÒÁÚÒÅÛÉÔØ ×ÅÓØ ÔÒÁÆÉË ÍÅÖÄÕ
	Ä×ÕÍÑ ÓÅÔÑÍÉ, ÉÌÉ ×ËÌÀÞÉÔØ ÐÒÁ×ÉÌÁ, ÚÁÝÉÝÁÀÝÉÅ ËÁÖÄÙÊ ËÏÎÅÃ
	ÓÏÅÄÉÎÅÎÉÑ ÏÔ ÄÒÕÇÏÇÏ.</para>

      <para>üÔÏ ÓÉÌØÎÏ ÕÐÒÏÝÁÅÔ ÔÅÓÔÉÒÏ×ÁÎÉÅ ÎÁÓÔÒÏÊËÉ ÂÒÁÎÄÍÁÕÜÒÁ,
	ÅÓÌÉ ×Ù ÒÁÚÒÅÛÁÅÔÅ ×ÅÓØ ÔÒÁÆÉË ÞÅÒÅÚ VPN.  ÷Ù ×ÓÅÇÄÁ ÍÏÖÅÔÅ
	÷Ù ×ÓÅÇÄÁ ÍÏÖÅÔÅ ÕÓÉÌÉÔØ ÚÁÝÉÔÕ ÐÏÚÖÅ.  åÓÌÉ ×Ù ÉÓÐÏÌØÚÕÅÔÅ
	ÎÁ ÛÌÀÚÁÈ &man.ipfw.8;, ËÏÍÁÎÄÁ ×ÒÏÄÅ ÜÔÏÊ</para>

      <programlisting>ipfw add 1 allow ip from any to any via gif0</programlisting>

      <para>ÒÁÚÒÅÛÉÔ ×ÅÓØ ÔÒÁÆÉË ÍÅÖÄÕ Ä×ÕÍÑ ËÏÎÃÁÍÉ VPN ÂÅÚ ×ÌÉÑÎÉÑ ÎÁ
	ÄÒÕÇÉÅ ÐÒÁ×ÉÌÁ ÂÒÁÎÄÍÁÕÜÒÁ.  ïÞÅ×ÉÄÎÏ, ×ÁÍ ÐÏÔÒÅÂÕÅÔÓÑ
	ÚÁÐÕÓÔÉÔØ ÜÔÕ ËÏÍÁÎÄÕ ÎÁ ÏÂÅÉÈ ÛÌÀÚÁÈ.</para>

      <para>üÔÏÇÏ ÄÏÓÔÁÔÏÞÎÏ ÄÌÑ ×ËÌÀÞÅÎÉÑ ping Ó ÏÄÎÏÇÏ ÛÌÀÚÁ ÎÁ ÄÒÕÇÏÊ.
	îÁ <hostid role="ipaddr">192.168.1.1</hostid>, ×Ù ÓÍÏÖÅÔÅ
	ÚÁÐÕÓÔÉÔØ</para>

      <programlisting>ping 192.168.2.1</programlisting>

      <para>É ÐÏÌÕÞÉÔØ ÏÔ×ÅÔ, É ÁÎÁÌÏÇÉÞÎÏ ÎÁ ÄÒÕÇÏÍ ÛÌÀÚÅ.</para>

      <para>ïÄÎÁËÏ, ÍÁÛÉÎÙ × ÄÒÕÇÏÊ ÓÅÔÉ ÐÏËÁ ÎÅÄÏÓÔÕÐÎÙ.  üÔÏ ÉÚ-ÚÁ
	ÍÁÒÛÒÕÔÉÚÁÃÉÉ &mdash; ÈÏÔÑ ÛÌÀÚÙ ÚÎÁÀÔ, ËÁË Ó×ÑÚÁÔØÓÑ ÄÒÕÇ Ó
	ÄÒÕÇÏÍ, ÏÎÉ ÎÅ ÚÎÁÀÔ, ËÁË Ó×ÑÚÁÔØÓÑ Ó ÓÅÔØÀ ÚÁ ÄÒÕÇÉÍ ÛÌÀÚÏÍ.</para>

      <para>äÌÑ ÒÅÛÅÎÉÑ ÜÔÏÊ ÐÒÏÂÌÅÍÙ ×Ù ÄÏÌÖÎÙ ÄÏÂÁ×ÉÔØ ÓÔÁÔÉÞÅÓËÉÊ ÍÁÒÛÒÕÔ
	ÎÁ ËÁÖÄÏÍ ÛÌÀÚÅ.  ëÏÍÁÎÄÁ ÎÁ ÐÅÒ×ÏÍ ÛÌÀÚÅ ÂÕÄÅÔ ×ÙÇÌÑÄÅÔØ ÔÁË:</para>

      <programlisting>route add 192.168.2.0 192.168.2.1 netmask 0xffffff00
      </programlisting>

      <para>ïÎÁ ÇÏ×ÏÒÉÔ <quote>äÌÑ ÄÏÓÔÉÖÅÎÉÑ ÈÏÓÔÏ× × ÓÅÔÉ
	<hostid role="ipaddr">192.168.2.0</hostid>, ÏÔÐÒÁ×ÌÑÊÔÅ ÐÁËÅÔÙ
	ÈÏÓÔÕ <hostid role="ipaddr">192.168.2.1</hostid></quote>.  ÷ÁÍ
	ÐÏÔÒÅÂÕÅÔÓÑ ÚÁÐÕÓÔÉÔØ ÐÏÈÏÖÕÀ ËÏÍÁÎÄÕ ÎÁ ÄÒÕÇÏÍ ÛÌÀÚÅ, ÎÏ Ó
	ÁÄÒÅÓÁÍÉ <hostid role="ipaddr">192.168.1.x</hostid>.</para>

      <para>IP ÔÒÁÆÉË Ó ÈÏÓÔÏ× × ÏÄÎÏÊ ÓÅÔÉ ÔÅÐÅÒØ ÍÏÖÅÔ ÄÏÓÔÉÞØ ÈÏÓÔÙ ×
	ÄÒÕÇÏÊ ÓÅÔÉ.</para>

      <para>ôÅÐÅÒØ ÓÏÚÄÁÎÏ Ä×Å ÔÒÅÔÉ VPN ÍÅÖÄÕ Ä×ÕÍÑ ÓÅÔÑÍÉ, ÐÏÓËÏÌØËÕ
	ÜÔÏ <quote>×ÉÒÔÕÁÌØÎÁÑ (virtual)</quote> <quote>ÓÅÔØ (network)</quote>.
	ïÎÁ ÅÝÅ ÎÅ ÐÒÉ×ÁÔÎÁÑ (private).  ÷Ù ÍÏÖÅÔÅ ÐÒÏÔÅÓÔÉÒÏ×ÁÔØ ÅÅ
	Ó ÐÏÍÏÝØÀ &man.ping.8; É &man.tcpdump.1;.  ÷ÏÊÄÉÔÅ ÎÁ ÛÌÀÚ É
	ÚÁÐÕÓÔÉÔÅ</para>

      <programlisting>tcpdump dst host 192.168.2.1</programlisting>

      <para>÷ ÄÒÕÇÏÊ ÓÅÓÓÉÉ ÎÁ ÜÔÏÍ ÖÅ ÈÏÓÔÅ ÚÁÐÕÓÔÉÔÅ</para>

      <programlisting>ping 192.168.2.1</programlisting>

      <para>÷Ù Õ×ÉÄÉÔÅ ÐÒÉÍÅÒÎÏ ÔÁËÉÅ ÓÔÒÏËÉ:</para>

      <programlisting>
16:10:24.018080 192.168.1.1 &gt; 192.168.2.1: icmp: echo request
16:10:24.018109 192.168.1.1 &gt; 192.168.2.1: icmp: echo reply
16:10:25.018814 192.168.1.1 &gt; 192.168.2.1: icmp: echo request
16:10:25.018847 192.168.1.1 &gt; 192.168.2.1: icmp: echo reply
16:10:26.028896 192.168.1.1 &gt; 192.168.2.1: icmp: echo request
16:10:26.029112 192.168.1.1 &gt; 192.168.2.1: icmp: echo reply
      </programlisting>

      <para>ëÁË ×Ù ×ÉÄÉÔÅ, ICMP ÓÏÏÂÝÅÎÉÑ ÐÅÒÅÓÙÌÁÀÔÓÑ ×ÐÅÒÅÄ É ÎÁÚÁÄ
	ÎÅÚÁÛÉÆÒÏ×ÁÎÎÙÍÉ.  åÓÌÉ ×Ù ÉÓÐÏÌØÚÏ×ÁÌÉ Ó &man.tcpdump.1; ÐÁÒÁÍÅÔÒ
	<option>-s</option> ÄÌÑ ÐÏÌÕÞÅÎÉÑ ÂÏÌØÛÅÇÏ ÏÂßÅÍÁ ÄÁÎÎÙÈ ÐÁËÅÔÁ,
	ÔÏ Õ×ÉÄÉÔÅ ÂÏÌØÛÅ ÉÎÆÏÒÍÁÃÉÉ.</para>

      <para>ëÏÎÅÞÎÏ ÖÅ ÜÔÏ ÎÅÐÒÉÅÍÌÅÍÏ.  ÷ ÓÌÅÄÕÀÝÅÍ ÒÁÚÄÅÌÅ ÍÙ ÏÂÓÕÄÉÍ
	ÚÁÝÉÔÕ ÓÏÅÄÉÎÅÎÉÑ ÍÅÖÄÕ Ä×ÕÍÑ ÓÅÔÑÍÉ, ÔÁË ÞÔÏ ×ÅÓØ ÔÒÁÆÉË ÂÕÄÅÔ
	Á×ÔÏÍÁÔÉÞÅÓËÉ ÛÉÆÒÏ×ÁÔØÓÑ.</para>

      <itemizedlist>
	<title>òÅÚÀÍÅ:</title>
	<listitem>
	  <para>îÁÓÔÒÏÊÔÅ ÏÂÁ ÑÄÒÁ Ó <quote>device gif</quote>.</para>
	</listitem>
	<listitem>
	  <para>ïÔÒÅÄÁËÔÉÒÕÊÔÅ <filename>/etc/rc.conf</filename> ÎÁ ÛÌÀÚÅ
	    #1 É ÄÏÂÁ×ØÔÅ ÓÌÅÄÕÀÝÉÅ ÓÔÒÏËÉ (ÐÏÄÓÔÁ×ÌÑÑ IP ÁÄÒÅÓÁ ÇÄÅ
	    ÎÅÏÂÈÏÄÉÍÏ).</para>
	  <programlisting>gifconfig_gif0="A.B.C.D W.X.Y.Z"
ifconfig_gif0="inet 192.168.1.1 192.168.2.1 netmask 0xffffffff"
static_routes="vpn"
route_vpn="192.168.2.0 192.168.2.1 netmask 0xffffff00"
	  </programlisting>
	</listitem>

	<listitem>
	  <para>ïÔÒÅÄÁËÔÉÒÕÊÔÅ ÓËÒÉÐÔ ÂÒÁÎÄÍÁÕÜÒÁ
	  (<filename>/etc/rc.firewall</filename>, ÉÌÉ ÐÏÄÏÂÎÙÊ) ÎÁ ÏÂÅÉÈ
	  ÈÏÓÔÁÈ É ÄÏÂÁ×ØÔÅ</para>

	  <programlisting>ipfw add 1 allow ip from any to any via gif0</programlisting>
	</listitem>
	<listitem>
	  <para>÷ÙÐÏÌÎÉÔÅ ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÉÅ ÉÚÍÅÎÅÎÉÑ ×
	    <filename>/etc/rc.conf</filename> ÎÁ ÛÌÀÚÅ #2,
	    ÍÅÎÑÑ ÐÏÒÑÄÏË IP ÁÄÒÅÓÏ×.</para>
	</listitem>
      </itemizedlist>
    </sect3>

    <sect3>
      <title>ûÁÇ 2: úÁÝÉÔÁ ÓÏÅÄÉÎÅÎÉÑ</title>

      <para>äÌÑ ÚÁÝÉÔÙ ÓÏÅÄÉÎÅÎÉÑ ÍÙ ÂÕÄÅÍ ÉÓÐÏÌØÚÏ×ÁÔØ IPsec.  IPsec
	ÐÒÅÄÏÓÔÁ×ÌÑÅÔ ÈÏÓÔÁÍ ÍÅÈÁÎÉÚÍ ÏÐÒÅÄÅÌÅÎÉÑ ËÌÀÞÁ ÄÌÑ ÛÉÆÒÏ×ÁÎÉÑ
	É ÄÌÑ ÐÏÓÌÅÄÕÀÝÅÇÏ ÉÓÐÏÌØÚÏ×ÁÎÉÑ ÜÔÏÇÏ ËÌÀÞÁ ÄÌÑ ÛÉÆÒÏ×ÁÎÉÑ
	ÄÁÎÎÙÈ ÍÅÖÄÕ Ä×ÕÍÑ ÈÏÓÔÁÍÉ.</para>

      <para>úÄÅÓØ ÂÕÄÕÔ ÒÁÓÓÍÏÔÒÅÎÙ Ä×Á ÁÓÐÅËÔÁ ÎÁÓÔÒÏÊËÉ.</para>

      <orderedlist>
	<listitem>
	  <para>õ ÈÏÓÔÏ× ÄÏÌÖÅÎ ÂÙÔØ ÓÐÏÓÏ ÓÏÇÌÁÓÏ×ÁÎÉÑ ÉÓÐÏÌØÚÕÅÍÏÇÏ
	    ÁÌÇÏÒÉÔÍÁ ÛÉÆÒÏ×ÁÎÉÑ.  ëÁË ÔÏÌØËÏ ÈÏÓÔÙ ÄÏÇÏ×ÏÒÑÔÓÑ Ï ÜÔÏÍ,
	    ÍÏÖÎÏ ÇÏ×ÏÒÉÔØ Ï ÕÓÔÁÎÏ×ÌÅÎÎÏÍ ÍÅÖÄÕ ÎÉÍÉ
	    <quote>ÂÅÚÏÐÁÓÎÏÍ ÓÏÅÄÉÎÅÎÉÉ</quote>.</para>
	</listitem>
	<listitem>
	  <para>äÏÌÖÅÎ ÂÙÔØ ÍÅÈÁÎÉÚÍ ÏÐÒÅÄÅÌÅÎÉÑ, ËÁËÏÊ ÔÒÁÆÉË ÎÅÏÂÈÏÄÉÍÏ
	    ÛÉÆÒÏ×ÁÔØ.  ëÏÎÅÞÎÏ, ×ÁÍ ÎÅ ÔÒÅÂÕÅÔÓÑ ÛÉÆÒÏ×ÁÔØ ×ÅÓØ ÉÓÈÏÄÑÝÉÊ
	    ÔÒÁÆÉË &mdash; ÄÏÓÔÁÔÏÞÎÏ ÛÉÆÒÏ×ÁÔØ ÔÏÌØËÏ ÔÒÁÆÉË, ÉÄÕÝÉÊ
	    ÞÅÒÅÚ VPN.  ðÒÁ×ÉÌÁ, ÏÐÒÅÄÅÌÑÀÝÉÅ ÔÏ, ËÁËÏÊ ÔÒÁÆÉË ÎÅÏÂÈÏÄÉÍÏ
	    ÛÉÆÒÏ×ÁÔØ, ÎÁÚÙ×ÁÀÔÓÑ <quote>ÐÏÌÉÔÉËÏÊ ÂÅÚÏÐÁÓÎÏÓÔÉ</quote>.</para>
	</listitem>
      </orderedlist>

      <para>âÅÚÏÐÁÓÎÏÅ ÓÏÅÄÉÎÅÎÉÅ É ÐÏÌÉÔÉËÁ ÂÅÚÏÐÁÓÎÏÓÔÉ ÐÏÄÄÅÒÖÉ×ÁÀÔÓÑ
	ÑÄÒÏÍ, É ÍÏÇÕÔ ÂÙÔØ ÉÚÍÅÎÅÎÙ ÐÒÏÇÒÁÍÍÁÍÉ ÐÏÌØÚÏ×ÁÔÅÌÑ.  ïÄÎÁËÏ
	ÐÅÒÅÄ ÔÅÍ, ËÁË ×Ù ÓÍÏÖÅÔÅ ÓÄÅÌÁÔØ ÜÔÏ, ÎÅÏÂÈÏÄÉÍÏ ÎÁÓÔÒÏÉÔØ
	ÐÏÄÄÅÒÖËÕ ÐÒÏÔÏËÏÌÏ× IPsec É Encapsulated Security Payload (ESP) ×
	ÑÄÒÅ.  üÔÏ ÄÅÌÁÅÔÓÑ ÄÏÂÁ×ÌÅÎÉÅÍ × ÎÁÓÔÒÏÊËÕ ÑÄÒÁ ÐÁÒÁÍÅÔÒÏ×:</para>

      <indexterm>
	<primary>ÐÁÒÁÍÅÔÒÙ ÑÄÒÁ</primary>

	<secondary>IPSEC</secondary>
      </indexterm>

      <programlisting>options IPSEC
options IPSEC_ESP</programlisting>

      <para>Ó ÐÏÓÌÅÄÕÀÝÉÍ ÐÅÒÅËÏÍÐÉÌÉÒÏ×ÁÎÉÅÍ, ÐÅÒÅÕÓÔÁÎÏ×ËÏÊ É
	ÐÅÒÅÚÁÇÒÕÚËÏÊ.  ëÁË É ÐÒÅÖÄÅ ×ÁÍ ÐÏÔÒÅÂÕÅÔÓÑ ÓÄÅÌÁÔØ ÜÔÏ Ó ÑÄÒÁÍÉ ÎÁ
	ÏÂÅÉÈ ÛÌÀÚÁÈ.</para>

      <indexterm>
	<primary>IKE</primary>
      </indexterm>

      <para>ðÒÉ ÎÁÓÔÒÏÊËÅ ÐÁÒÁÍÅÔÒÏ× ÂÅÚÏÐÁÓÎÏÓÔÉ (security associations)
	Õ ×ÁÓ ÅÓÔØ Ä×Á ×ÁÒÉÁÎÔÁ.  ÷Ù ÍÏÖÅÔÅ ÎÁÓÔÒÏÉÔØ ÉÈ ×ÒÕÞÎÕÀ ÄÌÑ ÏÂÅÉÈ
	ÈÏÓÔÏ×, ÚÁÄÁ× ÁÌÇÏÒÉÔÍ ÛÉÆÒÏ×ÁÎÉÑ, ËÌÀÞÉ ÄÌÑ ÛÉÆÒÏ×ÁÎÉÑ É ÔÁË ÄÁÌÅÅ,
	ÉÌÉ ÉÓÐÏÌØÚÏ×ÁÔØ ÄÁÅÍÏÎÙ, ÒÅÁÌÉÚÕÀÝÉÅ Internet Key Exchange protocol
	(IKE), ËÏÔÏÒÙÊ ÓÄÅÌÁÅÔ ÜÔÏ ÚÁ ×ÁÓ.</para>

      <para>òÅËÏÍÅÎÄÕÅÔÓÑ ÐÏÓÌÅÄÎÅÅ.  ðÏÍÉÍÏ ÐÒÏÞÅÇÏ, ÜÔÏÔ ÓÐÏÓÏ ÂÏÌÅÅ
	ÐÒÏÓÔ.</para>

      <indexterm>
	<primary>IPsec</primary>

	<secondary>ÐÏÌÉÔÉËÉ ÂÅÚÏÐÁÓÎÏÓÔÉ</secondary>
      </indexterm>

      <indexterm>
	<primary><command>setkey</command></primary>
      </indexterm>

      <para>òÅÄÁËÔÉÒÏ×ÁÎÉÅ É ÏÔÏÂÒÁÖÅÎÉÅ ÐÏÌÉÔÉËÉ ÂÅÚÏÐÁÓÎÏÓÔÉ ×ÙÐÏÌÎÑÅÔÓÑ
	Ó ÐÏÍÏÝØÀ &man.setkey.8;.  ðÏ ÁÎÁÌÏÇÉÉ, <command>setkey</command>
	ÉÓÐÏÌØÚÕÅÔÓÑ ÄÌÑ ÎÁÓÔÒÏÊËÉ ÔÁÂÌÉÃ ÐÏÌÉÔÉËÉ ÂÅÚÏÐÁÓÎÏÓÔÉ ÑÄÒÁ ÔÁË ÖÅ,
	ËÁË &man.route.8; ÉÓÐÏÌØÚÕÅÔÓÑ ÄÌÑ ÎÁÓÔÒÏÊËÉ ÔÁÂÌÉÃ ÍÁÒÛÒÕÔÉÚÁÃÉÉ
	ÑÄÒÁ.  <command>setkey</command> ÔÁËÖÅ ÍÏÖÅÔ ÏÔÏÂÒÁÖÁÔØ ÔÅËÕÝÉÅ
	ÐÁÒÁÍÅÔÒÙ ÂÅÚÏÐÁÓÎÏÓÔÉ, É ÐÒÏÄÏÌÖÁÑ ÁÎÁÌÏÇÉÀ ÄÁÌØÛÅ, ÜÔÏ
	ÓÏÏÔ×ÅÔÓÔ×ÕÅÔ <command>netstat -r</command>.</para>

      <para>óÕÝÅÓÔ×ÕÅÔ ÍÎÏÖÅÓÔ×Ï ÄÁÅÍÏÎÏ× ÄÌÑ ÕÐÒÁ×ÌÅÎÉÑ ÐÁÒÁÍÅÔÒÁÍÉ
	ÂÅÚÏÐÁÓÎÏÓÔÉ × FreeBSD.  úÄÅÓØ ÂÕÄÅÔ ÏÐÉÓÁÎÏ ÉÓÐÏÌØÚÏ×ÁÎÉÅ ÏÄÎÏÇÏ ÉÚ
	ÎÉÈ, racoon&nbsp;&mdash; ÏÎ ÄÏÓÔÕÐÅÎ × ÓÏÓÔÁ×Å ÐÏÒÔÁ <filename
	role="package">security/ipsec-tools</filename> × ëÏÌÌÅËÃÉÉ
	ðÏÒÔÏ× &os;.</para>

      <indexterm>
	<primary>racoon</primary>
      </indexterm>

      <para>äÁÅÍÏÎ <application>racoon</application>
	ÄÏÌÖÅÎ ÒÁÂÏÔÁÔØ ÎÁ ÏÂÅÉÈ ÛÌÀÚÁÈ.  îÁ ËÁÖÄÏÍ ÉÚ ÈÏÓÔÏ×
	ÏÎ ÎÁÓÔÒÁÉ×ÁÅÔÓÑ Ó IP ÁÄÒÅÓÏÍ ÄÒÕÇÏÇÏ ËÏÎÃÁ VPN, É ÓÅËÒÅÔÎÙÍ
	ËÌÀÞÏÍ (ÐÏ ×ÁÛÅÍÕ ×ÙÂÏÒÕ, ÄÏÌÖÅÎ ÂÙÔØ ÏÄÎÉÍ É ÔÅÍ ÖÅ ÎÁ ÏÂÅÉÈ
	ÛÌÀÚÁÈ).</para>

      <para>üÔÉ Ä×Á ÄÁÅÍÏÎÁ ÐÏÄËÌÀÞÁÀÔÓÑ ÄÒÕÇ Ë ÄÒÕÇÕ, ÐÏÄÔ×ÅÒÖÄÁÀÔ, ÞÔÏ ÏÎÉ
	ÉÍÅÎÎÏ ÔÅ, ÚÁ ËÏÇÏ ÓÅÂÑ ×ÙÄÁÀÔ (ÉÓÐÏÌØÚÕÑ ÓÅËÒÅÔÎÙÊ ËÌÀÞ, ÚÁÄÁÎÎÙÊ
	×ÁÍÉ).  úÁÔÅÍ ÄÁÅÍÏÎÙ ÇÅÎÅÒÉÒÕÀÔ ÎÏ×ÙÊ ÓÅËÒÅÔÎÙÊ ËÌÀÞ É ÉÓÐÏÌØÚÕÀÔ
	ÅÇÏ ÄÌÑ ÛÉÆÒÏ×ÁÎÉÑ ÔÒÁÆÉËÁ ÞÅÒÅÚ VPN.  ïÎÉ ÐÅÒÉÏÄÉÞÅÓËÉ ÉÚÍÅÎÑÀÔ
	ÜÔÏÔ ËÌÀÞ, ÔÁË ÞÔÏ ÄÁÖÅ ÅÓÌÉ ÁÔÁËÕÀÝÉÊ ÓÌÏÍÁÅÔ ÏÄÉÎ ÉÚ ËÌÀÞÅÊ
	(ÞÔÏ ÔÅÏÒÅÔÉÞÅÓËÉ ÐÏÞÔÉ ÎÅ×ÏÚÍÏÖÎÏ) ÜÔÏ ÎÅ ÄÁÓÔ ÅÍÕ ÓÌÉÛËÏÍ ÍÎÏÇÏ
	&mdash; ÏÎ ÓÌÏÍÁÌ ËÌÀÞ, ËÏÔÏÒÙÊ Ä×Á ÄÁÅÍÏÎÁ ÕÖÅ ÓÍÅÎÉÌÉ ÎÁ
	ÄÒÕÇÏÊ.</para>

      <para>îÁÓÔÒÏÊËÉ racoon ÓÏÈÒÁÎÑÀÔÓÑ × ÆÁÊÌÅ
	<filename>${PREFIX}/etc/racoon</filename>.  üÔÏÔ ÆÁÊÌ ÎÅ ÔÒÅÂÕÅÔ
	ÓÌÉÛËÏÍ ÂÏÌØÛÉÈ ÉÚÍÅÎÅÎÉÊ.  äÒÕÇÉÍ ËÏÍÐÏÎÅÎÔÏÍ ÎÁÓÔÒÏÊËÉ
	racoon, ËÏÔÏÒÙÊ ÐÏÔÒÅÂÕÅÔÓÑ ÉÚÍÅÎÉÔØ, Ñ×ÌÑÅÔÓÑ <quote>ÐÒÅÄ×ÁÒÉÔÅÌØÎÙÊ
	ËÌÀÞ</quote>.</para>

      <para>÷ ÎÁÓÔÒÏÊËÅ ÐÏ ÕÍÏÌÞÁÎÉÀ racoon ÉÝÅÔ ÅÇÏ × ÆÁÊÌÅ
	<filename>${PREFIX}/etc/racoon/psk.txt</filename>.  îÅÏÂÈÏÄÉÍÏ
	ÏÔÍÅÔÉÔØ, ÞÔÏ ÐÒÅÄ×ÁÒÉÔÅÌØÎÙÊ ËÌÀÞ <emphasis>ÎÅ</emphasis>
	ÉÓÐÏÌØÚÕÅÔÓÑ ÄÌÑ ÛÉÆÒÏ×ÁÎÉÑ ÔÒÁÆÉËÁ ÞÅÒÅÚ VPN ÓÏÅÄÉÎÅÎÉÅ
	ÜÔÏ ÐÒÏÓÔÏ ÍÁÒËÅÒ, ÐÏÚ×ÏÌÑÀÝÉÊ ÕÐÒÁ×ÌÑÀÝÉÍ ËÌÀÞÁÍÉ ÄÁÅÍÏÎÁÍ
	ÄÏ×ÅÒÑÔØ ÄÒÕÇ ÄÒÕÇÕ.</para>

      <para><filename>psk.txt</filename> ÓÏÄÅÒÖÉÔ ÓÔÒÏËÕ ÄÌÑ ËÁÖÄÏÇÏ
	ÕÄÁÌÅÎÎÏÇÏ ÓÅÒ×ÅÒÁ, Ó ËÏÔÏÒÙÍ ÐÒÏÉÓÈÏÄÉÔ ÓÏÅÄÉÎÅÎÉÅ.  ÷ ÜÔÏÍ ÐÒÉÍÅÒÅ
	Ä×Á ÓÅÒ×ÅÒÁ, ËÁÖÄÙÊ ÆÁÊÌ <filename>psk.txt</filename> ÂÕÄÅÔ
	ÓÏÄÅÒÖÁÔØ ÏÄÎÕ ÓÔÒÏËÕ (ËÁÖÄÙÊ ËÏÎÅÃ VPN ÏÂÝÁÅÔÓÑ ÔÏÌØËÏ Ó ÄÒÕÇÉÍ
	ËÏÎÃÏÍ.</para>

       <para>îÁ ÛÌÀÚÅ #1 ÜÔÁ ÓÔÒÏËÁ ÂÕÄÅÔ ×ÙÇÌÑÄÅÔØ ÐÒÉÍÅÒÎÏ ÔÁË:</para>

       <programlisting>W.X.Y.Z            secret</programlisting>

      <para>ôÏ ÅÓÔØ <emphasis>ÐÕÂÌÉÞÎÙÊ</emphasis> IP-ÁÄÒÅÓ ÐÒÏÔÉ×ÏÐÏÌÏÖÎÏÊ
	ÓÔÏÒÏÎÙ, ÐÒÏÂÅÌ É ÔÅËÓÔÏ×ÁÑ ÓÔÒÏËÁ c ÓÅËÒÅÔÎÏÊ ÆÒÁÚÏÊ.  ëÏÎÅÞÎÏ, ×ÁÍ
	ÎÅ ÓÔÏÉÔ ÉÓÐÏÌØÚÏ×ÁÔØ × ËÁÞÅÓÔ×Å ËÌÀÞÅ×ÏÊ ÆÒÁÚÙ ÓÌÏ×Ï
	<quote>secret</quote> -- ÚÄÅÓØ ÐÒÉÍÅÎÑÀÔÓÑ ÏÂÙÞÎÙÅ ÐÒÁ×ÉÌÁ
	×ÙÂÏÒÁ ÐÁÒÏÌÅÊ.</para>

      <para>îÁ ÛÌÀÚÅ #2 ÓÔÒÏËÁ ÂÕÄÅÔ ×ÙÇÌÑÄÅÔØ ÐÒÉÍÅÒÎÏ ÔÁË:</para>

      <programlisting>A.B.C.D            secret</programlisting>

      <para>ôÏ ÅÓÔØ ÐÕÂÌÉÞÎÙÊ IP ÁÄÒÅÓ ÕÄÁÌÅÎÎÏÊ ÓÔÏÒÏÎÙ É ÔÁ ÖÅ
	ÓÅËÒÅÔÎÁÑ ÆÒÁÚÁ.  ðÅÒÅÄ ÚÁÐÕÓËÏÍ racoon ÒÅÖÉÍ ÄÏÓÔÕÐÁ Ë ÆÁÊÌÕ
	<filename>psk.txt</filename> ÄÏÌÖÅÎ ÂÙÔØ ÕÓÔÁÎÏ×ÌÅÎ ×
	<literal>0600</literal> (Ô.Å. ÚÁÐÉÓØ É ÞÔÅÎÉÅ ÔÏÌØËÏ ÄÌÑ
	<username>root</username>).</para>

      <para>÷Ù ÄÏÌÖÎÙ ÚÁÐÕÓÔÉÔØ racoon ÎÁ ÏÂÏÉÈ ÛÌÀÚÁÈ.  ÷ÁÍ ÔÁËÖÅ
	ÐÏÔÒÅÂÕÅÔÓÑ ÄÏÂÁ×ÉÔØ ÐÒÁ×ÉÌÁ ÄÌÑ ×ËÌÀÞÅÎÉÑ IKE ÔÒÁÆÉËÁ,
	ÐÅÒÅÄÁÀÝÅÇÏÓÑ ÐÏ UDP ÞÅÒÅÚ ÐÏÒÔ ISAKMP (Internet Security Association
	Key Management Protocol).  ïÐÑÔØ ÖÅ, ÏÎÉ ÄÏÌÖÎÙ ÂÙÔØ
	ÒÁÓÐÏÌÏÖÅÎÙ ÎÁÓËÏÌØËÏ ×ÏÚÍÏÖÎÏ ÂÌÉÖÅ Ë ÎÁÞÁÌÕ ÎÁÂÏÒÁ ÐÒÁ×ÉÌ.</para>

      <programlisting>ipfw add 1 allow udp from A.B.C.D to W.X.Y.Z isakmp
ipfw add 1 allow udp from W.X.Y.Z to A.B.C.D isakmp
      </programlisting>

      <para>ëÁË ÔÏÌØËÏ racoon ÂÕÄÅÔ ÚÁÐÕÝÅÎ, ×Ù ÍÏÖÅÔÅ ÐÏÐÒÏÂÏ×ÁÔØ
	×ÙÐÏÌÎÉÔØ ping Ó ÏÄÎÏÇÏ ÛÌÀÚÁ ÎÁ ÄÒÕÇÏÊ.  óÏÅÄÉÎÅÎÉÅ ×ÓÅ ÅÝÅ ÎÅ
	ÚÁÛÉÆÒÏ×ÁÎÏ, ÎÏ racoon ÕÓÔÁÎÏ×ÉÔ ÐÁÒÁÍÅÔÒÙ ÂÅÚÏÐÁÓÎÏÓÔÉ ÍÅÖÄÕ
	Ä×ÕÍÑ ÈÏÓÔÁÍÉ &mdash; ÜÔÏ ÍÏÖÅÔ ÚÁÎÑÔØ ×ÒÅÍÑ É ×Ù ÍÏÖÅÔÅ ÚÁÍÅÔÉÔØ
	ÎÅÂÏÌØÛÕÀ ÚÁÄÅÒÖËÕ ÐÅÒÅÄ ÎÁÞÁÌÏÍ ÏÔ×ÅÔÁ ËÏÍÁÎÄÙ ping.</para>

      <para>ëÁË ÔÏÌØËÏ ÐÁÒÁÍÅÔÒÙ ÂÅÚÏÐÁÓÎÏÓÔÉ ÕÓÔÁÎÏ×ÌÅÎÙ, ×Ù ÍÏÖÅÔÅ
	ÐÒÏÓÍÏÔÒÅÔØ ÉÈ ÉÓÐÏÌØÚÕÑ &man.setkey.8;.  úÁÐÕÓÔÉÔÅ</para>

      <programlisting>setkey -D</programlisting>

      <para>ÎÁ ÌÀÂÏÍ ÉÚ ÈÏÓÔÏ× ÄÌÑ ÐÒÏÓÍÏÔÒÁ ÉÎÆÏÒÍÁÃÉÉ Ï ÐÁÒÁÍÅÔÒÁÈ
	ÂÅÚÏÐÁÓÎÏÓÔÉ.</para>

      <para>üÔÏ ÏÄÎÁ ÓÔÏÒÏÎÁ ÐÒÏÂÌÅÍÙ.  äÒÕÇÁÑ ÓÔÏÒÏÎÁ ÜÔÏ ÎÁÓÔÒÏÊËÁ
	ÐÏÌÉÔÉËÉ ÂÅÚÏÐÁÓÎÏÓÔÉ.</para>

      <para>äÌÑ ÓÏÚÄÁÎÉÑ ÒÁÚÕÍÎÏÊ ÐÏÌÉÔÉËÉ ÂÅÚÏÐÁÓÎÏÓÔÉ ÄÁ×ÁÊÔÅ ×ÓÐÏÍÎÉÍ,
	ÞÔÏ ÕÖÅ ÂÙÌÏ ÎÁÓÔÒÏÅÎÏ.  üÔÏ ÒÁÓÓÍÏÔÒÅÎÉÅ ÏÔÎÏÓÉÔÓÑ Ë ÏÂÅÉÍ
	ËÏÎÃÁÍ ÓÏÅÄÉÎÅÎÉÑ.</para>

      <para>ëÁÖÄÙÊ ÏÔÐÒÁ×ÌÑÅÍÙÊ IP ÐÁËÅÔ ÉÍÅÅÔ ÚÁÇÏÌÏ×ÏË, ÓÏÄÅÒÖÁÝÉÊ ÉÎÆÏÒÍÁÃÉÀ
	Ï ÐÁËÅÔÅ.  úÁÇÏÌÏ×ÏË ×ËÌÀÞÁÅÔ IP ÁÄÒÅÓÁ ÉÓÔÏÞÎÉËÁ É ÎÁÚÎÁÞÅÎÉÑ.
	ëÁË ÍÙ ÕÖÅ ÚÎÁÅÍ, ÐÒÉ×ÁÔÎÙÅ IP ÁÄÒÅÓÁ, ÔÁËÉÅ ËÁË <hostid
	role="ipaddr">192.168.x.y</hostid>, ÎÅ ÍÏÇÕÔ ÐÏÑ×ÉÔØÓÑ ×
	ÉÎÔÅÒÎÅÔ.  ïÎÉ ÄÏÌÖÎÙ ÂÙÔØ ÓÎÁÞÁÌÁ ×ËÌÀÞÅÎÙ ×ÎÕÔÒØ ÄÒÕÇÏÇÏ
	ÐÁËÅÔÁ.  ÷ ÜÔÏÍ ÐÁËÅÔÅ ÐÒÉ×ÁÔÎÙÅ IP ÁÄÒÅÓÁ ÉÓÔÏÞÎÉËÁ É ÎÁÚÎÁÞÅÎÉÑ
	ÚÁÍÅÎÑÀÔÓÑ ÐÕÂÌÉÞÎÙÍÉ IP ÁÄÒÅÓÁÍÉ.</para>

      <para>ôÏ ÅÓÔØ ÉÓÈÏÄÑÝÉÊ ÐÁËÅÔ, ËÏÔÏÒÙÊ ×ÙÇÌÑÄÉÔ ÐÒÉÍÅÒÎÏ ÔÁË:</para>

	<mediaobject>
	  <imageobject>
	    <imagedata fileref="security/ipsec-out-pkt" align="center">
	  </imageobject>

	  <textobject>
	    <literallayout class="monospaced">
  .----------------------------.
  | Src: 192.168.1.1           |
  | Dst: 192.168.2.1           |
  | &lt;ÄÒÕÇÉÅ ÄÁÎÎÙÅ ÚÁÇÏÌÏ×ËÁ&gt;  |
  +----------------------------+
  | &lt;ÄÁÎÎÙÅ ÐÁËÅÔÁ&gt;            |
  `----------------------------'</literallayout>
	  </textobject>
	</mediaobject>

      <para>ÂÕÄÅÔ ÉÎËÁÐÓÕÌÉÒÏ×ÁÎ × ÄÒÕÇÏÊ ÐÁËÅÔ, ×ÙÇÌÑÄÑÝÉÊ ÐÒÉÍÅÒÎÏ
	ÔÁË:</para>

	<mediaobject>
	  <imageobject>
	    <imagedata fileref="security/ipsec-encap-pkt" align="center">
	  </imageobject>

	  <textobject>
	    <literallayout class="monospaced">
  .--------------------------------.
  | Src: A.B.C.D                   |
  | Dst: W.X.Y.Z                   |
  | &lt;ÄÒÕÇÉÅ ÄÁÎÎÙÅ ÚÁÇÏÌÏ×ËÁ&gt;      |
  +--------------------------------+
  | .----------------------------. |
  | | Src: 192.168.1.1           | |
  | | Dst: 192.168.2.1           | |
  | | &lt;ÄÒÕÇÉÅ ÄÁÎÎÙÅ ÚÁÇÏÌÏ×ËÁ&gt;  | |
  | +----------------------------+ |
  | | &lt;ÄÁÎÎÙÅ ÐÁËÅÔÁ&gt;            | |
  | `----------------------------' |
  `--------------------------------'</literallayout>
	  </textobject>
	</mediaobject>

      <para>üÔÏÊ ÉÎËÁÐÓÕÌÑÃÉÅÊ ÚÁÎÉÍÁÅÔÓÑ ÕÓÔÒÏÊÓÔ×Ï
	<devicename>gif</devicename>.  ëÁË ×Ù ÍÏÖÅÔÅ ×ÉÄÅÔØ, ÔÅÐÅÒØ
	Õ ÐÁËÅÔÁ ÅÓÔØ ÒÅÁÌØÎÙÊ IP ÁÄÒÅÓ, ÉÓÈÏÄÎÙÊ ÐÁËÅÔ ÂÙÌ ×ËÌÀÞÅÎ
	× ÜÔÏÔ ÐÁËÅÔ × ×ÉÄÅ ÄÁÎÎÙÈ, ËÏÔÏÒÙÅ ÐÅÒÅÄÁÀÔÓÑ ÞÅÒÅÚ
	ÉÎÔÅÒÎÅÔ.</para>

      <para>ëÏÎÅÞÎÏ, ÍÙ ÈÏÔÉÍ ÚÁÛÉÆÒÏ×ÁÔØ ×ÅÓØ ÔÒÁÆÉË ÍÅÖÄÕ VPN.
	÷Ù ÍÏÖÅÔÅ ÓÆÏÒÍÕÌÉÒÏ×ÁÔØ ÜÔÏ ÎÁ ÓÌÏ×ÁÈ ÔÁË:</para>

      <para><quote>åÓÌÉ ÐÁËÅÔ ÏÔÐÒÁ×ÌÑÅÔÓÑ Ó <hostid
	role="ipaddr">A.B.C.D</hostid>, É ÐÒÅÄÎÁÚÎÁÞÅÎ ÄÌÑ <hostid
	role="ipaddr">W.X.Y.Z</hostid>, ÒÁÓÛÉÆÒÏ×ÁÔØ ÅÇÏ, ÉÓÐÏÌØÚÕÑ
	ÎÅÏÂÈÏÄÉÍÙÅ ÐÁÒÁÍÅÔÒÙ ÂÅÚÏÐÁÓÎÏÓÔÉ.</quote></para>

      <para><quote>åÓÌÉ ÐÁËÅÔ ÏÔÐÒÁ×ÌÑÅÔÓÑ Ó <hostid
	role="ipaddr">W.X.Y.Z</hostid>, É ÐÒÅÄÎÁÚÎÁÞÅÎ ÄÌÑ <hostid
	role="ipaddr">A.B.C.D</hostid>, ÒÁÓÛÉÆÒÏ×ÁÔØ ÅÇÏ, ÉÓÐÏÌØÚÕÑ
	ÎÅÏÂÈÏÄÉÍÙÅ ÐÁÒÁÍÅÔÒÙ ÂÅÚÏÐÁÓÎÏÓÔÉ.</quote></para>

       <para>üÔÏ ÐÏÈÏÖÅ ÎÁ ÖÅÌÁÅÍÏÅ, ÎÏ ÎÅ ÓÏ×ÓÅÍ ÔÏ.  åÓÌÉ ×Ù ÓÄÅÌÁÅÔÅ
	ÜÔÏ, ×ÅÓØ ÔÒÁÆÉË ÏÔ É Ë <hostid role="ipaddr">W.X.Y.Z</hostid>,
	ÄÁÖÅ ÅÓÌÉ ÏÎ ÎÅ Ñ×ÌÑÅÔÓÑ ÞÁÓÔØÀ VPN, ÂÕÄÅÔ ÚÁÛÉÆÒÏ×ÁÎ.  ðÒÁ×ÉÌØÎÁÑ
	ÐÏÌÉÔÉËÁ ÔÁËÏ×Á:</para>

      <para><quote>åÓÌÉ ÐÁËÅÔ ÏÔÐÒÁ×ÌÑÅÔÓÑ Ó <hostid
	role="ipaddr">A.B.C.D</hostid>, × ÎÅÍ ÉÎËÁÐÓÕÌÉÒÏ×ÁÎ ÄÒÕÇÏÊ ÐÁËÅÔ
	É ÁÄÒÅÓ ÎÁÚÎÁÞÅÎÉÑ <hostid role="ipaddr">W.X.Y.Z</hostid>,
	ÚÁÛÉÆÒÏ×ÁÔØ ÅÇÏ, ÉÓÐÏÌØÚÕÑ ÎÅÏÂÈÏÄÉÍÙÅ ÐÁÒÁÍÅÔÒÙ
	ÂÅÚÏÐÁÓÎÏÓÔÉ.</quote></para>

      <para><quote>åÓÌÉ ÐÁËÅÔ ÏÔÐÒÁ×ÌÑÅÔÓÑ Ó <hostid
	role="ipaddr">W.X.Y.Z</hostid>, × ÎÅÍ ÉÎËÁÐÓÕÌÉÒÏ×ÁÎ ÄÒÕÇÏÊ ÐÁËÅÔ
	É ÁÄÒÅÓ ÎÁÚÎÁÞÅÎÉÑ <hostid role="ipaddr">A.B.C.D</hostid>,
	ÚÁÛÉÆÒÏ×ÁÔØ ÅÇÏ, ÉÓÐÏÌØÚÕÑ ÎÅÏÂÈÏÄÉÍÙÅ ÐÁÒÁÍÅÔÒÙ
	ÂÅÚÏÐÁÓÎÏÓÔÉ.</quote></para>

      <para>ôÏÎËÏÅ, ÎÏ ÎÅÏÂÈÏÄÉÍÏÅ ÒÁÚÌÉÞÉÅ.</para>

      <para>ðÏÌÉÔÉËÁ ÂÅÚÏÐÁÓÎÏÓÔÉ ÔÁËÖÅ ÕÓÔÁÎÁ×ÌÉ×ÁÅÔÓÑ Ó ÉÓÐÏÌØÚÏ×ÁÎÉÅÍ
	&man.setkey.8;.  ÷ &man.setkey.8; ÐÒÅÄÕÓÍÏÔÒÅÎ ÑÚÙË ÏÐÒÅÄÅÌÅÎÉÑ
	ÐÏÌÉÔÉËÉ &man.setkey.8;.  ÷Ù ÍÏÖÅÔÅ ÉÌÉ ××ÅÓÔÉ ÉÎÓÔÒÕËÃÉÉ
	ÐÏ ÎÁÓÔÒÏÊËÅ ÓÏ ÓÔÁÎÄÁÒÔÎÏÇÏ ××ÏÄÁ, ÉÌÉ ÉÓÐÏÌØÚÏ×ÁÔØ ÐÁÒÁÍÅÔÒ
	<option>-f</option> ÄÌÑ ÚÁÄÁÎÉÑ ÆÁÊÌÁ, ÓÏÄÅÒÖÁÝÅÇÏ ÜÔÉ
	ÉÎÓÔÒÕËÃÉÉ.</para>

      <para>îÁÓÔÒÏÊËÁ ÎÁ ÛÌÀÚÅ #1 (ÇÄÅ ÅÓÔØ ÐÕÂÌÉÞÎÙÊ IP ÁÄÒÅÓ
	<hostid role="ipaddr">A.B.C.D</hostid>) ÄÌÑ ×ËÌÀÞÅÎÉÑ ÛÉÆÒÏ×ÁÎÉÑ
	×ÓÅÇÏ ÐÒÅÄÎÁÚÎÁÞÅÎÎÏÇÏ <hostid role="ipaddr">W.X.Y.Z</hostid>
	ÔÒÁÆÉËÁ:</para>

      <programlisting>
spdadd A.B.C.D/32 W.X.Y.Z/32 ipencap -P out ipsec esp/tunnel/A.B.C.D-W.X.Y.Z/require;
      </programlisting>

      <para>ðÏÍÅÓÔÉÔÅ ÜÔÉ ËÏÍÁÎÄÙ × ÆÁÊÌ (ÎÁÐÒÉÍÅÒ,
	<filename>/etc/ipsec.conf</filename>) É ÚÁÐÕÓÔÉÔÅ</para>

      <screen>&prompt.root; <userinput>setkey -f /etc/ipsec.conf</userinput></screen>

      <para><option>spdadd</option> ÕËÁÚÙ×ÁÅÔ &man.setkey.8; ÄÏÂÁ×ÉÔØ
	ÐÒÁ×ÉÌÏ Ë ÂÁÚÅ ÄÁÎÎÙÈ ÐÏÌÉÔÉËÉ ÂÅÚÏÐÁÓÎÏÓÔÉ.  ïÓÔÁÌØÎÁÑ ÞÁÓÔØ
	ÓÔÒÏËÉ ÕËÁÚÙ×ÁÅÔ ËÁËÉÅ ÐÁËÅÔÙ ÂÕÄÕÔ ÓÏÏÔ×ÅÔÓÔ×Ï×ÁÔØ ÐÏÌÉÔÉËÅ.
	<hostid role="ipaddr">A.B.C.D/32</hostid> É <hostid
	role="ipaddr">W.X.Y.Z/32</hostid> ÜÔÏ IP ÁÄÒÅÓÁ É ÓÅÔÅ×ÙÅ ÍÁÓËÉ,
	ÏÐÒÅÄÅÌÑÀÝÉÅ ÓÅÔÉ ÉÌÉ ÈÏÓÔÙ, Ë ËÏÔÏÒÙÍ ÂÕÄÅÔ ÐÒÉÍÅÎÑÔØÓÑ ÄÁÎÎÁÑ
	ÐÏÌÉÔÉËÁ.  ÷ ÄÁÎÎÏÍ ÓÌÕÞÁÅ ÍÙ ÈÏÔÉÍ ÐÒÉÍÅÎÉÔØ ÉÈ Ë ÔÒÁÆÉËÕ ÍÅÖÄÕ
	ÜÔÉÍÉ Ä×ÕÍÑ ÈÏÓÔÁÍÉ.  ðÁÒÁÍÅÔÒ <option>ipencap</option> ÓÏÏÂÝÁÅÔ
	ÑÄÒÕ, ÞÔÏ ÜÔÁ ÐÏÌÉÔÉËÁ ÄÏÌÖÎÁ ÐÒÉÍÅÎÑÔØÓÑ ÔÏÌØËÏ Ë ÐÁËÅÔÁÍ,
	ÉÎËÁÐÓÕÌÉÒÕÀÝÉÍ ÄÒÕÇÉÅ ÐÁËÅÔÙ.  ðÁÒÁÍÅÔÒ <option>-P out</option>
	ÓÏÏÂÝÁÅÔ, ÞÔÏ ÜÔÁ ÐÏÌÉÔÉËÁ ÐÒÉÍÅÎÑÅÔÓÑ Ë ÉÓÈÏÄÑÝÉÍ ÐÁËÅÔÁÍ, É
	<option>ipsec</option> &mdash; ÔÏ, ÞÔÏ ÐÁËÅÔÙ ÂÕÄÕÔ
	ÚÁÛÉÆÒÏ×ÁÎÙ.</para>

      <para>ïÓÔÁ×ÛÁÑÓÑ ÞÁÓÔØ ÓÔÒÏËÉ ÏÐÒÅÄÅÌÑÅÔ, ËÁË ÜÔÉ ÐÁËÅÔÙ ÂÕÄÕÔ
	ÚÁÛÉÆÒÏ×ÁÎÙ.  âÕÄÅÔ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ ÐÒÏÔÏËÏÌ <option>esp</option>,
	Á ÐÁÒÁÍÅÔÒ <option>tunnel</option> ÐÏËÁÚÙ×ÁÅÔ, ÞÔÏ ÐÁËÅÔ × ÄÁÌØÎÅÊÛÅÍ
	ÂÕÄÅÔ ÉÎËÁÐÓÕÌÉÒÏ×ÁÎ × IPsec ÐÁËÅÔ.  ðÏ×ÔÏÒÎÏÅ ÉÓÐÏÌØÚÏ×ÁÎÉÅ
	<hostid role="ipaddr">A.B.C.D</hostid> É <hostid
	role="ipaddr">W.X.Y.Z</hostid> ÐÒÅÄÎÁÚÎÁÞÅÎÏ ÄÌÑ ×ÙÂÏÒÁ
	ÉÓÐÏÌØÚÕÅÍÙÈ ÐÁÒÁÍÅÔÒÏ× ÂÅÚÏÐÁÓÎÏÓÔÉ, É ÎÁËÏÎÅà ÐÁÒÁÍÅÔÒ
	<option>require</option> ÒÁÚÒÅÛÁÅÔ ÛÉÆÒÏ×ÁÎÉÅ ÐÁËÅÔÏ×, ÐÏÐÁÄÁÀÝÉÈ
	ÐÏÄ ÜÔÏ ÐÒÁ×ÉÌÏ.</para>

      <para>üÔÏ ÐÒÁ×ÉÌÏ ÓÏÏÔ×ÅÔÓÔ×ÕÅÔ ÔÏÌØËÏ ÉÓÈÏÄÑÝÉÍ ÐÁËÅÔÁÍ.  ÷ÁÍ
	ÐÏÔÒÅÂÕÅÔÓÑ ÐÏÈÏÖÅÅ ÐÒÁ×ÉÌÏ, ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÅÅ ×ÈÏÄÑÝÉÍ ÐÁËÅÔÁÍ.</para>

      <programlisting>spdadd W.X.Y.Z/32 A.B.C.D/32 ipencap -P in ipsec esp/tunnel/W.X.Y.Z-A.B.C.D/require;</programlisting>

      <para>ïÂÒÁÔÉÔÅ ×ÎÉÍÁÎÉÅ, ÞÔÏ ×ÍÅÓÔÏ <option>in</option> ÉÓÐÏÌØÚÕÅÔÓÑ
	 <option>out</option> É IP ÁÄÒÅÓÁ ÐÅÒÅÓÔÁ×ÌÅÎÙ.</para>

      <para>äÒÕÇÏÍÕ ÛÌÀÚÕ (Ó ÐÕÂÌÉÞÎÙÍ IP ÁÄÒÅÓÏÍ
	<hostid role="ipaddr">W.X.Y.Z</hostid>) ÐÏÔÒÅÂÕÀÔÓÑ ÐÏÈÏÖÉÅ
	ÐÒÁ×ÉÌÁ.</para>

      <programlisting>spdadd W.X.Y.Z/32 A.B.C.D/32 ipencap -P out ipsec esp/tunnel/W.X.Y.Z-A.B.C.D/require;
spdadd A.B.C.D/32 W.X.Y.Z/32 ipencap -P in ipsec esp/tunnel/A.B.C.D-W.X.Y.Z/require;</programlisting>

      <para>îÁËÏÎÅÃ, ×ÁÍ ÐÏÔÒÅÂÕÅÔÓÑ ÄÏÂÁ×ÉÔØ ÐÒÁ×ÉÌÁ Ë ÂÒÁÎÄÍÁÕÜÒÕ
	ÄÌÑ ×ËÌÀÞÅÎÉÑ ÐÒÏÈÏÖÄÅÎÉÑ ÐÁËÅÔÏ× ESP É IPENCAP × ÏÂÅ ÓÔÏÒÏÎÙ.
	îÁ ÏÂÅÉÈ ÈÏÓÔÁÈ ÐÏÔÒÅÂÕÅÔÓÑ ÄÏÂÁ×ÉÔØ ÓÌÅÄÕÀÝÉÅ ÐÒÁ×ÉÌÁ:</para>

      <programlisting>ipfw add 1 allow esp from A.B.C.D to W.X.Y.Z
ipfw add 1 allow esp from W.X.Y.Z to A.B.C.D
ipfw add 1 allow ipencap from A.B.C.D to W.X.Y.Z
ipfw add 1 allow ipencap from W.X.Y.Z to A.B.C.D
      </programlisting>

      <para>ðÏÓËÏÌØËÕ ÐÒÁ×ÉÌÁ ÓÉÍÍÅÔÒÉÞÎÙ, ÍÏÖÎÏ ÉÓÐÏÌØÚÏ×ÁÔØ ÉÈ ÂÅÚ
	ÉÚÍÅÎÅÎÉÑ ÎÁ ÏÂÅÉÈ ÈÏÓÔÁÈ

      <para>éÓÈÏÄÑÝÉÅ ÐÁËÅÔÙ ÔÅÐÅÒØ ÂÕÄÕÔ ×ÙÇÌÑÄÅÔØ ÐÒÉÍÅÒÎÏ ÔÁË:</para>

	<mediaobject>
	  <imageobject>
	    <imagedata fileref="security/ipsec-crypt-pkt" align="center">
	  </imageobject>

	  <textobject>
	    <literallayout class="monospaced">
  .------------------------------.  --------------------------.
  | Src: A.B.C.D                 |                            |
  | Dst: W.X.Y.Z                 |                            |
  | &lt;other header info&gt;          |                            |  Encrypted
  +------------------------------+                            |  packet.
  | .--------------------------. |  -------------.            |  contents
  | | Src: A.B.C.D             | |               |            |  are
  | | Dst: W.X.Y.Z             | |               |            |  completely
  | | &lt;other header info&gt;      | |               |            |- secure
  | +--------------------------+ |               |  Encap'd   |  from third
  | | .----------------------. | |  -.           |  packet    |  party
  | | | Src: 192.168.1.1     | | |   |  Original |- with real |  snooping
  | | | Dst: 192.168.2.1     | | |   |  packet,  |  IP addr   |
  | | | &lt;other header info&gt;  | | |   |- private  |            |
  | | +----------------------+ | |   |  IP addr  |            |
  | | | &lt;packet data&gt;        | | |   |           |            |
  | | `----------------------' | |  -'           |            |
  | `--------------------------' |  -------------'            |
  `------------------------------'  --------------------------'
	    </literallayout>
	  </textobject>
	</mediaobject>

      <para>ëÏÇÄÁ ÜÔÉ ÐÁËÅÔÙ ÂÕÄÕÔ ÐÏÌÕÞÅÎÙ ÎÁ ÕÄÁÌÅÎÎÏÍ ËÏÎÃÅ VPN
	ÓÏÅÄÉÎÅÎÉÑ, ÏÎÉ ÂÕÄÕÔ ÒÁÓÛÉÆÒÏ×ÁÎÙ (ÉÓÐÏÌØÚÕÑ ÐÁÒÁÍÅÔÒÙ
	ÂÅÚÏÐÁÓÎÏÓÔÉ, Ï ËÏÔÏÒÙÈ ÄÏÇÏ×ÏÒÉÌÓÑ racoon).  úÁÔÅÍ ÏÎÉ ÂÕÄÕÔ
	ÐÅÒÅÄÁÎÙ ÉÎÔÅÒÆÅÊÓÕ <devicename>gif</devicename>, ËÏÔÏÒÙÊ
	<quote>ÒÁÚ×ÅÒÎÅÔ</quote> ×ÔÏÒÏÊ ÓÌÏÊ, ÏÓÔÁ×É× ÐÁËÅÔ Ó ×ÎÕÔÒÅÎÎÉÍÉ
	ÁÄÒÅÓÁÍÉ, ËÏÔÏÒÙÊ ÓÍÏÖÅÔ ÐÏÐÁÓÔØ ×Ï ×ÎÕÔÒÅÎÎÀÀ ÓÅÔØ.</para>

      <para>÷Ù ÍÏÖÅÔÅ ÐÒÏ×ÅÒÉÔØ ÂÅÚÏÐÁÓÎÏÓÔØ ÔÅÍ ÖÅ &man.ping.8;, ËÏÔÏÒÙÊ
	ÉÓÐÏÌØÚÏ×ÁÌÓÑ ÒÁÎÅÅ.  óÎÁÞÁÌÁ ×ÏÊÄÉÔÅ ÎÁ ÛÌÀÚ <hostid
	role="ipaddr">A.B.C.D</hostid> É ÚÁÐÕÓÔÉÔÅ:</para>

      <programlisting>tcpdump dst host 192.168.2.1</programlisting>

      <para>÷ ÄÒÕÇÏÊ ÓÅÓÓÉÉ ÎÁ ÔÏÍ ÖÅ ÈÏÓÔÅ ÚÁÐÕÓÔÉÔÅ</para>

      <programlisting>ping 192.168.2.1</programlisting>

      <para>÷ ÜÔÏÔ ÍÏÍÅÎÔ ×Ù ÄÏÌÖÎÙ Õ×ÉÄÅÔØ ÐÒÉÍÅÒÎÏ ÜÔÏ:</para>

      <programlisting>XXX tcpdump output</programlisting>

      <para>ôÅÐÅÒØ, ËÁË ×ÉÄÉÔÅ, &man.tcpdump.1; ÐÏËÁÚÙ×ÁÅÔ ESP ÐÁËÅÔÙ.  åÓÌÉ
	×Ù ÐÏÐÙÔÁÅÔÅÓØ ÐÒÏÓÍÏÔÒÅÔØ ÉÈ Ó ÐÁÒÁÍÅÔÒÏÍ <option>-s</option>,
	ÔÏ ×ÅÒÏÑÔÎÏ Õ×ÉÄÉÔÅ  ÎÅÞÔÏ ÎÅÐÏÎÑÔÎÏÅ, ÐÏÓËÏÌØËÕ ÐÒÉÍÅÎÑÅÔÓÑ
	ÛÉÆÒÏ×ÁÎÉÅ.</para>

      <para>ðÏÚÄÒÁ×ÌÑÅÍ. ÷Ù ÔÏÌØËÏ ÞÔÏ ÎÁÓÔÒÏÉÌÉ VPN ÍÅÖÄÕ Ä×ÕÍÑ ÕÄÁÌÅÎÎÙÍÉ
	ÓÅÔÑÍÉ.</para>

      <itemizedlist>
	<title>òÅÚÀÍÅ</title>

	<listitem>
	  <para>îÁÓÔÒÏÊÔÅ ÏÂÁ ÑÄÒÁ Ó:</para>

	  <programlisting>options IPSEC
options IPSEC_ESP
	  </programlisting>
	</listitem>

	<listitem>
	  <para>õÓÔÁÎÏ×ÉÔÅ <filename
	    role="package">security/ipsec-tools</filename>.  ïÔÒÅÄÁËÔÉÒÕÊÔÅ
	    <filename>${PREFIX}/etc/racoon/psk.txt</filename> ÎÁ ÏÂÅÉÈ
	    ÛÌÀÚÁÈ, ÄÏÂÁ×É× ÚÁÐÉÓØ ÄÌÑ ËÁÖÄÏÇÏ IP ÁÄÒÅÓÁ ÕÄÁÌÅÎÎÏÇÏ ÈÏÓÔÁ
	    É ÓÅËÒÅÔÎÙÊ ËÌÀÞ, ËÏÔÏÒÙÊ ÂÕÄÅÔ ÉÚ×ÅÓÔÅÎ ÉÍ ÏÂÅÉÍ.  õÂÅÄÉÔÅÓØ,
	    ÞÔÏ ÒÅÖÉÍ ÄÏÓÔÕÐÁ Ë ÆÁÊÌÕ 0600.</para>
	</listitem>
	<listitem>
	  <para>äÏÂÁ×ØÔÅ Ë
	    <filename>/etc/rc.conf</filename> ÎÁ ËÁÖÄÏÍ ÈÏÓÔÅ ÓÌÅÄÕÀÝÉÅ
	    ÓÔÒÏËÉ:</para>

	  <programlisting>ipsec_enable="YES"
ipsec_file="/etc/ipsec.conf"
	  </programlisting>
	</listitem>
	<listitem>
	  <para>óÏÚÄÁÊÔÅ <filename>/etc/ipsec.conf</filename> ÎÁ ËÁÖÄÏÍ
	    ÈÏÓÔÅ Ó ÎÅÏÂÈÏÄÉÍÙÍÉ ÓÔÒÏËÁÍÉ spdadd.  îÁ ÛÌÀÚÅ #1 ÏÎ ÂÕÄÅÔ
	    ÔÁËÉÍ:</para>

	  <programlisting>
spdadd A.B.C.D/32 W.X.Y.Z/32 ipencap -P out ipsec
  esp/tunnel/A.B.C.D-W.X.Y.Z/require;
spdadd W.X.Y.Z/32 A.B.C.D/32 ipencap -P in ipsec
  esp/tunnel/W.X.Y.Z-A.B.C.D/require;
</programlisting>

	  <para>á ÎÁ ÛÌÀÚÅ #2 ÔÁËÉÍ:</para>

<programlisting>
spdadd W.X.Y.Z/32 A.B.C.D/32 ipencap -P out ipsec
  esp/tunnel/W.X.Y.Z-A.B.C.D/require;
spdadd A.B.C.D/32 W.X.Y.Z/32 ipencap -P in ipsec
  esp/tunnel/A.B.C.D-W.X.Y.Z/require;
</programlisting>
	</listitem>
	<listitem>
	  <para>äÏÂÁ×ØÔÅ ÐÒÁ×ÉÌÁ Ë ÂÒÁÎÄÍÁÕÜÒÁÍ ÏÂÅÉÈ ÈÏÓÔÏ× ÄÌÑ
	    ×ËÌÀÞÅÎÉÑ IKE, ESP É IPENCAP ÔÒÁÆÉËÁ:</para>

	  <programlisting>
ipfw add 1 allow udp from A.B.C.D to W.X.Y.Z isakmp
ipfw add 1 allow udp from W.X.Y.Z to A.B.C.D isakmp
ipfw add 1 allow esp from A.B.C.D to W.X.Y.Z
ipfw add 1 allow esp from W.X.Y.Z to A.B.C.D
ipfw add 1 allow ipencap from A.B.C.D to W.X.Y.Z
ipfw add 1 allow ipencap from W.X.Y.Z to A.B.C.D
	  </programlisting>
	</listitem>
      </itemizedlist>

      <para>ä×ÕÈ ÐÒÉ×ÅÄÅÎÎÙÈ ÛÁÇÏ× ÄÏÌÖÎÏ ÂÙÔØ ÄÏÓÔÁÔÏÞÎÏ ÄÌÑ ÎÁÓÔÒÏÊËÉ
	É ×ËÌÀÞÅÎÉÑ VPN.  íÁÛÉÎÙ × ËÁÖÄÏÊ ÓÅÔÉ ÓÍÏÇÕÔ ÏÂÒÁÝÁÔØÓÑ ÄÒÕÇ Ë
	ÄÒÕÇÕ ÐÏ IP ÁÄÒÅÓÁÍ, É ×ÅÓØ ÔÒÁÆÉË ÞÅÒÅÚ ÓÏÅÄÉÎÅÎÉÅ ÂÕÄÅÔ
	Á×ÔÏÍÁÔÉÞÅÓËÉ ÎÁÄÅÖÎÏ ÚÁÛÉÆÒÏ×ÁÎ.</para>
    </sect3>
    </sect2>
  </sect1>

  <sect1 id="openssh">
    <sect1info>
      <authorgroup>
	<author>
	  <firstname>Chern</firstname>
	  <surname>Lee</surname>
	  <contrib>ðÒÅÄÏÓÔÁ×ÉÌ </contrib>
	</author>
	<!-- 21 April 2001 -->
      </authorgroup>
    </sect1info>

    <title>OpenSSH</title>
    <indexterm><primary>OpenSSH</primary></indexterm>
    <indexterm>
      <primary>ÂÅÚÏÐÁÓÎÏÓÔØ</primary>
      <secondary>OpenSSH</secondary>
    </indexterm>

    <para><application>OpenSSH</application> ÜÔÏ ÎÁÂÏÒ ÓÅÔÅ×ÙÈ ÉÎÓÔÒÕÍÅÎÔÏ×,
      ÉÓÐÏÌØÚÕÅÍÙÈ ÄÌÑ ÚÁÝÉÝÅÎÎÏÇÏ ÄÏÓÔÕÐÁ Ë ÕÄÁÌÅÎÎÙÍ ËÏÍÐØÀÔÅÒÁÍ.
      ïÎ ÍÏÖÅÔ ÂÙÔØ ÉÓÐÏÌØÚÏ×ÁÎ × ËÁÞÅÓÔ×Å ÎÅÐÏÓÒÅÄÓÔ×ÅÎÎÏÊ ÚÁÍÅÎÙ
      <command>rlogin</command>, <command>rsh</command>,
      <command>rcp</command> É <command>telnet</command>.
      ëÒÏÍÅ ÔÏÇÏ, ÞÅÒÅÚ SSH ÍÏÇÕÔ ÂÙÔØ ÂÅÚÏÐÁÓÎÏ ÔÕÎÎÅÌÉÒÏ×ÁÎÙ É/ÉÌÉ
      ÐÅÒÅÎÁÐÒÁ×ÌÅÎÙ ÐÒÏÉÚ×ÏÌØÎÙÅ TCP/IP ÓÏÅÄÉÎÅÎÉÑ.
      <application>OpenSSH</application> ÛÉÆÒÕÅÔ ×ÅÓØ ÔÒÁÆÉË, ÜÆÆÅËÔÉ×ÎÏ
      ÐÒÅÄÏÔ×ÒÁÝÁÑ ËÒÁÖÕ ÄÁÎÎÙÈ, ÐÅÒÅÈ×ÁÔ ÓÏÅÄÉÎÅÎÉÑ É ÄÒÕÇÉÅ ÓÅÔÅ×ÙÅ
      ÁÔÁËÉ.</para>

    <para><application>OpenSSH</application> ÐÏÄÄÅÒÖÉ×ÁÅÔÓÑ ÐÒÏÅËÔÏÍ
      OpenBSD, ÏÎ ÏÓÎÏ×ÁÎ ÎÁ SSH v1.2.12 ÓÏ ×ÓÅÍÉ ÐÏÓÌÅÄÎÉÍÉ ÉÓÐÒÁ×ÌÅÎÉÑÍÉ
      É ÏÂÎÏ×ÌÅÎÉÑÍÉ, ÓÏ×ÍÅÓÔÉÍ Ó ÐÒÏÔÏËÏÌÁÍÉ SSH ×ÅÒÓÉÊ 1 É 2.</para>

    <sect2>
      <title>ðÒÅÉÍÕÝÅÓÔ×Á ÉÓÐÏÌØÚÏ×ÁÎÉÑ OpenSSH</title>

      <para>ïÂÙÞÎÏ ÐÒÉ ÉÓÐÏÌØÚÏ×ÁÎÉÉ &man.telnet.1; ÉÌÉ &man.rlogin.1;
	ÄÁÎÎÙÅ ÐÅÒÅÓÙÌÁÀÔÓÑ ÐÏ ÓÅÔÉ × ÎÅÚÁÛÉÆÒÏ×ÁÎÎÏÊ ÆÏÒÍÅ.  ðÅÒÅÈ×ÁÔÞÉË
	ÐÁËÅÔÏ× × ÌÀÂÏÊ ÔÏÞËÅ ÓÅÔÉ ÍÅÖÄÕ ËÌÉÅÎÔÏÍ É ÓÅÒ×ÅÒÏÍ ÍÏÖÅÔ
	ÐÏÈÉÔÉÔØ ÉÎÆÏÒÍÁÃÉÀ Ï ÐÏÌØÚÏ×ÁÔÅÌÅ/ÐÁÒÏÌÅ ÉÌÉ ÄÁÎÎÙÅ, ÐÅÒÅÄÁ×ÁÅÍÙÅ
	ÞÅÒÅÚ ÓÏÅÄÉÎÅÎÉÅ.  äÌÑ ÐÒÅÄÏÔ×ÒÁÝÅÎÉÑ ÜÔÏÇÏ
	<application>OpenSSH</application> ÐÒÅÄÌÁÇÁÅÔ ÒÁÚÌÉÞÎÙÅ ÍÅÔÏÄÙ
	ÛÉÆÒÏ×ÁÎÉÑ.</para>
    </sect2>

    <sect2>
      <title>÷ËÌÀÞÅÎÉÅ sshd</title>
      <indexterm>
	<primary>OpenSSH</primary>
	<secondary>×ËÌÀÞÅÎÉÅ</secondary>
      </indexterm>

      <para>÷ &os; ÄÁÅÍÏÎ <application>sshd</application> ÄÏÌÖÅÎ
	ÂÙÔØ ÒÁÚÒÅÛÅÎ × ÐÒÏÃÅÓÓÅ ÉÎÓÔÁÌÌÑÃÉÉ.  úÁ ÚÁÐÕÓË ÏÔ×ÅÔÓÔ×ÅÎÎÁ
	ÓÌÅÄÕÀÝÁÑ ÓÔÒÏËÁ × ÆÁÊÌÅ <filename>rc.conf</filename>:</para>

      <screen>sshd_enable="YES"</screen>

      <para>ðÒÉ ÓÌÅÄÕÀÝÅÊ ÚÁÇÒÕÚËÅ ÓÉÓÔÅÍÙ ÂÕÄÅÔ ÚÁÐÕÝÅÎ &man.sshd.8;, ÄÁÅÍÏÎ ÄÌÑ
	<application>OpenSSH</application>.  ÷Ù ÍÏÖÅÔÅ ÔÁËÖÅ ×ÏÓÐÏÌØÚÏ×ÁÔØÓÑ
	ÓËÒÉÐÔÏÍ <filename>/etc/rc.d/sshd</filename> ÓÉÓÔÅÍÙ &man.rc.8;
	ÄÌÑ ÚÁÐÕÓËÁ <application>OpenSSH</application>:</para>

	<programlisting>/etc/rc.d/sshd start</programlisting>
     </sect2>

    <sect2>
      <title>SSH ËÌÉÅÎÔ</title>
      <indexterm>
	<primary>OpenSSH</primary>
	<secondary>ËÌÉÅÎÔ</secondary>
      </indexterm>

      <para>õÔÉÌÉÔÁ &man.ssh.1; ÒÁÂÏÔÁÅÔ ÐÏÄÏÂÎÏ &man.rlogin.1;.</para>

      <screen>&prompt.root; <userinput>ssh <replaceable>user@example.com</replaceable></userinput>
Host key not found from the list of known hosts.
Are you sure you want to continue connecting (yes/no)? <userinput>yes</userinput>
Host 'example.com' added to the list of known hosts.
user@example.com's password: <userinput>*******</userinput></screen>

      <para>÷ÈÏÄ ÐÒÏÄÏÌÖÉÔÓÑ ÔÁË ÖÅ, ËÁË ÅÓÌÉ ÂÙ ÓÅÓÓÉÑ ÂÙÌÁ ÉÎÉÃÉÉÒÏ×ÁÎÁ
	Ó ÉÓÐÏÌØÚÏ×ÁÎÉÅÍ <command>rlogin</command> ÉÌÉ
	<command>telnet</command>.  SSH ÉÓÐÏÌØÚÕÅÔ ÓÉÓÔÅÍÕ ÏÐÏÚÎÁ×ÁÔÅÌØÎÙÈ
	ËÌÀÞÅÊ ÄÌÑ ÐÒÏ×ÅÒËÉ ÐÏÄÌÉÎÎÏÓÔÉ ÓÅÒ×ÅÒÁ ÐÒÉ ÐÏÄËÌÀÞÅÎÉÉ ËÌÉÅÎÔÁ.
	ðÏÌØÚÏ×ÁÔÅÌÀ ÐÒÅÄÌÁÇÁÅÔÓÑ <literal>yes</literal> ÔÏÌØËÏ ÐÒÉ ÐÅÒ×ÏÍ
	ÐÏÄËÌÀÞÅÎÉÉ.  äÁÌØÎÅÊÛÉÅ ÐÏÐÙÔËÉ ×ÈÏÄÁ ÐÒÅÄ×ÁÒÑÀÔÓÑ ÐÒÏ×ÅÒËÏÊ
	ÓÏÈÒÁÎÅÎÎÏÇÏ ËÌÀÞÁ ÓÅÒ×ÅÒÁ.  SSH ËÌÉÅÎÔ ÓÏÏÂÝÉÔ ×ÁÍ, ÅÓÌÉ ÓÏÈÒÁÎÅÎÎÙÊ
	ËÌÀÞ ÂÕÄÅÔ ÏÔÌÉÞÁÔØÓÑ ÏÔ ÔÏÌØËÏ ÞÔÏ ÐÏÌÕÞÅÎÎÏÇÏ.  ëÌÀÞÉ ÓÅÒ×ÅÒÏ×
	ÓÏÈÒÁÎÑÀÔÓÑ × <filename>~/.ssh/known_hosts</filename>, ÉÌÉ ×
	<filename>~/.ssh/known_hosts2</filename> ÄÌÑ SSH v2.</para>

      <para>ðÏ ÕÍÏÌÞÁÎÉÀ ÓÏ×ÒÅÍÅÎÎÙÅ ÓÅÒ×ÅÒÙ <application>OpenSSH</application>
	ÎÁÓÔÒÏÅÎÙ ÎÁ ÐÒÉ£Í ÔÏÌØËÏ ÓÏÅÄÉÎÅÎÉÊ SSH v2.  ëÌÉÅÎÔ ÂÕÄÅÔ
	ÉÓÐÏÌØÚÏ×ÁÔØ ×ÅÒÓÉÀ 2 ÔÁÍ, ÇÄÅ ÜÔÏ ×ÏÚÍÏÖÎÏ, Á ÚÁÔÅÍ ×ÅÒÓÉÀ 1.
	ôÁËÖÅ, ËÌÉÅÎÔ ÍÏÖÎÏ ÚÁÓÔÁ×ÉÔØ ÉÓÐÏÌØÚÏ×ÁÔØ ËÏÎËÒÅÔÎÕÀ ×ÅÒÓÉÀ ÐÒÉ ÐÏÍÏÝÉ
	ÏÐÃÉÊ <option>-1</option> É <option>-2</option> ÄÌÑ ÕËÁÚÁÎÉÑ
	ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÅÊ ×ÅÒÓÉÉ ÐÒÏÔÏËÏÌÁ.  ÷ÅÒÓÉÑ 1 ÐÏÄÄÅÒÖÉ×ÁÅÔÓÑ ÒÁÄÉ
	ÓÏ×ÍÅÓÔÉÍÏÓÔÉ ÓÏ ÓÔÁÒÙÍÉ ÓÅÒ×ÅÒÁÍÉ.</para>
    </sect2>

    <sect2>
      <title>âÅÚÏÐÁÓÎÏÅ ËÏÐÉÒÏ×ÁÎÉÅ</title>
      <indexterm>
	<primary>OpenSSH</primary>
	<secondary>ÂÅÚÏÐÁÓÎÏÅ ËÏÐÉÒÏ×ÁÎÉÅ</secondary>
      </indexterm>
      <indexterm><primary><command>scp</command></primary></indexterm>

      <para>ëÏÍÁÎÄÁ &man.scp.1; ÒÁÂÏÔÁÅÔ ÐÏÄÏÂÎÏ &man.rcp.1;; ÏÎÁ ËÏÐÉÒÕÅÔ
	ÆÁÊÌ Ó ÕÄÁÌÅÎÎÏÇÏ ËÏÍÐØÀÔÅÒÁ, ÎÏ ÄÅÌÁÅÔ ÜÔÏ ÂÅÚÏÐÁÓÎÙÍ
	ÓÐÏÓÏÂÏÍ.</para>

      <screen>&prompt.root; <userinput> scp <replaceable>user@example.com:/COPYRIGHT COPYRIGHT</replaceable></userinput>
user@example.com's password: <userinput>*******</userinput>
COPYRIGHT            100% |*****************************|  4735       00:00
&prompt.root;</screen>

      <para>ðÏÓËÏÌØËÕ × ÐÒÅÄÙÄÕÝÅÍ ÐÒÉÍÅÒÅ ËÌÀÞ ÓÅÒ×ÅÒÁ ÕÖÅ ÂÙÌ ÓÏÈÒÁÎÅÎ,
	× ÜÔÏÍ ÐÒÉÍÅÒÅ ÏÎ ÐÒÏ×ÅÒÑÅÔÓÑ ÐÒÉ ÉÓÐÏÌØÚÏ×ÁÎÉÉ &man.scp.1;.</para>

      <para>ðÁÒÁÍÅÔÒÙ, ÐÅÒÅÄÁ×ÁÅÍÙÅ &man.scp.1;, ÐÏÈÏÖÉ ÎÁ ÐÁÒÁÍÅÔÒÙ
	&man.cp.1;, Ó ÆÁÊÌÏÍ ÉÌÉ ÆÁÊÌÁÍÉ × ËÁÞÅÓÔ×Å ÐÅÒ×ÏÇÏ ÁÒÇÕÍÅÎÔÁ É
	ÐÒÉÅÍÎÉËÏÍ ËÏÐÉÒÏ×ÁÎÉÑ ×Ï ×ÔÏÒÏÍ.  ðÏÓËÏÌØËÕ ÆÁÊÌÙ ÆÁÊÌÙ ÐÅÒÅÄÁÀÔÓÑ
	ÐÏ ÓÅÔÉ ÞÅÒÅÚ SSH, ÏÄÉÎ ÉÌÉ ÂÏÌÅÅ ÁÒÇÕÍÅÎÔÏ× ÐÒÉÎÉÍÁÀÔ ÆÏÒÍÕ
	<option>user@host:&lt;path_to_remote_file&gt;</option>.</para>

    </sect2>

    <sect2>
      <title>îÁÓÔÒÏÊËÁ</title>
      <indexterm>
	<primary>OpenSSH</primary>
	<secondary>ÎÁÓÔÒÏÊËÁ</secondary>
      </indexterm>

      <para>óÉÓÔÅÍÎÙÅ ÆÁÊÌÙ ÎÁÓÔÒÏÊËÉ ÄÌÑ ÄÁÅÍÏÎÁ É ËÌÉÅÎÔÁ
	<application>OpenSSH</application> ÒÁÓÐÏÌÏÖÅÎÙ × ËÁÔÁÌÏÇÅ
	<filename>/etc/ssh</filename>.</para>

      <para>æÁÊÌ <filename>ssh_config</filename> ÉÓÐÏÌØÚÕÅÔÓÑ ÄÌÑ ÎÁÓÔÒÏÊËÉ
	ËÌÉÅÎÔÁ, Á <filename>sshd_config</filename> ÄÌÑ ÄÁÅÍÏÎÁ.</para>

      <para>ëÒÏÍÅ ÔÏÇÏ, ÐÁÒÁÍÅÔÒÙ <option>sshd_program</option>
	(ÐÏ ÕÍÏÌÞÁÎÉÀ <filename>/usr/sbin/sshd</filename>), É
	<option>sshd_flags</option> <filename>rc.conf</filename>
	ÄÁÀÔ ÄÏÐÏÌÎÉÔÅÌØÎÙÅ ×ÏÚÍÏÖÎÏÓÔÉ ÎÁÓÔÒÏÊËÉ.</para>
    </sect2>

    <sect2 id="ssh-keygen">
      <title>ssh-keygen</title>

      <para>÷ÍÅÓÔÏ ÉÓÐÏÌØÚÏ×ÁÎÉÑ ÐÁÒÏÌÅÊ, Ó ÐÏÍÏÝØÀ &man.ssh-keygen.1;
	ÍÏÖÎÏ ÓÏÚÄÁÔØ ËÌÀÞÉ DSA ÉÌÉ RSA, ËÏÔÏÒÙÍÉ
	ÐÏÌØÚÏ×ÁÔÅÌÉ ÍÏÇÕÔ ÁÕÔÅÎÔÉÆÉÃÉÒÏ×ÁÔØÓÑ:</para>

      <screen>&prompt.user; <userinput>ssh-keygen -t <replaceable>dsa</replaceable></userinput>
Generating public/private dsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_dsa):
Created directory '/home/user/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/user/.ssh/id_dsa.
Your public key has been saved in /home/user/.ssh/id_dsa.pub.
The key fingerprint is:
bb:48:db:f2:93:57:80:b6:aa:bc:f5:d5:ba:8f:79:17 user@host.example.com
</screen>

      <para>&man.ssh-keygen.1; ÓÏÚÄÁÓÔ ÐÁÒÕ ÐÕÂÌÉÞÎÏÇÏ É ÐÒÉ×ÁÔÎÏÇÏ
	ËÌÀÞÅÊ, ÉÓÐÏÌØÚÕÅÍÙÈ ÄÌÑ ÁÕÔÅÎÔÉÆÉËÁÃÉÉ.  ðÒÉ×ÁÔÎÙÊ ËÌÀÞ ÓÏÈÒÁÎÑÅÔÓÑ
	× <filename>~/.ssh/id_dsa</filename> ÉÌÉ
	<filename>~/.ssh/id_rsa</filename>, Á ÐÕÂÌÉÞÎÙÊ ×
	<filename>~/.ssh/id_dsa.pub</filename> ÉÌÉ
	<filename>~/.ssh/id_rsa.pub</filename> (ÄÌÑ ËÌÀÞÅÊ DSA É RSA
	ÓÏÏÔ×ÅÔÓÔ×ÅÎÎÏ).  äÌÑ ×ËÌÀÞÅÎÉÑ
	ÁÕÔÅÎÔÉÆÉËÁÃÉÉ ÐÏ ËÌÀÞÁÍ ÐÕÂÌÉÞÎÙÊ ËÌÀÞ ÄÏÌÖÅÎ
	ÂÙÔØ ÐÏÍÅÝÅÎ × ÆÁÊÌ <filename>~/.ssh/authorized_keys</filename>
	ÎÁ ÕÄÁÌÅÎÎÏÍ ËÏÍÐØÀÔÅÒÅ.</para>

      <para>üÔÏ ÐÏÚ×ÏÌÑÅÔ ÓÏÅÄÉÎÑÔØÓÑ Ó ÕÄÁÌÅÎÎÙÍ ËÏÍÐØÀÔÅÒÏÍ Ó ÐÏÍÏÝØÀ
	SSH-ËÌÀÞÅÊ ×ÍÅÓÔÏ ÐÁÒÏÌÅÊ.</para>

      <para>åÓÌÉ ÐÒÉ ÇÅÎÅÒÁÃÉÉ ËÌÀÞÅÊ ÂÙÌ ÉÓÐÏÌØÚÏ×ÁÎ ÐÁÒÏÌØ, ËÁÖÄÙÊ ÒÁÚ
	ÄÌÑ ÐÒÉ ÉÓÐÏÌØÚÏ×ÁÎÉÉ ÐÒÉ×ÁÔÎÏÇÏ ËÌÀÞÁ ÏÎ ÂÕÄÅÔ ÚÁÐÒÁÛÉ×ÁÔØÓÑ
	Õ ÐÏÌØÚÏ×ÁÔÅÌÑ.  äÌÑ ÔÏÇÏ, ÞÔÏÂÙ ÉÚÂÅÖÁÔØ ÎÅÐÒÅÒÙ×ÎÏÇÏ ÎÁÂÏÒÁ
	ËÏÄÏ×ÏÊ ÆÒÁÚÙ, ÍÏÖÎÏ ÉÓÐÏÌØÚÏ×ÁÔØ ÕÔÉÌÉÔÕ &man.ssh-agent.1;,
	ËÁË ÏÐÉÓÁÎÏ × ÒÁÚÄÅÌÅ <xref linkend="security-ssh-agent">
	ÎÉÖÅ.</para>

      <warning><para>ðÁÒÁÍÅÔÒÙ É ÉÍÅÎÁ ÆÁÊÌÏ× ÍÏÇÕÔ ÒÁÚÌÉÞÁÔØÓÑ ÄÌÑ ÒÁÚÎÙÈ
	×ÅÒÓÉÊ <application>OpenSSH</application>, ÕÓÔÁÎÏ×ÌÅÎÎÙÈ × ÓÉÓÔÅÍÅ,
	ÄÌÑ ÒÅÛÅÎÉÑ ÐÒÏÂÌÅÍ ÏÂÒÁÔÉÔÅÓØ Ë ÓÔÒÁÎÉÃÅ ÓÐÒÁ×ÏÞÎÉËÁ
	&man.ssh-keygen.1;.</para></warning>
    </sect2>

    <sect2 id="security-ssh-agent">
      <title>õÔÉÌÉÔÙ ssh-agent É ssh-add</title>

      <para>õÔÉÌÉÔÙ &man.ssh-agent.1; É &man.ssh-add.1; ÐÏÚ×ÏÌÑÀÔ
	ÓÏÈÒÁÎÑÔØ ËÌÀÞÉ <application>SSH</application> × ÐÁÍÑÔÉ, ÞÔÏÂÙ
	ÎÅ ÎÁÂÉÒÁÔØ ËÏÄÏ×ÙÅ ÆÒÁÚÙ ÐÒÉ ËÁÖÄÏÍ ÉÓÐÏÌØÚÏ×ÁÎÉÉ ËÌÀÞÁ.</para>

      <para>õÔÉÌÉÔÁ &man.ssh-agent.1; ÏÂÅÓÐÅÞÉ×ÁÅÔ ÐÒÏÃÅÓÓ ÁÕÔÅÎÔÉÆÉËÁÃÉÉ
	ÚÁÇÒÕÖÅÎÎÙÍÉ × ÎÅÅ ÓÅËÒÅÔÎÙÍÉ ËÌÀÞÁÍÉ; ÄÌÑ ÜÔÏÇÏ ÕÔÉÌÉÔÁ
	&man.ssh-agent.1; ÄÏÌÖÎÁ ÚÁÐÕÓÔÉÔØ ×ÎÅÛÎÉÊ ÐÒÏÃÅÓÓ.  ÷ ÓÁÍÏÍ ÐÒÏÓÔÏÍ
	ÓÌÕÞÁÅ ÜÔÏ ÍÏÖÅÔ ÂÙÔØ ÛÅÌÌ-ÐÒÏÃÅÓÓ; × ÞÕÔØ ÂÏÌÅÅ ÐÒÏÄ×ÉÎÕÔÏÍ &mdash;
	ÏËÏÎÎÙÊ ÍÅÎÅÄÖÅÒ.</para>

      <para>äÌÑ ÉÓÐÏÌØÚÏ×ÁÎÉÑ &man.ssh-agent.1; ÓÏ×ÍÅÓÔÎÏ Ó ÛÅÌÌÏÍ,
	&man.ssh-agent.1; ÄÏÌÖÅÎ ÂÙÔØ ÚÁÐÕÝÅÎ Ó ÉÍÅÎÅÍ ÜÔÏÇÏ ÛÅÌÌÁ
	× ËÁÞÅÓÔ×Å ÁÒÇÕÍÅÎÔÁ.  ðÏÓÌÅ ÜÔÏÇÏ × ÅÇÏ ÐÁÍÑÔØ ÐÒÉ ÐÏÍÏÝÉ
	ÕÔÉÌÉÔÙ  &man.ssh-add.1; ÍÏÇÕÔ ÂÙÔØ ÄÏÂÁ×ÌÅÎÙ ÎÅÏÂÈÏÄÉÍÙÅ ËÌÀÞÉ;
	ÐÒÉ ÜÔÏÍ ÂÕÄÕÔ ÚÁÐÒÏÛÅÎÙ ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÉÅ ËÏÄÏ×ÙÅ ÆÒÁÚÙ.
	äÏÂÁ×ÌÅÎÎÙÅ ËÌÀÞÉ ÍÏÇÕÔ ÚÁÔÅÍ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ ÄÌÑ &man.ssh.1;
	ÎÁ ÍÁÛÉÎÙ, ÎÁ ËÏÔÏÒÙÈ ÕÓÔÁÎÏ×ÌÅÎÙ ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÉÅ ÐÕÂÌÉÞÎÙÅ
	ËÌÀÞÉ:</para>

      <screen>&prompt.user; ssh-agent <replaceable>csh</replaceable>
&prompt.user; ssh-add
Enter passphrase for /home/user/.ssh/id_dsa:
Identity added: /home/user/.ssh/id_dsa (/home/user/.ssh/id_dsa)
&prompt.user;</screen>

      <para>äÌÑ ÔÏÇÏ ÞÔÏÂÙ ÉÓÐÏÌØÚÏ×ÁÔØ &man.ssh-agent.1; × X11,
	×ÙÚÏ× &man.ssh-agent.1;ÄÏÌÖÅÎ ÂÙÔØ ÐÏÍÅÝÅÎ × ÆÁÊÌ
	<filename>~/.xinitrc</filename>.  üÔÏ ÏÂÅÓÐÅÞÉÔ ÐÏÄÄÅÒÖËÏÊ
	&man.ssh-agent.1; ×ÓÅ ÐÒÏÇÒÁÍÍÙ, ÚÁÐÕÝÅÎÎÙÅ × X11.  æÁÊÌ
	<filename>~/.xinitrc</filename> ÍÏÖÅÔ ×ÙÇÌÑÄÅÔØ, ÎÁÐÒÉÍÅÒ,
	ÔÁË:</para>

      <programlisting>exec ssh-agent <replaceable>startxfce4</replaceable></programlisting>

      <para>ðÒÉ ÜÔÏÍ ÂÕÄÅÔ ÚÁÐÕÝÅÎ &man.ssh-agent.1;, ËÏÔÏÒÙÊ, × Ó×ÏÀ
	ÏÞÅÒÅÄØ, ×ÙÚÏ×ÅÔ ÚÁÐÕÓË <application>XFCE</application>, ÐÒÉ ËÁÖÄÏÍ
	ÓÔÁÒÔÅ X11.  ðÏÓÌÅ ÚÁÐÕÓËÁ X11, ×ÙÐÏÌÎÉÔÅ ËÏÍÁÎÄÕ &man.ssh-add.1;
	ÄÌÑ ÄÏÂÁ×ÌÅÎÉÑ ×ÁÛÉÈ SSH-ËÌÀÞÅÊ.</para>
    </sect2>

    <sect2 id="security-ssh-tunneling">
      <title>ôÕÎÎÅÌÉÒÏ×ÁÎÉÅ SSH</title>

      <indexterm>
	<primary>OpenSSH</primary>

	<secondary>ÔÕÎÎÅÌÉÒÏ×ÁÎÉÅ</secondary>
      </indexterm>

      <para><application>OpenSSH</application> ÐÏÄÄÅÒÖÉ×ÁÅÔ ×ÏÚÍÏÖÎÏÓÔØ
	ÓÏÚÄÁÎÉÑ ÔÕÎÎÅÌÑ ÄÌÑ ÐÒÏÐÕÓËÁ ÓÏÅÄÉÎÅÎÉÑ ÐÏ ÄÒÕÇÏÍÕ ÐÒÏÔÏËÏÌÕ
	ÞÅÒÅÚ ÚÁÝÉÝÅÎÎÕÀ ÓÅÓÓÉÀ.</para>

      <para>óÌÅÄÕÀÝÁÑ ËÏÍÁÎÄÁ ÕËÁÚÙ×ÁÅÔ &man.ssh.1; ÓÏÚÄÁÔØ ÔÕÎÎÅÌØ ÄÌÑ
	<application>telnet</application>:</para>

       <screen>&prompt.user; <userinput>ssh -2 -N -f -L <replaceable>5023:localhost:23 user@foo.example.com</replaceable></userinput>
&prompt.user;</screen>

      <para>ëÏÍÁÎÄÁ <command>ssh</command> ÉÓÐÏÌØÚÕÅÔÓÑ ÓÏ ÓÌÅÄÕÀÝÉÍÉ
	ÐÁÒÁÍÅÔÒÁÍÉ:</para>

      <variablelist>
	<varlistentry>
	  <term><option>-2</option></term>

	  <listitem>
	    <para>õËÁÚÙ×ÁÅÔ <command>ssh</command> ÉÓÐÏÌØÚÏ×ÁÔØ ×ÅÒÓÉÀ
	      2 ÐÒÏÔÏËÏÌÁ (ÎÅ ÉÓÐÏÌØÚÕÊÔÅ ÜÔÏÔ ÐÁÒÁÍÅÔÒ, ÅÓÌÉ ÒÁÂÏÔÁÅÔÅ
	      ÓÏ ÓÔÁÒÙÍÉ SSH ÓÅÒ×ÅÒÁÍÉ).</para>
	  </listitem>
	</varlistentry>

	<varlistentry>
	  <term><option>-N</option></term>

	  <listitem>
	    <para>ïÚÎÁÞÁÅÔ ÉÓÐÏÌØÚÏ×ÁÎÉÅ × ÎÅ-ËÏÍÁÎÄÎÏÍ ÒÅÖÉÍÅ, ÔÏÌØËÏ ÄÌÑ
	      ÔÕÎÎÅÌÉÒÏ×ÁÎÉÑ.  åÓÌÉ ÜÔÏÔ ÐÁÒÁÍÅÔÒ ÏÐÕÝÅÎ,
	      <command>ssh</command> ÚÁÐÕÓÔÉÔ ÏÂÙÞÎÕÀ ÓÅÓÓÉÀ.</para>
	  </listitem>
	</varlistentry>

	<varlistentry>
	  <term><option>-f</option></term>

	  <listitem>
	    <para>õËÁÚÙ×ÁÅÔ <command>ssh</command> ÚÁÐÕÓËÁÔØÓÑ × ÆÏÎÏ×ÏÍ
	      ÒÅÖÉÍÅ.</para>
	  </listitem>
	</varlistentry>

	<varlistentry>
	  <term><option>-L</option></term>

	  <listitem>
	    <para>ïÚÎÁÞÁÅÔ ÌÏËÁÌØÎÙÊ ÔÕÎÎÅÌØ × ÓÔÉÌÅ
	      <replaceable>localport:remotehost:remoteport</replaceable>.</para>
	  </listitem>
	  </varlistentry>

	<varlistentry>
	  <term><option>user@foo.example.com</option></term>

	  <listitem>
	    <para>õÄÁÌÅÎÎÙÊ ÓÅÒ×ÅÒ SSH.</para>
	  </listitem>
	</varlistentry>
      </variablelist>


      <para>ôÕÎÎÅÌØ SSH ÓÏÚÄÁÅÔÓÑ ÐÕÔÅÍ ÓÏÚÄÁÎÉÑ ÐÒÏÓÌÕÛÉ×ÁÀÝÅÇÏ ÓÏËÅÔÁ
	ÎÁ ÏÐÒÅÄÅÌÅÎÎÏÍ ÐÏÒÔÕ <hostid>localhost</hostid>.  úÁÔÅÍ ×ÓÅ
	ÐÒÉÎÑÔÙÅ ÎÁ ÌÏËÁÌØÎÏÍ ÈÏÓÔÕ/ÐÏÒÔÕ ÓÏÅÄÉÎÅÎÉÑ ÐÅÒÅÐÒÁ×ÌÑÀÔÓÑ ÎÁ
	ÞÅÒÅÚ SSH ÎÁ ÏÐÒÅÄÅÌÅÎÎÙÊ ÕÄÁÌÅÎÎÙÊ ÈÏÓÔ É ÐÏÒÔ.</para>

      <para>÷ ÜÔÏÍ ÐÒÉÍÅÒÅ, ÐÏÒÔ <replaceable>5023</replaceable> ÎÁ
	<hostid>localhost</hostid> ÐÅÒÅÎÁÐÒÁ×ÌÑÅÔÓÑ ÎÁ ÐÏÒÔ
	<replaceable>23</replaceable> ÎÁ <hostid>localhost</hostid>
	ÕÄÁÌÅÎÎÏÇÏ ËÏÍÐØÀÔÅÒÁ.  ðÏÓËÏÌØËÕ <replaceable>23</replaceable>
	ÜÔÏ ÐÏÒÔ <application>telnet</application>, ÂÕÄÅÔ ÓÏÚÄÁÎÏ ÚÁÝÉÝÅÎÎÏÅ
	ÓÏÅÄÉÎÅÎÉÅ <application>telnet</application> ÞÅÒÅÚ ÔÕÎÎÅÌØ
	SSH.</para>

      <para>üÔÏÔ ÍÅÔÏÄ ÍÏÖÎÏ ÉÓÐÏÌØÚÏ×ÁÔØ ÄÌÑ ÌÀÂÏÇÏ ÞÉÓÌÁ ÎÅÂÅÚÏÐÁÓÎÙÈ
	ÐÒÏÔÏËÏÌÏ×, ÔÁËÉÈ ËÁË SMTP, POP3, FTP, É ÔÁË ÄÁÌÅÅ.</para>

      <example>
	<title>éÓÐÏÌØÚÏ×ÁÎÉÅ SSH ÄÌÑ ÓÏÚÄÁÎÉÑ ÚÁÝÉÝÅÎÎÏÇÏ ÔÕÎÎÅÌÑ ÎÁ
	  SMTP</title>

	<screen>&prompt.user; <userinput>ssh -2 -N -f -L <replaceable>5025:localhost:25 user@mailserver.example.com</replaceable></userinput>
user@mailserver.example.com's password: <userinput>*****</userinput>
&prompt.user; <userinput>telnet localhost 5025</userinput>
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 mailserver.example.com ESMTP</screen>

	<para>üÔÏÔ ÍÅÔÏÄ ÍÏÖÎÏ ÉÓÐÏÌØÚÏ×ÁÔØ ×ÍÅÓÔÅ Ó &man.ssh-keygen.1;
	  É ÄÏÐÏÌÎÉÔÅÌØÎÙÍÉ ÐÏÌØÚÏ×ÁÔÅÌØÓËÉÍÉ ÕÞ£ÔÎÙÍÉ ÚÁÐÉÓÑÍÉ ÄÌÑ
	  ÓÏÚÄÁÎÉÑ ÂÏÌÅÅ ÕÄÏÂÎÏÇÏ Á×ÔÏÍÁÔÉÞÅÓËÏÇÏ SSH ÔÕÎÎÅÌÉÒÏ×ÁÎÉÑ.
	  ëÌÀÞÉ ÍÏÇÕÔ ÂÙÔØ ÉÓÐÏÌØÚÏ×ÁÎÙ ×ÍÅÓÔÏ ÐÁÒÏÌÅÊ, É ÔÕÎÎÅÌÉ
	  ÍÏÇÕÔ ÚÁÐÕÓËÁÔØÓÑ ÏÔ ÏÔÄÅÌØÎÙÈ ÐÏÌØÚÏ×ÁÔÅÌÅÊ.</para>
      </example>

      <sect3>
	<title>ðÒÁËÔÉÞÅÓËÉÅ ÐÒÉÍÅÒÙ SSH ÔÕÎÎÅÌÉÒÏ×ÁÎÉÑ</title>

	<sect4>
	  <title>úÁÝÉÝÅÎÎÙÊ ÄÏÓÔÕÐ Ë ÓÅÒ×ÅÒÕ POP3</title>

	  <para>îÁ ÒÁÂÏÔÅ ÎÁÈÏÄÉÔÓÑ SSH ÓÅÒ×ÅÒ, ÐÒÉÎÉÍÁÀÝÉÊ ÓÏÅÄÉÎÅÎÉÑ
	    ÓÎÁÒÕÖÉ.  ÷ ÜÔÏÊ ÖÅ ÏÆÉÓÎÏÊ ÓÅÔÉ ÎÁÈÏÄÉÔÓÑ ÐÏÞÔÏ×ÙÊ ÓÅÒ×ÅÒ,
	    ÐÏÄÄÅÒÖÉ×ÁÀÝÉÊ ÐÒÏÔÏËÏÌ POP3.  óÅÔØ ÉÌÉ ÓÅÔÅ×ÏÅ ÓÏÅÄÉÎÅÎÉÅ
	    ÍÅÖÄÕ ×ÁÛÉÍ ÄÏÍÏÍ É ÏÆÉÓÏÍ ÍÏÇÕÔ ÂÙÔØ ÉÌÉ ÎÅ ÂÙÔØ ÐÏÌÎÏÓÔØÀ
	    ÄÏ×ÅÒÑÅÍÙÍÉ.  ðÏ ÜÔÏÊ ÐÒÉÞÉÎÅ ×ÁÍ ÐÏÔÒÅÂÕÅÔÓÑ ÐÒÏ×ÅÒÑÔØ
	    ÐÏÞÔÕ ÞÅÒÅÚ ÚÁÝÉÝÅÎÎÏÅ ÓÏÅÄÉÎÅÎÉÅ.  òÅÛÅÎÉÅ ÓÏÓÔÏÉÔ × ÓÏÚÄÁÎÉÉ
	    SSH ÓÏÅÄÉÎÅÎÉÑ Ë ÏÆÉÓÎÏÍÕ ÓÅÒ×ÅÒÕ SSH É ÔÕÎÎÅÌÉÒÏ×ÁÎÉÅ
	    ÞÅÒÅÚ ÎÅÇÏ Ë ÐÏÞÔÏ×ÏÍÕ ÓÅÒ×ÅÒÕ.</para>

	  <screen>&prompt.user; <userinput>ssh -2 -N -f -L <replaceable>2110:mail.example.com:110 user@ssh-server.example.com</replaceable></userinput>
user@ssh-server.example.com's password: <userinput>******</userinput></screen>

	  <para>ëÏÇÄÁ ÔÕÎÎÅÌØ ×ËÌÀÞÅÎ É ÒÁÂÏÔÁÅÔ, ×Ù ÍÏÖÅÔÅ ÎÁÓÔÒÏÉÔØ
	    ÐÏÞÔÏ×ÙÊ ËÌÉÅÎÔ ÄÌÑ ÏÔÐÒÁ×ËÉ ÚÁÐÒÏÓÏ× POP3 ÎÁ
	    <hostid>localhost</hostid>, ÐÏÒÔ 2110.  óÏÅÄÉÎÅÎÉÅ ÂÕÄÅÔ
	    ÂÅÚÏÐÁÓÎÏ ÐÅÒÅÐÒÁ×ÌÅÎÏ ÞÅÒÅÚ ÔÕÎÎÅÌØ ÎÁ
	    <hostid>mail.example.com</hostid>.</para>
	</sect4>

	<sect4>
	  <title>ðÒÏÈÏÖÄÅÎÉÅ ÞÅÒÅÚ äÒÁËÏÎÏ×ÓËÉÊ âÒÁÎÄÍÁÕÜÒ</title>

	  <para>îÅËÏÔÏÒÙÅ ÓÅÔÅ×ÙÅ ÁÄÍÉÎÉÓÔÒÁÔÏÒÙ ÕÓÔÁÎÁ×ÌÉ×ÁÀÔ
	    ÎÁ ÂÒÁÎÄÍÁÕÜÒÁÈ ÄÒÁËÏÎÏ×ÓËÉÅ ÐÒÁ×ÉÌÁ,
	    ÆÉÌØÔÒÕÑ ÎÅ ÔÏÌØËÏ ×ÈÏÄÑÝÉÅ ÓÏÅÄÉÎÅÎÉÑ, ÎÏ É ÉÓÈÏÄÑÝÉÅ.
	    ÷ÁÍ ÍÏÖÅÔ ÂÙÔØ ÒÁÚÒÅÛÅÎ ÄÏÓÔÕÐ Ë ÕÄÁÌÅÎÎÙÍ ËÏÍÐØÀÔÅÒÁÍ ÔÏÌØËÏ
	    ÐÏ ÐÏÒÔÁÍ 22 É 80, ÄÌÑ SSH É ÐÒÏÓÍÏÔÒÁ ÓÁÊÔÏ×.</para>

	  <para>÷ÁÍ ÍÏÖÅÔ ÐÏÔÒÅÂÏ×ÁÔØÓÑ ÄÏÓÔÕÐ Ë ÄÒÕÇÏÍÕ (×ÏÚÍÏÖÎÏ, ÎÅ
	    ÏÔÎÏÓÑÝÅÍÕÓÑ Ë ÒÁÂÏÔÅ) ÓÅÒ×ÉÓÕ, ÔÁËÏÍÕ ËÁË Ogg Vorbis
	    ÄÌÑ ÐÒÏÓÌÕÛÉ×ÁÎÉÑ ÍÕÚÙËÉ.  åÓÌÉ ÜÔÏÔ ÓÅÒ×ÅÒ Ogg Vorbis
	    ×ÙÄÁÅÔ ÐÏÔÏË ÎÅ Ó ÐÏÒÔÏ× 22 ÉÌÉ 80, ×Ù ÎÅ ÓÍÏÖÅÔÅ ÐÏÌÕÞÉÔØ
	    Ë ÎÅÍÕ ÄÏÓÔÕÐ.</para>

	  <para>òÅÛÅÎÉÅ ÓÏÓÔÏÉÔ × ÓÏÚÄÁÎÉÉ SSH ÓÏÅÄÉÎÅÎÉÑ Ó ËÏÍÐØÀÔÅÒÏÍ
	    ×ÎÅ ÂÒÁÎÄÍÁÕÜÒÁ É ÉÓÐÏÌØÚÏ×ÁÎÉÅ ÅÇÏ ÄÌÑ ÔÕÎÎÅÌÉÒÏ×ÁÎÉÑ
	    ÓÅÒ×ÅÒÁ Ogg Vorbis.</para>

	  <screen>&prompt.user; <userinput>ssh -2 -N -f -L <replaceable>8888:music.example.com:8000 user@unfirewalled-system.example.org</replaceable></userinput>
user@unfirewalled-system.example.org's password: <userinput>*******</userinput></screen>

	  <para>ëÌÉÅÎÔÓËÕÀ ÐÒÏÇÒÁÍÍÕ ÔÅÐÅÒØ ÍÏÖÎÏ ÎÁÓÔÒÏÉÔØ ÎÁ
	    <hostid>localhost</hostid> ÐÏÒÔ 8888, ËÏÔÏÒÙÊ ÂÕÄÅÔ ÐÅÒÅÎÁÐÒÁ×ÌÅÎ
	    ÎÁ <hostid>music.example.com</hostid> ÐÏÒÔ 8000, ÕÓÐÅÛÎÏ
	    ÏÂÏÊÄÑ ÂÒÁÎÄÍÁÕÜÒ.</para>
	</sect4>
      </sect3>
    </sect2>

    <sect2>
      <title>ðÁÒÁÍÅÔÒ ÏÇÒÁÎÉÞÅÎÉÑ ÐÏÌØÚÏ×ÁÔÅÌÅÊ
	<varname>AllowUsers</varname></title>

      <para>úÁÞÁÓÔÕÀ ÈÏÒÏÛÉÅ ÒÅÚÕÌØÔÁÔÙ ÄÁ£Ô ÏÇÒÁÎÉÞÅÎÉÅ ÔÏÇÏ, ËÁËÉÅ
	ÉÍÅÎÎÏ ÐÏÌØÚÏ×ÁÔÅÌÉ É ÏÔËÕÄÁ ÍÏÇÕÔ ÒÅÇÉÓÔÒÉÒÏ×ÁÔØÓÑ × ÓÉÓÔÅÍÅ.
	úÁÄÁÎÉÅ ÐÁÒÁÍÅÔÒÁ <literal>AllowUsers</literal> Ñ×ÌÑÅÔÓÑ ÈÏÒÏÛÉÍ
	ÓÐÏÓÏÂÏÍ ÄÏÂÉÔØÓÑ ÜÔÏÇÏ.  ë ÐÒÉÍÅÒÕ, ÄÌÑ ÒÁÚÒÅÛÅÎÉÑ ÒÅÇÉÓÔÒÁÃÉÉ ÔÏÌØËÏ
	ÐÏÌØÚÏ×ÁÔÅÌÀ <username>root</username> Ó ÍÁÛÉÎÙ <hostid
	role="ipaddr">192.168.1.32</hostid>, × ÆÁÊÌÅ
	<filename>/etc/ssh/sshd_config</filename> ÎÕÖÎÏ ÕËÁÚÁÔØ ÎÅÞÔÏ ×ÒÏÄÅ
	ÓÌÅÄÕÀÝÅÇÏ:</para>

      <programlisting>AllowUsers root@192.168.1.32</programlisting>

      <para>äÌÑ ÒÁÚÒÅÛÅÎÉÑ ÒÅÇÉÓÔÒÁÃÉÉ ÐÏÌØÚÏ×ÁÔÅÌÑ <username>admin</username>
	ÉÚ ÌÀÂÏÊ ÔÏÞËÉ, ÐÒÏÓÔÏ ÕËÁÖÉÔÅ ÉÍÑ ÐÏÌØÚÏ×ÁÔÅÌÑ:</para>

      <programlisting>AllowUsers admin</programlisting>

      <para>îÅÓËÏÌØËÏ ÐÏÌØÚÏ×ÁÔÅÌÅÊ ÄÏÌÖÎÙ ÐÅÒÅÞÉÓÌÑÔØ × ÏÄÎÏÊ ÓÔÒÏËÅ, ËÁË
	ÚÄÅÓØ:</para>

      <programlisting>AllowUsers root@192.168.1.32 admin</programlisting>

      <note>
	<para>÷ÁÖÎÏ, ÞÔÏÂÙ ÂÙ ÐÅÒÅÞÉÓÌÉÌÉ ×ÓÅÈ ÐÏÌØÚÏ×ÁÔÅÌÅÊ, ËÏÔÏÒÙÅ ÄÏÌÖÎÙ
	  ÒÅÇÉÓÔÒÉÒÏ×ÁÔØÓÑ ÎÁ ÜÔÏÊ ÍÁÛÉÎÅ; × ÐÒÏÔÉ×ÎÏÍ ÓÌÕÞÁÅ ÏÎÉ ÂÕÄÕÔ
	  ÚÁÂÌÏËÉÒÏ×ÁÎÙ.</para>
      </note>

      <para>ðÏÓÌÅ ×ÎÅÓÅÎÉÑ ÉÚÍÅÎÅÎÉÊ ×
	<filename>/etc/ssh/sshd_config</filename> ×Ù ÄÏÌÖÎÙ ÕËÁÚÁÔØ
	&man.sshd.8; ÎÁ ÐÏ×ÔÏÒÎÕÀ ÚÁÇÒÕÚËÕ ËÏÎÆÉÇÕÒÁÃÉÏÎÎÙÈ ÆÁÊÌÏ×, ×ÙÐÏÌÎÉ×
	ÓÌÅÄÕÀÝÕÀ ËÏÍÁÎÄÕ:</para>

      <screen>&prompt.root; <userinput>/etc/rc.d/sshd reload</userinput></screen>
    </sect2>

    <sect2>
      <title>äÏÐÏÌÎÉÔÅÌØÎÁÑ ÌÉÔÅÒÁÔÕÒÁ</title>

      <para><ulink url="http://www.openssh.com/">OpenSSH</ulink></para>

      <para>&man.ssh.1; &man.scp.1; &man.ssh-keygen.1;
	&man.ssh-agent.1; &man.ssh-add.1; &man.ssh.config.5;</para>

      <para>&man.sshd.8; &man.sftp-server.8; &man.sshd.config.5;</para>
    </sect2>
  </sect1>

  <sect1 id="fs-acl">
    <sect1info>
      <authorgroup>
	<author>
	  <firstname>Tom</firstname>
	  <surname>Rhodes</surname>
	  <contrib>ðÒÅÄÏÓÔÁ×ÉÌ </contrib>
	</author>
      </authorgroup>
    </sect1info>
    <indexterm>
      <primary>ACL</primary>
    </indexterm>
    <title>óÐÉÓËÉ ËÏÎÔÒÏÌÑ ÄÏÓÔÕÐÁ ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÙ (ACL)</title>

    <para>÷ ÄÏÐÏÌÎÅÎÉÅ Ë ÄÒÕÇÉÍ ÒÁÓÛÉÒÅÎÉÑÍ ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÙ, ÔÁËÉÍ ËÁË
      ÓÎÉÍËÉ (snapshots), FreeBSD 5.0 É ÂÏÌÅÅ ÐÏÚÄÎÉÅ ×ÅÒÓÉÉ ÓÉÓÔÅÍÙ
      ÐÒÅÄÌÁÇÁÀÔ ÚÁÝÉÔÕ Ó ÐÏÍÏÝØÀ ÓÐÉÓËÏ× ËÏÎÔÒÏÌÑ ÄÏÓÔÕÐÁ ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÙ
      (File System Access Control Lists, <acronym>ACLs</acronym>).</para>

    <para>óÐÉÓËÉ ËÏÎÔÒÏÌÑ ÄÏÓÔÕÐÁ ÒÁÓÛÉÒÑÀÔ ÓÔÁÎÄÁÒÔÎÕÀ ÍÏÄÅÌØ ÐÒÁ× &unix;
      ×ÙÓÏËÏ ÓÏ×ÍÅÓÔÉÍÙÍ (&posix;.1e) ÓÐÏÓÏÂÏÍ.  üÔÁ ×ÏÚÍÏÖÎÏÓÔØ ÐÏÚ×ÏÌÑÅÔ
      ÁÄÍÉÎÉÓÔÒÁÔÏÒÕ ÐÏÌÕÞÉÔØ ÐÒÅÉÍÕÝÅÓÔ×Ï ÏÔ ÉÓÐÏÌØÚÏ×ÁÎÉÑ ÂÏÌÅÅ
      ÉÎÔÅÌÌÅËÔÕÁÌØÎÏÊ ÍÏÄÅÌÉ ÂÅÚÏÐÁÓÎÏÓÔÉ.</para>

    <para>äÌÑ ×ËÌÀÞÅÎÉÑ ÐÏÄÄÅÒÖËÉ <acronym>ACL</acronym> × ÆÁÊÌÏ×ÏÊ
      ÓÉÓÔÅÍÅ <acronym>UFS</acronym>, ÓÌÅÄÕÀÝÁÑ ÓÔÒÏËÁ:</para>

    <programlisting>options UFS_ACL</programlisting>

    <para>ÄÏÌÖÎÁ ÂÙÔØ ÄÏÂÁ×ÌÅÎÁ × ÆÁÊÌ ÎÁÓÔÒÏÊËÉ ÑÄÒÁ.  åÓÌÉ ÐÁÒÁÍÅÔÒ ÎÅ
      ÄÏÂÁ×ÌÅÎ, ÐÒÉ ÐÏÐÙÔËÅ ÍÏÎÔÉÒÏ×ÁÎÉÑ ÓÉÓÔÅÍ, ÐÏÄÄÅÒÖÉ×ÁÀÝÉÈ
      <acronym>ACL</acronym>, ÐÏÑ×ÉÔÓÑ ÐÒÅÄÕÐÒÅÖÄÁÀÝÅÅ ÓÏÏÂÝÅÎÉÅ.
      üÔÏÔ ÐÁÒÁÍÅÔÒ ×ËÌÀÞÅÎ × ÑÄÒÏ <filename>GENERIC</filename>.
      <acronym>ACL</acronym> ÏÓÎÏ×Ù×ÁÅÔÓÑ ÎÁ ÄÏÐÏÌÎÉÔÅÌØÎÙÈ ÁÔÒÉÂÕÔÁÈ,
      ×ÓÔÒÏÅÎÎÙÈ × ÆÁÊÌÏ×ÕÀ ÓÉÓÔÅÍÕ.  äÏÐÏÌÎÉÔÅÌØÎÙÅ ÁÔÒÉÂÕÔÙ
      ÐÏÄÄÅÒÖÉ×ÁÀÔÓÑ ÐÏ ÕÍÏÌÞÁÎÉÀ ÓÌÅÄÕÀÝÉÍ ÐÏËÏÌÅÎÉÅÍ ÆÁÊÌÏ×ÙÈ ÓÉÓÔÅÍ
      &unix;, <acronym>UFS2</acronym>.</para>

    <note><para>äÌÑ ×ËÌÀÞÅÎÉÑ ÄÏÐÏÌÎÉÔÅÌØÎÙÈ ÁÔÒÉÂÕÔÏ× ×
      <acronym>UFS1</acronym> ÔÒÅÂÕÅÔÓÑ ÂÏÌØÛÅ ÕÓÉÌÉÊ ÐÏ ÓÒÁ×ÎÅÎÉÀ Ó
      <acronym>UFS2</acronym>.  ðÒÏÉÚ×ÏÄÉÔÅÌØÎÏÓÔØ ÄÏÐÏÌÎÉÔÅÌØÎÙÈ
      ÁÔÒÉÂÕÔÏ× × <acronym>UFS2</acronym> ÔÁËÖÅ ÓÕÝÅÓÔ×ÅÎÎÏ ×ÙÛÅ.
      ðÏ ÜÔÉÍ ÐÒÉÞÉÎÁÍ ÄÌÑ ÒÁÂÏÔÙ Ó ÓÐÉÓËÁÍÉ ËÏÎÔÒÏÌÑ ÄÏÓÔÕÐÁ
      ÐÒÅÄÐÏÞÔÉÔÅÌØÎÏ ÉÓÐÏÌØÚÏ×ÁÎÉÅ <acronym>UFS2</acronym></para></note>

    <para><acronym>ACL</acronym> ×ËÌÀÞÁÀÔÓÑ ×Ï ×ÒÅÍÑ ÍÏÎÔÉÒÏ×ÁÎÉÑ ÆÌÁÇÏÍ
      <option>acls</option>, ËÏÔÏÒÙÊ ÄÏÂÁ×ÌÑÅÔÓÑ Ë
      <filename>/etc/fstab</filename>.  üÔÏÔ ÆÌÁÇ ÔÁËÖÅ ÍÏÖÎÏ ÓÄÅÌÁÔØ
      ÐÏÓÔÏÑÎÎÙÍ Ó ÐÏÍÏÝØÀ &man.tunefs.8;, ÉÚÍÅÎÉ× ÆÌÁÇ
      <acronym>ACL</acronym> × ÚÁÇÏÌÏ×ËÅ ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÙ.  ÷ÏÏÂÝÅ ÇÏ×ÏÒÑ,
      ÉÓÐÏÌØÚÏ×ÁÎÉÅ ÆÌÁÇÁ × ÓÕÐÅÒÂÌÏËÅ ÐÒÅÄÐÏÞÔÉÔÅÌØÎÏ ÐÏ ÎÅÓËÏÌØËÉÍ
      ÐÒÉÞÉÎÁÍ:</para>

    <itemizedlist>
      <listitem>
	<para>ðÏÓÔÏÑÎÎÙÊ <acronym>ACL</acronym> ÆÌÁÇ ÎÅ ÍÏÖÅÔ ÂÙÔØ ÉÚÍÅÎÅÎ
	  ÐÕÔÅÍ ÐÅÒÅÍÏÎÔÉÒÏ×ÁÎÉÑ ÓÉÓÔÅÍÙ (&man.mount.8; <option>-u</option>),
	  Á ÔÏÌØËÏ ÞÅÒÅÚ &man.umount.8; É &man.mount.8;.  üÔÏ ÏÚÎÁÞÁÅÔ,
	  ÞÔÏ <acronym>ACL</acronym> ÎÅÌØÚÑ ×ËÌÀÞÉÔØ ÎÁ ËÏÒÎÅ×ÏÊ ÆÁÊÌÏ×ÏÊ
	  ÓÉÓÔÅÍÅ ÐÏÓÌÅ ÚÁÇÒÕÚËÉ.  üÔÏ ÔÁËÖÅ ÏÚÎÁÞÁÅÔ, ÞÔÏ ×Ù ÎÅ ÍÏÖÅÔÅ
	  ÉÚÍÅÎÉÔØ ÆÌÁÇ ÎÁ ÉÓÐÏÌØÚÕÅÍÏÊ ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÅ.</para>
      </listitem>

      <listitem>
	<para>õÓÔÁÎÏ×ËÁ ÆÌÁÇÁ × ÓÕÐÅÒÂÌÏËÅ ÐÒÉ×ÏÄÉÔ Ë ÐÏÓÔÏÑÎÎÏÍÕ ÍÏÎÔÉÒÏ×ÁÎÉÀ
	  ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÙ Ó ×ËÌÀÞÅÎÎÙÍ <acronym>ACL</acronym>, ÄÁÖÅ ÅÓÌÉ
	  ÎÅÔ ÚÁÐÉÓÉ × <filename>fstab</filename> ÉÌÉ ÐÒÉ ÓÍÅÎÅ ÐÏÒÑÄËÁ
	  ÕÓÔÒÏÊÓÔ×.  üÔÏ ÐÒÅÄÏÔ×ÒÁÝÁÅÔ ÓÌÕÞÁÊÎÏÅ ÍÏÎÔÉÒÏ×ÁÎÉÅ ÆÁÊÌÏ×ÏÊ
	  ÓÉÓÔÅÍÙ ÂÅÚ <acronym>ACL</acronym>, ËÏÔÏÒÏÅ ÍÏÖÅÔ ÐÏ×ÌÅÞØ ÚÁ
	  ÓÏÂÏÊ ÐÒÏÂÌÅÍÙ Ó ÂÅÚÏÐÁÓÎÏÓÔØÀ.</para>
      </listitem>
    </itemizedlist>

    <note><para>íÙ ÍÏÖÅÍ ÉÚÍÅÎÉÔØ ÐÏ×ÅÄÅÎÉÅ <acronym>ACL</acronym> ÄÌÑ
	×ËÌÀÞÅÎÉÑ ÆÌÁÇÁ ÂÅÚ ÐÏÌÎÏÇÏ ÐÅÒÅÍÏÎÔÉÒÏ×ÁÎÉÑ, ÎÏ ÓÞÉÔÁÅÍ, ÞÔÏ
	ÖÅÌÁÔÅÌØÎÏ ÉÓËÌÀÞÉÔØ ÓÌÕÞÁÊÎÏÅ ÍÏÎÔÉÒÏ×ÁÎÉÅ ÂÅÚ
	<acronym>ACL</acronym>, ÐÏÓËÏÌØËÕ ×Ù ÍÏÖÅÔÅ ÐÏÐÁÓÔØ × ÎÅÐÒÉÑÔÎÕÀ
	ÓÉÔÕÁÃÉÀ, ÅÓÌÉ ×ËÌÀÞÉÔÅ <acronym>ACL</acronym>, ÚÁÔÅÍ ×ÙËÌÀÞÉÔÅ
	ÉÈ, ÚÁÔÅÍ ÏÐÑÔØ ×ËÌÀÞÉÔÅ ÂÅÚ ÓÂÒÏÓÁ ÒÁÓÛÉÒÅÎÎÙÈ ÁÔÒÉÂÕÔÏ×.
	ïÂÙÞÎÏ, ËÁË ÔÏÌØËÏ ×Ù ×ËÌÀÞÉÌÉ <acronym>ACL</acronym> × ÆÁÊÌÏ×ÏÊ
	ÓÉÓÔÅÍÅ, ÏÎÉ ÎÅ ÄÏÌÖÎÙ ÂÙÔØ ×ÙËÌÀÞÅÎÙ, ÐÏÓËÏÌØËÕ ÐÏÌÕÞÁÀÝÁÑÓÑ
	ÚÁÝÉÔÁ ÆÁÊÌÏ× ÍÏÖÅÔ ÂÙÔØ ÎÅ ÓÏ×ÍÅÓÔÉÍÁ Ó ÔÏÊ, ÞÔÏ ÐÒÉÍÅÎÑÅÔÓÑ
	ÐÏÌØÚÏ×ÁÔÅÌÑÍÉ ÓÉÓÔÅÍÙ, É ÐÏ×ÔÏÒÎÏÅ ×ËÌÀÞÅÎÉÅ <acronym>ACL</acronym>
	ÍÏÖÅÔ ÐÏÄËÌÀÞÉÔØ ÐÒÅÄÙÄÕÝÉÅ ÓÐÉÓËÉ ËÏÎÔÒÏÌÑ ÄÏÓÔÕÐÁ Ë ÆÁÊÌÁÍ,
	ÐÒÁ×Á ÎÁ ËÏÔÏÒÙÅ ÉÚÍÅÎÅÎÙ, ÞÔÏ ÐÒÉ×ÅÄÅÔ Ë ÎÅÐÒÅÄÓËÁÚÕÅÍÏÍÕ
	ÐÏ×ÅÄÅÎÉÀ.</para></note>

    <para>æÁÊÌÏ×ÙÅ ÓÉÓÔÅÍÙ Ó ×ËÌÀÞÅÎÎÙÍÉ <acronym>ACLs</acronym> ÐÏËÁÚÙ×ÁÀÔ
      ÚÎÁË <literal>+</literal> ÐÒÉ ÐÒÏÓÍÏÔÒÅ ÐÒÁ× ÎÁ ÆÁÊÌÙ.
      îÁÐÒÉÍÅÒ:</para>

    <programlisting>drwx------  2 robert  robert  512 Dec 27 11:54 private
drwxrwx---+ 2 robert  robert  512 Dec 23 10:57 directory1
drwxrwx---+ 2 robert  robert  512 Dec 22 10:20 directory2
drwxrwx---+ 2 robert  robert  512 Dec 27 11:57 directory3
drwxr-xr-x  2 robert  robert  512 Nov 10 11:54 public_html</programlisting>

    <para>úÄÅÓØ ÍÙ ×ÉÄÉÍ, ÞÔÏ ËÁÔÁÌÏÇÉ <filename>directory1</filename>,
      <filename>directory2</filename>, É <filename>directory3</filename>
      ÉÓÐÏÌØÚÕÀÔ ÐÒÅÉÍÕÝÅÓÔ×Á <acronym>ACL</acronym>.  ëÁÔÁÌÏÇ
      <filename>public_html</filename> ÉÈ ÎÅ ÉÓÐÏÌØÚÕÅÔ.</para>

    <sect2>
      <title>éÓÐÏÌØÚÏ×ÁÎÉÅ <acronym>ACL</acronym></title>

      <para><acronym>ACL</acronym> ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÙ ÍÏÖÎÏ ÐÒÏÓÍÏÔÒÅÔØ
	Ó ÐÏÍÏÝØÀ ÕÔÉÌÉÔÙ &man.getfacl.1;.  îÁÐÒÉÍÅÒ, ÄÌÑ ÐÒÏÓÍÏÔÒÁ
	ÎÁÓÔÒÏÅË <acronym>ACL</acronym> ÆÁÊÌÁ
	<filename>test</filename>, ÍÏÖÅÔ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ ËÏÍÁÎÄÁ:</para>

      <screen>&prompt.user; <userinput>getfacl <filename>test</filename></userinput>
        #file:test
        #owner:1001
        #group:1001
        user::rw-
        group::r--
        other::r--</screen>

      <para>äÌÑ ÉÚÍÅÎÅÎÉÑ <acronym>ACL</acronym> ÜÔÏÇÏ ÆÁÊÌÁ,
	×ÙÚÏ×ÉÔÅ ÕÔÉÌÉÔÕ &man.setfacl.1;.  ÷ÙÐÏÌÎÉÔÅ:</para>

      <screen>&prompt.user; <userinput>setfacl -k <filename>test</filename></userinput></screen>

      <para>ðÁÒÁÍÅÔÒ <option>-k</option> ÕÄÁÌÉÔ ×ÓÅ ÕÓÔÁÎÏ×ÌÅÎÎÙÅ
	ÎÁ ÄÁÎÎÙÊ ÍÏÍÅÎÔ <acronym>ACL</acronym> ÉÚ ÆÁÊÌÁ ÉÌÉ ÆÁÊÌÏ×ÏÊ
	ÓÉÓÔÅÍÙ.  âÏÌÅÅ ÐÒÅÄÐÏÞÔÉÔÅÌØÎÙÊ ÍÅÔÏÄ ÜÔÏ ÉÓÐÏÌØÚÏ×ÁÎÉÅ
	ÐÁÒÁÍÅÔÒÁ <option>-b</option>, ËÏÔÏÒÙÊ ÏÓÔÁ×ÉÔ ÎÅÏÂÈÏÄÉÍÙÅ
	ÄÌÑ ÒÁÂÏÔÙ <acronym>ACL</acronym> ÐÏÌÑ.</para>

      <screen>&prompt.user; <userinput>setfacl -m u:trhodes:rwx,group:web:r--,o::--- <filename>test</filename></userinput></screen>

      <para>÷ ×ÙÛÅÐÒÉ×ÅÄÅÎÎÏÊ ËÏÍÁÎÄÅ ÐÁÒÁÍÅÔÒ <option>-m</option>
	ÉÓÐÏÌØÚÏ×ÁÎ ÄÌÑ ÉÚÍÅÎÅÎÉÑ ÚÁÐÉÓÅÊ <acronym>ACL</acronym>
	ÐÏ ÕÍÏÌÞÁÎÉÀ.  ðÏÓËÏÌØËÕ ÐÒÅÄÕÓÔÁÎÏ×ÌÅÎÎÙÈ ÚÁÐÉÓÅÊ ÎÅ ÂÙÌÏ (ÏÎÉ ÂÙÌÉ
	ÕÄÁÌÅÎÙ ÐÒÅÄÙÄÕÝÅÊ ËÏÍÁÎÄÏÊ), ÜÔÁ ËÏÍÁÎÄÁ ×ÏÓÓÔÁÎÏ×ÉÔ ÐÁÒÁÍÅÔÒÙ
	ÐÏ ÕÍÏÌÞÁÎÉÀ É ÚÁÄÁÓÔ ÐÒÉ×ÅÄÅÎÎÙÅ ÐÁÒÁÍÅÔÒÙ.  éÍÅÊÔÅ ××ÉÄÕ,
	ÐÒÉ ÄÏÂÁ×ÌÅÎÉÉ ÐÏÌØÚÏ×ÁÔÅÌÑ ÉÌÉ ÇÒÕÐÐÙ, ËÏÔÏÒÙÈ ÎÅÔ × ÓÉÓÔÅÍÅ,
	ÎÁ <devicename>stdout</devicename> ÂÕÄÅÔ ×Ù×ÅÄÅÎÁ ÏÛÉÂËÁ
	<errorname>Invalid argument</errorname>.</para>
    </sect2>
  </sect1>

  <sect1 id="security-portaudit">
    <sect1info>
      <authorgroup>
	<author>
	  <firstname>ôÏÍ</firstname>

	  <surname>òÏÄÅÓ</surname>

	  <contrib>ôÅËÓÔ ÐÒÅÄÏÓÔÁ×ÉÌ </contrib>
	</author>
      </authorgroup>
    </sect1info>

    <indexterm>
      <primary>Portaudit</primary>
    </indexterm>

    <title>íÏÎÉÔÏÒÉÎÇ ×ÏÐÒÏÓÏ× ÂÅÚÏÐÁÓÎÏÓÔÉ × ðï ÓÔÏÒÏÎÎÉÈ
      ÒÁÚÒÁÂÏÔÞÉËÏ×</title>

    <para>÷ ÐÏÓÌÅÄÎÉÅ ÇÏÄÙ × ÏÂÌÁÓÔÉ ÉÎÆÏÒÍÁÃÉÏÎÎÏÊ ÂÅÚÏÐÁÓÎÏÓÔÉ ÐÒÏÉÚÏÛÌÏ
      ÍÎÏÇÏ ÕÌÕÞÛÅÎÉÊ, ËÁÓÁÀÝÉÈÓÑ ×ÙÒÁÂÏÔËÉ ÏÃÅÎËÉ ÕÑÚ×ÉÍÏÓÔÉ.  õÇÒÏÚÁ
      ÐÒÏÎÉËÎÏ×ÅÎÉÑ × ÓÉÓÔÅÍÕ Õ×ÅÌÉÞÉ×ÁÅÔÓÑ ×ÍÅÓÔÅ Ó ÕÓÔÁÎÏ×ËÏÊ É ÎÁÓÔÒÏÊËÏÊ
      ÕÔÉÌÉÔ ÓÔÏÒÏÎÎÉÈ ÒÁÚÒÁÂÏÔÞÉËÏ×, ËÁËÏÊ ÂÙ ÓÏ×ÒÅÍÅÎÎÏÊ ÏÐÅÒÁÃÉÏÎÎÏÊ
      ÓÉÓÔÅÍÙ ÜÔÏ ÎÉ ËÁÓÁÌÏÓØ.</para>

    <para>ïÃÅÎËÁ ÕÑÚ×ÉÍÏÓÔÉ Ñ×ÌÑÅÔÓÑ ËÌÀÞÅ×ÙÍ ÆÁËÔÏÒÏÍ ÏÂÅÓÐÅÞÅÎÉÑ ÚÁÝÉÔÙ, É
      ÈÏÔÑ ÄÌÑ ÂÁÚÏ×ÏÇÏ ËÏÍÐÌÅËÔÁ &os; ×ÙÐÕÓËÁÀÔÓÑ ÂÀÌÌÅÔÅÎÉ ÂÅÚÏÐÁÓÎÏÓÔÉ, ÎÏ
      ÄÅÌÁÔØ ÜÔÏ ÄÌÑ ËÁÖÄÏÊ ÓÔÏÒÏÎÎÅÊ ÕÔÉÌÉÔÙ ×ÙÛÅ ×ÏÚÍÏÖÎÏÓÔÅÊ ÕÞÁÓÔÎÉËÏ×
      ðÒÏÅËÔÁ &os;.  óÕÝÅÓÔ×ÕÅÔ ÓÐÏÓÏ ÓÍÑÇÞÅÎÉÑ ÕÑÚ×ÉÍÏÓÔÅÊ ÐÒÏÇÒÁÍÍÎÏÇÏ
      ÏÂÅÓÐÅÞÅÎÉÑ ÓÔÏÒÏÎÎÉÈ ÒÁÚÒÁÂÏÔÞÉËÏ× É ÐÒÅÄÕÐÒÅÖÄÅÎÉÑ ÁÄÍÉÎÉÓÔÒÁÔÏÒÏ× ÏÂ
      ÉÚ×ÅÓÔÎÙÈ ÐÒÏÂÌÅÍÁÈ Ó ÂÅÚÏÐÁÓÎÏÓÔØÀ.  ÷Ï &os; ÓÕÝÅÓÔ×ÕÅÔ ÕÔÉÌÉÔÁ ÐÏÄ
      ÎÁÚ×ÁÎÉÅÍ <application>Portaudit</application>, ËÏÔÏÒÁÑ ÓÌÕÖÉÔ
      ÉÓËÌÀÞÉÔÅÌØÎÏ ÜÔÏÊ ÃÅÌÉ.</para>

    <para>ðÏÒÔ <filename role="port">security/portaudit</filename> ÏÂÒÁÝÁÅÔÓÑ
      Ë ÂÁÚÅ ÄÁÎÎÙÈ, ÏÂÎÏ×ÌÑÅÍÏÊ É ÐÏÄÄÅÒÖÉ×ÁÅÍÏÊ çÒÕÐÐÏÊ ÉÎÆÏÒÍÁÃÉÏÎÎÏÊ
      ÂÅÚÏÐÁÓÎÏÓÔÉ &os; É ÒÁÚÒÁÂÏÔÞÉËÁÍÉ ÐÏÒÔÏ×, ÄÌÑ ÐÏÌÕÞÅÎÉÑ ÉÎÆÏÒÍÁÃÉÉ ÏÂ
      ÉÚ×ÅÓÔÎÙÈ ÐÒÏÂÌÅÍÁÈ Ó ÚÁÝÉÔÏÊ.</para>

    <para>äÌÑ ÔÏÇÏ, ÞÔÏÂÙ ÐÒÉÓÔÕÐÉÔØ Ë ÉÓÐÏÌØÚÏ×ÁÎÉÀ
      <application>Portaudit</application>, ÎÅÏÂÈÏÄÉÍÏ ÕÓÔÁÎÏ×ÉÔØ ÅÇÏ ÉÚ
      ëÏÌÌÅËÃÉÉ ðÏÒÔÏ×:</para>

    <screen>&prompt.root; <userinput>cd /usr/ports/security/portaudit &amp;&amp; make install clean</userinput></screen>

    <para>÷ ÐÒÏÃÅÓÓÅ ÕÓÔÁÎÏ×ËÉ ÂÕÄÕÔ ÏÂÎÏ×ÌÅÎÙ ËÏÎÆÉÇÕÒÁÃÉÏÎÎÙÅ ÆÁÊÌÙ ÄÌÑ
      &man.periodic.8;, × ËÏÔÏÒÙÅ ÂÕÄÅÔ ÄÏÂÁ×ÌÅÎÁ ×ÙÄÁÞÁ
      <application>Portaudit</application> ÐÒÉ ÅÖÅÄÎÅ×ÎÏÍ Å£ ÚÁÐÕÓËÅ.
      ðÒÏ×ÅÒØÔÅ, ÞÔÏ ÅÖÅÄÎÅ×ÎÙÅ ÓÏÏÂÝÅÎÉÑ ÜÌÅËÔÒÏÎÎÏÊ ÐÏÞÔÙ, ËÁÓÁÀÝÉÅÓÑ
      ÂÅÚÏÐÁÓÎÏÓÔÉ, ËÏÔÏÒÙÅ ÐÏÓÙÌÁÀÔÓÑ ÎÁ ÁÄÒÅÓ <username>root</username>,
      ÐÒÏÞÉÔÙ×ÁÀÔÓÑ.  äÒÕÇÏÊ ÄÏÐÏÌÎÉÔÅÌØÎÏÊ ÎÁÓÔÒÏÊËÉ ÂÏÌØÛÅ ÎÅ
      ÐÏÎÁÄÏÂÉÔÓÑ.</para>

    <para>ðÏÓÌÅ ÕÓÔÁÎÏ×ËÉ ÁÄÍÉÎÉÓÔÒÁÔÏÒ ÍÏÖÅÔ ÏÂÎÏ×ÉÔØ ÂÁÚÕ ÄÁÎÎÙÈ
      É ÐÏÓÍÏÔÒÅÔØ ÓÐÉÓÏË ÉÚ×ÅÓÔÎÙÈ ÕÑÚ×ÉÍÏÓÔÅÊ × ÕÓÔÁÎÏ×ÌÅÎÎÙÈ ÐÁËÅÔÁÈ
      ÐÒÉ ÐÏÍÏÝÉ ËÏÍÁÎÄÙ</para>

    <screen>&prompt.root; <userinput>portaudit -Fda</userinput></screen>

    <note>
      <para>âÁÚÁ ÄÁÎÎÙÈ ÂÕÄÅÔ Á×ÔÏÍÁÔÉÞÅÓËÉ ÏÂÎÏ×ÌÅÎÁ ÐÒÉ ÚÁÐÕÓËÅ
	&man.periodic.8;; ÔÁËÉÍ ÏÂÒÁÚÏÍ, ÐÒÅÄÙÄÕÝÁÑ ËÏÍÁÎÄÕ ÍÏÖÎÏ ÐÏÌÎÏÓÔØÀ
	ÏÐÕÓÔÉÔØ.  ïÎÁ ÔÒÅÂÕÅÔÓÑ ÔÏÌØËÏ ÄÌÑ ÓÌÅÄÕÀÝÉÈ ÐÒÉÍÅÒÏ×.</para>
    </note>

    <para>äÌÑ ÁÕÄÉÔÁ ÕÔÉÌÉÔ ÓÔÏÒÏÎÎÉÈ ÒÁÚÒÁÂÏÔÞÉËÏ×, ÕÓÔÁÎÏ×ÌÅÎÎÙÈ ËÁË ÞÁÓÔØ
      ëÏÌÌÅËÃÉÉ ðÏÒÔÏ×, ÁÄÍÉÎÉÓÔÒÁÔÏÒÕ ÄÏÓÔÁÔÏÞÎÏ ÚÁÐÕÓËÁÔØ ÔÏÌØËÏ ÓÌÅÄÕÀÝÕÀ
      ËÏÍÁÎÄÕ:</para>

    <screen>&prompt.root; <userinput>portaudit -a</userinput></screen>

    <para>õÔÉÌÉÔÁ <application>portaudit</application> ×ÙÄÁÓÔ ÐÒÉÍÅÒÎÏ
      ÓÌÅÄÕÀÝÅÅ:</para>

    <programlisting>Affected package: cups-base-1.1.22.0_1
Type of problem: cups-base -- HPGL buffer overflow vulnerability.
Reference: &lt;http://www.FreeBSD.org/ports/portaudit/40a3bca2-6809-11d9-a9e7-0001020eed82.html&gt;

1 problem(s) in your installed packages found.

You are advised to update or deinstall the affected package(s) immediately.</programlisting>

    <para>ðÅÒÅÊÄÑ × Web-ÂÒÁÕÚÅÒÅ ÐÏ ÐÏËÁÚÁÎÎÏÍÕ <acronym>URL</acronym>,
      ÁÄÍÉÎÉÓÔÒÁÔÏÒ ÍÏÖÅÔ ÐÏÌÕÞÉÔØ ÂÏÌÅÅ ÐÏÄÒÏÂÎÕÀ ÉÎÆÏÒÍÁÃÉÀ Ï ÐÏËÁÚÁÎÎÏÊ
      ÕÑÚ×ÉÍÏÓÔÉ.  ÷ ÎÅ£ ×ÏÊÄ£Ô ÐÅÒÅÞÉÓÌÅÎÉÅ ×ÅÒÓÉÊ, ÚÁÔÒÏÎÕÔÙÈ
      ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÅÊ ×ÅÒÓÉÅÊ ÐÏÒÔÁ &os;, Á ÔÁËÖÅ ÄÒÕÇÉÅ Web-ÓÁÊÔÙ, ËÏÔÏÒÙÅ
      ÍÏÇÕÔ ÓÏÄÅÒÖÁÔØ ÂÀÌÌÅÔÅÎÉ ÂÅÚÏÐÁÓÎÏÓÔÉ.</para>

    <para>åÓÌÉ ÏÐÉÓÙ×ÁÔØ ×ËÒÁÔÃÅ, ÔÏ <application>Portaudit</application>
      Ñ×ÌÑÅÔÓÑ ÍÏÝÎÏÊ É, ÐÒÉ ÉÓÐÏÌØÚÏ×ÁÎÉÉ ×ÍÅÓÔÅ Ó ÐÏÒÔÏÍ
      <application>Portupgrade</application>, ÞÒÅÚ×ÙÞÁÊÎÏ ÐÏÌÅÚÎÏÊ
      ÕÔÉÌÉÔÏÊ.</para>
  </sect1>

  <sect1 id="security-advisories">
    <sect1info>
      <authorgroup>
	<author>
	  <firstname>Tom</firstname>
	  <surname>Rhodes</surname>
	  <contrib>ðÒÅÄÏÓÔÁ×ÉÌ </contrib>
	</author>
      </authorgroup>
    </sect1info>
    <indexterm>
      <primary>óÏÏÂÝÅÎÉÑ ÂÅÚÏÐÁÓÎÏÓÔÉ FreeBSD</primary>
    </indexterm>
    <title>óÏÏÂÝÅÎÉÑ ÂÅÚÏÐÁÓÎÏÓÔÉ &os;</title>

    <para>ëÁË ÍÎÏÇÉÅ É ×ÙÓÏËÏËÁÞÅÓÔ×ÅÎÎÙÅ ÏÐÅÒÁÃÉÏÎÎÙÅ ÓÉÓÔÅÍÙ, &os;
      ÐÕÂÌÉËÕÅÔ <quote>óÏÏÂÝÅÎÉÑ ÂÅÚÏÐÁÓÎÏÓÔÉ</quote> (<quote>Security
      Advisories</quote>).  üÔÉ ÓÏÏÂÝÅÎÉÑ ÏÂÙÞÎÏ ÏÔÐÒÁ×ÌÑÀÔÓÑ ÐÏ ÐÏÞÔÅ
      × ÓÐÉÓËÉ ÒÁÓÓÙÌËÉ, ÐÏÓ×ÑÝÅÎÎÙÅ ÂÅÚÏÐÁÓÎÏÓÔÉ É ÐÕÂÌÉËÕÀÔÓÑ
      × ÓÐÉÓËÅ ÐÒÏÂÌÅÍ ÔÏÌØËÏ ÐÏÓÌÅ ×ÙÈÏÄÁ ÉÓÐÒÁ×ÌÅÎÉÊ Ë ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÉÍ
      ÒÅÌÉÚÁÍ.  ÷ ÜÔÏÍ ÒÁÚÄÅÌÅ ÒÁÚßÑÓÎÑÅÔÓÑ, ÞÔÏ ÔÁËÏÅ ÓÏÏÂÝÅÎÉÑ ÂÅÚÏÐÁÓÎÏÓÔÉ,
      ËÁË ÉÈ ÞÉÔÁÔØ É ËÁËÉÅ ÍÅÒÙ ÐÒÉÎÉÍÁÔØ ÄÌÑ ÉÓÐÒÁ×ÌÅÎÉÑ ÓÉÓÔÅÍÙ.</para>

    <sect2>
      <title>ëÁË ×ÙÇÌÑÄÉÔ ÓÏÏÂÝÅÎÉÅ?</title>

      <para>óÏÏÂÝÅÎÉÅ ÂÅÚÏÐÁÓÎÏÓÔÉ &os; ×ÙÇÌÑÄÉÔ ÐÏÄÏÂÎÏ ÓÏÏÂÝÅÎÉÀ ÎÉÖÅ,
	×ÚÑÔÏÍÕ ÉÚ ÓÐÉÓËÁ ÒÁÓÓÙÌËÉ &a.security-notifications.name;.</para>

      <programlisting>=============================================================================
&os;-SA-XX:XX.UTIL                                     Security Advisory
                                                          The &os; Project

Topic:          denial of service due to some problem<co id="co-topic">

Category:       core<co id="co-category">
Module:         sys<co id="co-module">
Announced:      2003-09-23<co id="co-announce">
Credits:        Person@EMAIL-ADDRESS<co id="co-credit">
Affects:        All releases of &os;<co id="co-affects">
                &os; 4-STABLE prior to the correction date
Corrected:      2003-09-23 16:42:59 UTC (RELENG_4, 4.9-PRERELEASE)
                2003-09-23 20:08:42 UTC (RELENG_5_1, 5.1-RELEASE-p6)
                2003-09-23 20:07:06 UTC (RELENG_5_0, 5.0-RELEASE-p15)
                2003-09-23 16:44:58 UTC (RELENG_4_8, 4.8-RELEASE-p8)
                2003-09-23 16:47:34 UTC (RELENG_4_7, 4.7-RELEASE-p18)
                2003-09-23 16:49:46 UTC (RELENG_4_6, 4.6-RELEASE-p21)
                2003-09-23 16:51:24 UTC (RELENG_4_5, 4.5-RELEASE-p33)
                2003-09-23 16:52:45 UTC (RELENG_4_4, 4.4-RELEASE-p43)
                2003-09-23 16:54:39 UTC (RELENG_4_3, 4.3-RELEASE-p39)<co id="co-corrected">
<acronym>CVE</acronym> Name:   CVE-XXXX-XXXX<co id="co-cve">

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit
http://www.FreeBSD.org/security/.

I.   Background<co id="co-backround">


II.  Problem Description<co id="co-descript">


III. Impact<co id="co-impact">


IV.  Workaround<co id="co-workaround">


V.   Solution<co id="co-solution">


VI.  Correction details<co id="co-details">


VII. References<co id="co-ref"></programlisting>


      <calloutlist>
	<callout arearefs="co-topic">
	  <para>ðÏÌÅ <literal>Topic</literal> ÐÏËÁÚÙ×ÁÅÔ × ÞÅÍ ÉÍÅÎÎÏ
	    ÚÁËÌÀÞÁÅÔÓÑ ÐÒÏÂÌÅÍÁ.  üÔÏ ÏÂÙÞÎÏ ××ÅÄÅÎÉÅ × ÓÏÏÂÝÅÎÉÅ
	    ÂÅÚÏÐÁÓÎÏÓÔÉ, ÕÐÏÍÉÎÁÀÝÅÅ ÕÔÉÌÉÔÕ, × ËÏÔÏÒÏÊ ×ÏÚÎÉËÌÁ
	    ÏÛÉÂËÁ.</para>
	</callout>

	<callout arearefs="co-category">
	  <para>ðÏÌÅ <literal>Category</literal> ÏÔÎÏÓÉÔÓÑ Ë ÚÁÔÒÏÎÕÔÏÊ ÞÁÓÔÉ
	    ÓÉÓÔÅÍÙ É ÍÏÖÅÔ ÂÙÔØ ×ÙÂÒÁÎÁ ÉÚ <literal>core</literal>,
	    <literal>contrib</literal>, ÉÌÉ <literal>ports</literal>.
	    ëÁÔÅÇÏÒÉÑ <literal>core</literal> ÏÚÎÁÞÁÅÔ, ÞÔÏ
	    ÕÑÚ×ÉÍÏÓÔØ ÚÁÔÒÁÇÉ×ÁÅÔ ÏÓÎÏ×ÎÏÊ ËÏÍÐÏÎÅÎÔ ÏÐÅÒÁÃÉÏÎÎÏÊ ÓÉÓÔÅÍÙ
	    &os;.  ëÁÔÅÇÏÒÉÑ <literal>contrib</literal> ÏÚÎÁÞÁÅÔ, ÞÔÏ
	    ÕÑÚ×ÉÍÏÓÔØ ÚÁÔÒÁÇÉ×ÁÅÔ ÐÒÏÇÒÁÍÍÙ, ÐÒÅÄÏÓÔÁ×ÌÅÎÎÙÅ ÐÒÏÅËÔÕ
	    &os;, ÎÁÐÒÉÍÅÒ <application>sendmail</application>.  îÁËÏÎÅÃ,
	    ËÁÔÅÇÏÒÉÑ <literal>ports</literal> ÏÚÎÁÞÁÅÔ, ÞÔÏ ÕÑÚ×ÉÍÏÓÔØ
	    ÚÁÔÒÁÇÉ×ÁÅÔ ÐÒÏÇÒÁÍÍÎÏÅ ÏÂÅÓÐÅÞÅÎÉÅ, ÄÏÓÔÕÐÎÏÅ ÉÚ ëÏÌÌÅËÃÉÉ
	    ðÏÒÔÏ×.</para>
	</callout>

	<callout arearefs="co-module">
	  <para>ðÏÌÅ <literal>Module</literal> ÕËÁÚÙ×ÁÅÔ ÎÁ ÍÅÓÔÏÐÏÌÏÖÅÎÉÅ
	    ËÏÍÐÏÎÅÎÔÁ, ÎÁÐÒÉÍÅÒ <literal>sys</literal>.  ÷ ÜÔÏÍ ÐÒÉÍÅÒÅ
	    ÍÙ ×ÉÄÉÍ, ÞÔÏ ÚÁÔÒÏÎÕÔ ÍÏÄÕÌØ <literal>sys</literal>,
	    ÓÌÅÄÏ×ÁÔÅÌØÎÏ, ÜÔÁ ÕÑÚ×ÉÍÏÓÔØ ÏÔÎÏÓÉÔÓÑ Ë ËÏÍÐÏÎÅÎÔÕ,
	    ÉÓÐÏÌØÚÕÅÍÏÍÕ × ÑÄÒÅ.</para>
	</callout>

	<callout arearefs="co-announce">
	  <para>ðÏÌÅ <literal>Announced</literal> ÏÔÒÁÖÁÅÔ ÄÁÔÕ ÐÕÂÌÉËÁÃÉÉ
	    ÓÏÏÂÝÅÎÉÑ ÂÅÚÏÐÁÓÎÏÓÔÉ, ÉÌÉ ÅÇÏ ÁÎÏÎÓÉÒÏ×ÁÎÉÑ.  üÔÏ ÏÚÎÁÞÁÅÔ,
	    ÞÔÏ ËÏÍÁÎÄÁ ÏÂÅÓÐÅÞÅÎÉÑ ÂÅÚÏÐÁÓÎÏÓÔÉ ÕÂÅÄÉÌÁÓØ, ÞÔÏ ÐÒÏÂÌÅÍÁ
	    ÓÕÝÅÓÔ×ÕÅÔ É ÞÔÏ ÐÁÔÞ ÐÏÍÅÝ£Î × ÈÒÁÎÉÌÉÝÅ ÉÓÈÏÄÎÙÈ ÔÅËÓÔÏ×
	    &os;.</para>
	</callout>

	<callout arearefs="co-credit">
	  <para>ðÏÌÅ <literal>Credits</literal> ÕÐÏÍÉÎÁÅÔ ÞÁÓÔÎÏÅ ÌÉÃÏ ÉÌÉ
	    ÏÒÇÁÎÉÚÁÃÉÀ, ÏÂÎÁÒÕÖÉ×ÛÕÀ ÕÑÚ×ÉÍÏÓÔØ É ÓÏÏÂÝÉ×ÛÕÀ Ï ÎÅÊ.</para>
	</callout>

	<callout arearefs="co-affects">
	  <para>ðÏÌÅ <literal>Affects</literal> ÄÁÅÔ ÉÎÆÏÒÍÁÃÉÀ Ï ÒÅÌÉÚÁÈ
	    &os;, Ë ËÏÔÏÒÙÍ ÏÔÎÏÓÉÔÓÑ ÄÁÎÎÁÑ ÕÑÚ×ÉÍÏÓÔØ.  äÌÑ ÂÁÚÏ×ÏÊ
	    ÓÉÓÔÅÍÙ, ÐÒÏÓÍÏÔÒ ×Ù×ÏÄÁ ËÏÍÁÎÄÙ <command>ident</command>
	    ÄÌÑ ÆÁÊÌÏ×, ÚÁÔÒÏÎÕÔÙÈ ÕÑÚ×ÉÍÏÓÔØÀ, ÐÏÍÏÖÅÔ ÏÐÒÅÄÅÌÉÔØ
	    ÒÅ×ÉÚÉÀ.  îÏÍÅÒ ×ÅÒÓÉÉ ÐÏÒÔÏ× ÐÒÉ×ÅÄÅÎ ÐÏÓÌÅ ÉÍÅÎÉ ÐÏÒÔÁ
	    × ËÁÔÁÌÏÇÅ <filename>/var/db/pkg</filename>.  åÓÌÉ ÓÉÓÔÅÍÁ
	    ÎÅ ÓÉÎÈÒÏÎÉÚÉÒÕÅÔÓÑ Ó <acronym>CVS</acronym>-ÈÒÁÎÉÌÉÝÅÍ
	    &os; É ÎÅ ÐÅÒÅÓÏÂÉÒÁÅÔÓÑ ÅÖÅÄÎÅ×ÎÏ, ×ÙÓÏË ÛÁÎÓ, ÞÔÏ
	    ÏÎÁ ÚÁÔÒÏÎÕÔÁ ÕÑÚ×ÉÍÏÓÔØÀ.</para>
	</callout>

	<callout arearefs="co-corrected">
	  <para>ðÏÌÅ <literal>Corrected</literal> ÐÏËÁÚÙ×ÁÅÔ ÄÁÔÕ, ×ÒÅÍÑ,
	    ÓÍÅÝÅÎÉÅ ×Ï ×ÒÅÍÅÎÉ É ÒÅÌÉÚ, × ËÏÔÏÒÏÍ ÉÓÐÒÁ×ÌÅÎÁ ÏÛÉÂËÁ.</para>
	</callout>

	<callout arearefs="co-cve">
	  <para>úÁÒÅÚÅÒ×ÉÒÏ×ÁÎÏ ÄÌÑ ÉÄÅÎÔÉÆÉËÁÃÉÉ ÕÑÚ×ÉÍÏÓÔÉ × ÏÂÝÅÊ ÂÁÚÅ
	    ÄÁÎÎÙÈ CVD (Common Vulnerabilities Database).</para>

	<callout arearefs="co-backround">
	  <para>ðÏÌÅ <literal>Background</literal> ÄÁÅÔ ÉÎÆÏÒÍÁÃÉÀ ÉÍÅÎÎÏ
	    Ï ÔÏÊ ÕÔÉÌÉÔÅ, ÄÌÑ ËÏÔÏÒÏÊ ×ÙÐÕÝÅÎÏ ÓÏÏÂÝÅÎÉÅ.  ëÁË ÐÒÁ×ÉÌÏ
	    ÉÎÆÏÒÍÁÃÉÑ Ï ÔÏÍ, ÚÁÞÅÍ ÕÔÉÌÉÔÁ ÐÒÉÓÕÔÓÔ×ÕÅÔ × &os;, ÄÌÑ
	    ÞÅÇÏ ÏÎÁ ÉÓÐÏÌØÚÕÅÔÓÑ, É ÎÅÍÎÏÇÏ ÉÎÆÏÒÍÁÃÉÉ Ï ÔÏÍ, ËÁË
	    ÐÏÑ×ÉÌÁÓØ ÜÔÁ ÕÔÉÌÉÔÁ.</para>
	</callout>

	<callout arearefs="co-descript">
	  <para>ðÏÌÅ <literal>Problem Description</literal> ÄÁÅÔ ÂÏÌÅÅ
	    ÇÌÕÂÏËÉÅ ÒÁÚßÑÓÎÅÎÉÑ ×ÏÚÎÉËÛÅÊ ÐÒÏÂÌÅÍÙ.  ïÎÏ ÍÏÖÅÔ ×ËÌÀÞÁÔØ
	    ÉÎÆÏÒÍÁÃÉÀ ÏÂ ÏÛÉÂÏÞÎÏÍ ËÏÄÅ, ÉÌÉ ÄÁÖÅ Ï ÔÏÍ, ËÁË ÕÔÉÌÉÔÁ
	    ÍÏÖÅÔ ÂÙÔØ ÉÓÐÏÌØÚÏ×ÁÎÁ ÄÌÑ ÓÏÚÄÁÎÉÑ ÂÒÅÛÉ × ÓÉÓÔÅÍÅ
	    ÂÅÚÏÐÁÓÎÏÓÔÉ.</para>
	</callout>

	<callout arearefs="co-impact">
	  <para>ðÏÌÅ <literal>Impact</literal> ÏÐÉÓÙ×ÁÅÔ ÔÉÐ ×ÏÚÄÅÊÓÔ×ÉÑ,
	    ËÏÔÏÒÙÊ ÐÒÏÂÌÅÍÁ ÍÏÖÅÔ ÏËÁÚÁÔØ ÎÁ ÓÉÓÔÅÍÕ.  üÔÏ ÍÏÖÅÔ ÂÙÔØ
	    ×ÓÅ, ÞÔÏ ÕÇÏÄÎÏ, ÏÔ ÁÔÁËÉ ÎÁ ÏÔËÁÚ × ÏÂÓÌÕÖÉ×ÁÎÉÉ ÄÏ
	    ÐÏÌÕÞÅÎÉÑ ÐÏÌØÚÏ×ÁÔÅÌÑÍÉ ÄÏÐÏÌÎÉÔÅÌØÎÙÈ ÐÒÉ×ÉÌÅÇÉÊ, ÉÌÉ
	    ÄÁÖÅ ÐÏÌÕÞÅÎÉÑ ÁÔÁËÕÀÝÉÍ ÐÒÁ× ÓÕÐÅÒÐÏÌØÚÏ×ÁÔÅÌÑ.</para>
	</callout>

	<callout arearefs="co-workaround">
	  <para>ðÏÌÅ <literal>Workaround</literal> ÐÒÅÄÌÁÇÁÅÔ ÔÅÍ,
	    ÓÉÓÔÅÍÎÙÍ ÁÄÍÉÎÉÓÔÒÁÔÏÒÁÍ, ËÏÔÏÒÙÅ ÎÅ ÍÏÇÕÔ ÏÂÎÏ×ÉÔØ ÓÉÓÔÅÍÕ,
	    ÏÂÈÏÄÎÏÊ ÐÕÔØ ÒÅÛÅÎÉÑ ÐÒÏÂÌÅÍÙ.  ïÎ ÍÏÖÅÔ ÐÒÉÇÏÄÉÔØÓÑ ÐÒÉ
	    ÎÅÄÏÓÔÁÔËÅ ×ÒÅÍÅÎÉ, ÏÔÓÕÔÓÔ×ÉÉ ÐÏÄËÌÀÞÅÎÉÑ Ë ÓÅÔÉ ÉÌÉ ÐÏ
	    ÍÁÓÓÅ ÄÒÕÇÉÈ ÐÒÉÞÉÎ.  ÷ ÌÀÂÏÍ ÓÌÕÞÁÅ, Ë ÂÅÚÏÐÁÓÎÏÓÔÉ ÎÅÌØÚÑ
	    ÏÔÎÏÓÉÔØÓÑ ÎÅÓÅÒØÅÚÎÏ, É ÎÅÏÂÈÏÄÉÍÏ ÌÉÂÏ ÐÒÉÍÅÎÉÔØ ÕËÁÚÁÎÎÙÊ
	    ÏÂÈÏÄÎÏÊ ÐÕÔØ, ÌÉÂÏ ÉÓÐÒÁ×ÉÔØ ÓÉÓÔÅÍÕ.</para>
	</callout>

	<callout arearefs="co-solution">
	  <para>ðÏÌÅ <literal>Solution</literal> ÐÒÅÄÌÁÇÁÅÔ ÉÎÓÔÒÕËÃÉÉ ÐÏ
	    ÉÓÐÒÁ×ÌÅÎÉÀ ÚÁÔÒÏÎÕÔÏÊ ÓÉÓÔÅÍÙ.  üÔÏ ÐÏÛÁÇÏ×ÏÅ ÒÕËÏ×ÏÄÓÔ×Ï,
	    ÐÒÏÔÅÓÔÉÒÏ×ÁÎÎÙÊ ÍÅÔÏÄ ×ÏÓÓÔÁÎÏ×ÌÅÎÉÑ ÂÅÚÏÐÁÓÎÏÓÔÉ ÓÉÓÔÅÍÙ.</para>
	</callout>

	<callout arearefs="co-details">
	  <para>ðÏÌÅ <literal>Correction Details</literal> ÐÏËÁÚÙ×ÁÅÔ
	    ×ÅÔ×Ø <acronym>CVS</acronym> (ÉÍÑ ÒÅÌÉÚÁ Ó ÔÏÞËÁÍÉ, ÚÁÍÅÎÅÎÎÙÍÉ
	    ÎÁ ÓÉÍ×ÏÌÙ ÐÏÄÞÅÒËÉ×ÁÎÉÑ).  úÄÅÓØ ÔÁËÖÅ ÐÏËÁÚÁÎ ÎÏÍÅÒ ÒÅ×ÉÚÉÉ
	    ËÁÖÄÏÇÏ ÆÁÊÌÁ ÉÚ ËÁÖÄÏÊ ×ÅÔ×É.</para>
	</callout>

	<callout arearefs="co-ref">
	  <para>ðÏÌÅ <literal>References</literal> ÏÂÙÞÎÏ ÕÐÏÍÉÎÁÅÔ
	    ÄÒÕÇÉÅ ÉÓÔÏÞÎÉËÉ ÉÎÆÏÒÍÁÃÉÉ.  üÔÏ ÍÏÇÕÔ ÂÙÔØ Web-ÓÔÒÁÎÉÃÙ,
	    ËÎÉÇÉ, ÓÐÉÓËÉ ÒÁÓÓÙÌËÉ É ÇÒÕÐÐÙ ÎÏ×ÏÓÔÅÊ.</para>
	</callout>
      </calloutlist>
    </sect2>
  </sect1>

  <sect1 id="security-accounting">
    <sect1info>
      <authorgroup>
	<author>
	  <firstname>ôÏÍ</firstname>

	  <surname>òÏÄÅÓ</surname>

	  <contrib>ôÅËÓÔ ÐÒÅÄÏÓÔÁ×ÉÌ </contrib>
	</author>
      </authorgroup>
    </sect1info>

    <indexterm>
      <primary>õÞ£Ô ÉÓÐÏÌØÚÕÅÍÙÈ ÒÅÓÕÒÓÏ×</primary>
    </indexterm>

    <title>õÞ£Ô ÉÓÐÏÌØÚÕÅÍÙÈ ÒÅÓÕÒÓÏ×</title>

    <para>õÞ£Ô ÉÓÐÏÌØÚÕÅÍÙÈ ÐÒÏÃÅÓÓÁÍÉ ÒÅÓÕÒÓÏ× ÐÒÅÄÓÔÁ×ÌÑÅÔ ÓÏÂÏÊ ÍÅÔÏÄ
      ÚÁÝÉÔÙ, ÐÒÉ ËÏÔÏÒÏÍ ÁÄÍÉÎÉÓÔÒÁÔÏÒ ÍÏÖÅÔ ÏÔÓÌÅÖÉ×ÁÔØ ÉÓÐÏÌØÚÏ×ÁÎÉÅ
      ÓÉÓÔÅÍÎÙÈ ÒÅÓÕÒÓÏ× É ÉÈ ÒÁÓÐÒÅÄÅÌÅÎÉÅ ÍÅÖÄÕ ÐÏÌØÚÏ×ÁÔÅÌÑÍÉ ÄÌÑ ÎÕÖÄ
      ÓÉÓÔÅÍÎÏÇÏ ÍÏÎÉÔÏÒÉÎÇÁ É ÍÉÎÉÍÁÌØÎÏÇÏ ÏÔÓÌÅÖÉ×ÁÎÉÑ ËÏÍÁÎÄ
      ÐÏÌØÚÏ×ÁÔÅÌÅÊ.</para>

    <para>îÁ ÓÁÍÏÍ ÄÅÌÅ ÚÄÅÓØ ÅÓÔØ Ó×ÏÉ ÐÏÌÏÖÉÔÅÌØÎÙÊ É ÏÔÒÉÃÁÔÅÌØÎÙÅ ÍÏÍÅÎÔÙ.
      ðÏÌÏÖÉÔÅÌØÎÏÊ ÓÔÏÒÏÎÏÊ Ñ×ÌÑÅÔÓÑ ÔÏ, ÞÔÏ ÐÒÏÎÉËÎÏ×ÅÎÉÅ ÍÏÖÅÔ ÂÙÔØ
      ÏÔÓÌÅÖÅÎÏ ÄÏ ÐÅÒ×ÏÎÁÞÁÌØÎÏÊ ÔÏÞËÉ ×ÈÏÄÁ.  ïÔÒÉÃÁÔÅÌØÎÏÊ ÓÔÏÒÏÎÏÊ
      Ñ×ÌÑÅÔÓÑ ÏÂß£Í ÐÒÏÔÏËÏÌÏ×, ËÏÔÏÒÙÊ ÇÅÎÅÒÉÒÕÅÔÓÑ ÐÒÉ ÍÏÎÉÔÏÒÉÎÇÅ, É
      ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÉÅ ÔÒÅÂÏ×ÁÎÉÑ Ë ÄÉÓËÏ×ÏÍÕ ÐÒÏÓÔÒÁÎÓÔ×Õ.  ÷ ÜÔÏÍ ÒÁÚÄÅÌÅ
      ÁÄÍÉÎÉÓÔÒÁÔÏÒÕ ÄÁÀÔÓÑ ÏÓÎÏ×Ù ÕÞ£ÔÁ ÒÅÓÕÒÓÏ× ÐÒÏÃÅÓÓÏ×.</para>

    <sect2>
      <title>áËÔÉ×ÁÃÉÑ É ÉÓÐÏÌØÚÏ×ÁÎÉÅ ÕÞ£ÔÁ ÒÅÓÕÒÓÏ×</title>

      <para>ðÒÅÖÄÅ ÞÅÍ ÉÓÐÏÌØÚÏ×ÁÔØ ÓÉÓÔÅÍÕ ÕÞ£ÔÁ ÒÅÓÕÒÓÏ×, Å£ ÎÅÏÂÈÏÄÉÍÏ
	ÁËÔÉ×ÉÒÏ×ÁÔØ.  äÌÑ ÜÔÏÇÏ ×ÙÐÏÌÎÉÔÅ ÓÌÅÄÕÀÝÉÅ ËÏÍÁÎÄÙ:</para>

      <screen>&prompt.root; <userinput>touch <filename>/var/account/acct</filename></userinput>

&prompt.root; <userinput>accton <filename>/var/account/acct</filename></userinput>

&prompt.root; <userinput>echo 'accounting_enable="YES"' &gt;&gt; <filename>/etc/rc.conf</filename></userinput></screen>

      <para>ðÏÓÌÅ ÁËÔÉ×ÁÃÉÉ ÓÉÓÔÅÍÁ ÕÞ£ÔÁ ÒÅÓÕÒÓÏ× ÎÁÞÎ£Ô ÏÔÓÌÅÖÉ×ÁÔØ
	ÓÔÁÔÉÓÔÉËÕ <acronym>CPU</acronym>, ËÏÍÁÎÄ É ÔÁË ÄÁÌÅÅ.  ÷ÓÅ ÐÒÏÔÏËÏÌÙ
	ÕÞ£ÔÁ ×ÅÄÕÔÓÑ × ÆÏÒÍÁÔÅ, ÎÅÄÏÓÔÕÐÎÏÍ ÄÌÑ ÞÔÅÎÉÑ ÞÅÌÏ×ÅËÏÍ, É ÍÏÇÕÔ
	ÐÒÏÓÍÁÔÒÉ×ÁÔØÓÑ ÐÒÉ ÐÏÍÏÝÉ ÕÔÉÌÉÔÙ &man.sa.8;.  úÁÐÕÝÅÎÎÁÑ ÂÅÚ
	ÐÁÒÁÍÅÔÒÏ×, <command>sa</command> ×ÙÄÁÓÔ ÉÎÆÏÒÍÁÃÉÀ, ÏÔÎÏÓÑÝÕÀÓÑ Ë
	ËÏÌÉÞÅÓÔ×Õ ×ÙÚÏ×Ï× × ÒÁÓÞ£ÔÅ ÎÁ ËÁÖÄÏÇÏ ÐÏÌØÚÏ×ÁÔÅÌÑ, ÏÂÝÅÅ
	ÚÁÔÒÁÞÅÎÎÏÅ ×ÒÅÍÑ × ÍÉÎÕÔÁÈ, ÏÂÝÅÅ ×ÒÅÍÑ <acronym>CPU</acronym> É
	ÐÏÌØÚÏ×ÁÔÅÌÑ × ÍÉÎÕÔÁÈ, ÓÒÅÄÎÅÅ ËÏÌÉÞÅÓÔ×Ï ÏÐÅÒÁÃÉÊ ××ÏÄÁ/×Ù×ÏÄÁ É
	ÔÁË ÄÁÌÅÅ.</para>

      <para>äÌÑ ÐÒÏÓÍÏÔÒÁ ÉÎÆÏÒÍÁÃÉÉ Ï ÚÁÐÕÝÅÎÎÙÈ ËÏÍÁÎÄÁÈ, ÎÅÏÂÈÏÄÉÍÏ
	×ÏÓÐÏÌØÚÏ×ÁÔØÓÑ ÕÔÉÌÉÔÏÊ &man.lastcomm.1;.  ëÏÍÁÎÄÕ
	<command>lastcomm</command> ÍÏÖÎÏ ÉÓÐÏÌØÚÏ×ÁÔØ, ÎÁÐÒÉÍÅÒ, ÄÌÑ ×ÙÄÁÞÉ
	ÓÐÉÓËÁ ÄÉÒÅËÔÉ×, ×ÙÄÁÎÎÙÈ ÐÏÌØÚÏ×ÁÔÅÌÑÍÉ ÏÐÒÅÄÅÌ£ÎÎÏÇÏ ÔÅÒÍÉÎÁÌÁ
	&man.ttys.5;:</para>

      <screen>&prompt.root; <userinput>lastcomm ls <username>trhodes</username> ttyp1</userinput></screen>

      <para>üÔÁ ËÏÍÁÎÄÁ ×ÙÄÁÓÔ ×ÓÅ ÚÁÆÉËÓÉÒÏ×ÁÎÎÙÅ ÉÓÐÏÌØÚÏ×ÁÎÉÑ ËÏÍÁÎÄÙ
	<command>ls</command> ÐÏÌØÚÏ×ÁÔÅÌÅÍ <username>trhodes</username> ÎÁ
	ÔÅÒÍÉÎÁÌÅ ttyp1.</para>

      <para>óÕÝÅÓÔ×ÕÅÔ ÍÎÏÇÉÅ ÄÒÕÇÉÅ ÐÏÌÅÚÎÙÅ ÐÁÒÁÍÅÔÒÙ, ËÏÔÏÒÙÅ ÏÐÉÓÁÎÙ ÎÁ
	ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÉÈ ÓÐÒÁ×ÏÞÎÙÈ ÓÔÒÁÎÉÃÁÈ &man.lastcomm.1;, &man.acct.5; É
	&man.sa.8;.</para>
    </sect2>
  </sect1>
</chapter>

<!--
     Local Variables:
     mode: sgml
     sgml-declaration: "../chapter.decl"
     sgml-indent-data: t
     sgml-omittag: nil
     sgml-always-quote-attributes: t
     sgml-parent-document: ("../book.sgml" "part" "chapter")
     End:
-->