Þ Ê 0 ¹ Ð, Ž; Œ; À; ì; í; ï; <
< .< ?< V< c< ~< < < ¯< À< Ø< õ< " = ' 2= l Z= ¿ Ç= R > ± Ú> @ ? 5 Í? / @ 3@ K@ & `@ @ š@ 7 À@ ø@ A 2 )A \A Z yA F ÔA 1 B MB $ ^B , B % °B a ÖB > 8C 3 wC * «C ÖC ! êC D ,D MD jD B D ) ÊD ) ôD * E IE # \E 3 E % ŽE 3 ÚE % F 4F UF mF F F ²F # ÑF % õF G :G + LG xG G # µG ÙG óG H ,H KH dH # ~H ¢H ŒH ØH õH I ! (I JI eI 2 I ³I 2 ÃI % öI J ¬J ( CK lK K €K & ¿K w æK ! ^L L M !M . @M ! oM % M ·M ÊM 0 áM J N ]N & }N % €N ÊN P áN $ 2O ( WO O O ºO 5 ÒO , P 4 5P . jP 2 P A ÌP , Q E ;Q 3 Q µQ ( ÒQ # ûQ 4 R TR + qR R ŒR ÝR êR " S 5 +S
aS 6 lS $ £S * ÈS , óS T >T ' XT , T - T % ÛT ' U > )U hU , U & ¶U ÝU ðU ! V +V J FV " V ) ŽV ! ÞV - W ( .W WW pW ! W ªW ¹W ÏW ÙW
éW # ÷W X 0X
GX RX ) aX X €X »X R ÏX U "Y A xY V ºY A Z ) SZ < }Z B ºZ G ýZ F E[ . [ F »[ 8 \ ; ;\ Z w\ ] Ò\ E 0] : v] > ±] ; ð] - ,^ 7 Z^ ^ ^ È^ " ß^ _ _ % :_ `_
t_ _ F _ Ù_ 4 ë_ 4 ` Û U` V 1a ; a ; Äa ! b 0 "b Sb tb b T ¬b ' c ! )c Kc ! jc c 2 ªc 4 Ýc d - -d 3 [d
d d d Æd ád ÿd e 6e Oe ge |e e µe Öe òe f /f Of % jf f ¯f Ÿf Ôf ìf * g : /g % jg * g $ »g 5 àg 0 h + Gh # sh h «h B Âh > i 4 Di 9 yi v ³i *j # Jj : nj ©j . »j ' êj k #k >k Sk mk
zk I k & Òk f ùk 4 `l F l ; Ül = m - Vm m - m , Âm 5 ïm %n ! 5n Wn & sn ) n Än = Én ) o ' 1o
Yo go o o - ¬o Úo
òo p , p @p 7 [p p p ( Êp ! óp q & 1q Xq oq q ªq % Ãq éq ÿq r Ë 'r ór úr 0
s + >s ( js A s 2 Õs t = t Vt A ot ? ±t 6 ñt (u 5 :u = pu > ®u K íu Q 9v M v W Ùv M 1w w w
§w M ²w x x 0x + Ix ( ux
x ©x Àx Üx ùx 2 y * My xy y - «y Ùy ' íy 0 z * Fz qz 7 z ¿z ' Þz { %{ = C{ 5 { 1 ·{ é{ - | " .| Q| p| | §| * È| / ó| $ #} H} c} u} } ³} H Ì} 7 ~ M~ l~ ( }~ Š~ ¿~ " Õ~ ø~ 3 P i ò ( - Ž ) â *
F T k / $ ± Ö 7 ó 7 + c
€ ¶ Ñ % á E ^ $ u ± Ì è 7 & 8 7 _ . § & Ö ý 9
$ N
s
$ Š
: Ë
^ c e _ É $ ) . N T } ! Ò × ô # Ì # ð
) 3 7 3 k ( + È ! ô ) $ I # n 9 I Ì 2 K Z w ° Ê ä ! / : j Ž Ë â ù ( ) @ u j 2 à A < U P L ã = 0 J n < ¹ = ö E 4 ; z = ¶ N ô 9 C ^ } \ Ü 5 9 ^ o ( Î ÷ 2 < A P ~ K Ï a Š X / a 1 Ã ß ó . § 6 ! Þ " = # L a 3 ® " â A - G C u B ¹ ' ü 8 $ ) ] - µ / @ & p m ; A ! b > £ â g # # § ! Ë í 5 $ " Z 2 } ! °
Ò > à 8 X g ! * Š A Ñ ! 5 V s ! ° " Ñ ô ) G c q 7 ó 3 +¡ @ _¡ ¡ 2 »¡ % î¡ 3 ¢ 1 H¢ 0 z¢ / «¢ 2 Û¢ ' £ R 6£ 5 £ 8 ¿£ & ø£ # € C€ ' W€ € ( € »€ H Ì€ * ¥ D @¥ E
¥ è Ë¥ 8 ŽŠ " íŠ i § 9 z§ 8 Ž§ D í§ 8 2š 6 kš A ¢š äš ; © = @© @ ~© A ¿© K ª > Mª 3 ª T Àª D « Z« - v« ? €« C ä« 5 (¬ ^¬ B y¬ ' Œ¬ * ä¬ . 5 8 2 n 9 ¡ 9 Û ® /® H® O® b® h® ® £® + µ® $ á® $ ¯ +¯ $ J¯ o¯ ¯ ¯
¯ £¯ »¯ ϯ $ 㯠° ° 4° M° d° x° ° ®° Å° Ú° ó° ± "± 6± ! N± 7 p± 8 š± 2 á± ² -² E² `² x² ² ¯² Ų ! Õ² " ÷² ³ ³ ³ ÒŽ ÔŽ , äŽ
µ µ & 7µ ^µ A kµ µ Œµ Ôµ ìµ ýµ - ¶ 9 J¶ 3 ¶ > ž¶ ÷¶ 6 {· a ²ž ! ¹ W 6º L º * Ûº $ » . +» > Z» / » É» K ç» ) 3Œ ]Œ H {Œ 2 ÄŒ ÷Œ o œ T ðœ EŸ 3 ^Ÿ 6 Ÿ < ÉŸ ¿ r ¢¿ H À E ^À €À 5 œÀ 2 óÀ I &Á C pÁ + ŽÁ W àÁ 8 8 < q ; ®Â ê à 6 "à , Yà E à T Ìà & !Ä HÄ aÄ }Ä Ä $ ¶Ä 0 ÛÄ 0 Å - =Å * kÅ ] Å 9 ôÅ 3 .Æ , bÆ ! Æ * ±Æ ! ÜÆ # þÆ ! "Ç - DÇ T rÇ * ÇÇ 3 òÇ ? &È fÈ 5 È . žÈ + çÈ É 8 -É fÉ K É - ÏÉ Ê ýÉ Þ ÈÊ - §Ë 1 ÕË ! Ì )Ì - FÌ ¥ tÌ 7 Í × RÍ * *Î / UÎ i
Î : ïÎ @ *Ï kÏ Ï @ ¡Ï âÏ H dÐ ? Ð @ íÐ " .Ñ QÑ K ÓÑ , Ò 2 LÒ , Ò ) ¬Ò K ÖÒ ? "Ó Z bÓ 0 œÓ : îÓ [ )Ô <
Ô m ÂÔ @ 0Õ 0 qÕ ; ¢Õ B ÞÕ W !Ö - yÖ E §Ö 7 íÖ 0 %× V× 9 n× - š× 9 Ö× Ø ` Ø < Ø 0 œØ + îØ 7 Ù : RÙ C Ù 1 ÑÙ R Ú @ VÚ 4 Ú t ÌÚ 8 AÛ L zÛ : ÇÛ ( Ü 0 +Ü < \Ü + Ü } ÅÜ ! CÝ 0 eÝ - Ý K ÄÝ R Þ $ cÞ $ Þ . Þ ÜÞ # ðÞ ß ß
+ß 9 6ß pß ß šß žß , ×ß ' à ! ,à ( Nà r wà W êà H Bá n á > úá ( 9â f bâ T Éâ A ã M `ã ? ®ã 9 îã E (ä N nä [ œä å O Šå : öå 8 1æ Q jæ 6 Œæ V óæ * Jç & uç ç ( ²ç / Ûç è 1 *è % \è è è t ³è - (é < Vé K é ßé ñê d
ë e êë 6 Pì H ì 6 Ðì 4 í ) <í h fí C Ïí 1 î - Eî + sî - î N Íî T ï qï E ï c Øï <ð Pð / cð ) ð ? œð ? ýð * =ñ < hñ $ ¥ñ * Êñ 6 õñ , ,ò & Yò ' ò 9 šò ! âò - ó ' 2ó 0 Zó 6 ó Âó Õó $ õó * ô < Eô 6 ô 3 ¹ô íô õ & õ Fõ eõ " õ €õ 3 žõ B ìõ ` /ö T ö < åö { "÷ ÷ 5 œ÷ K ó÷ ?ø ? _ø < ø Üø ùø * ù ) @ù jù ù Z ù & ÷ù ú * Šú f Ñú H 8û V û B Øû ü c 1ü ] ü < óü 0ý H Fý ý $ ¥ý - Êý øý S ÿý B Sþ 9 þ Ðþ * éþ * ÿ ?ÿ X Zÿ ( ³ÿ " Üÿ ( ÿÿ F ( $ o 9 * Î 3 ù B - 3 p , € N Ñ * 3 K B *  N í * < 6 g : ® é ù B c W = » H ù T B 1 G É ' c 9 c K M G Z H ¢ H ë [ 4 a ] ò g P
Y ž
$ 7 U R u È 1 è ' f B M © ÷ $
0 .
+ _
-
G ¹
: - < j # 1 ª @ Ü R - p E ¿ $ * F 0 g > T × T , & K š ? ô ' 4 + \ # * ¬ 9 × 3 % E k > « 6 ê % ! d G a ¬ - < @ W ¯ + Î ú g / ! / ¹ ' é L J ^ G © P ñ & B ) i « Ç W ã / ; k X Q ã * 5
` n % ¡ Ç 5 Û [ 2 ( § Ð $ ï 6 & K < r 6 ¯ < æ # K 6 B Å o á 6 Q 6 ¿ 9 Þ ^ w ! ! < " D W" ` " ' ý" M %# @ s$ 3 Ž$ $ è$
% - )% - W% +
% 0 ±% 0 â% $ & 2 8& 6 k& < ¢& i ß& { I' & Å' # ì' ( $ "( % G( ) m( ! ( ! ¹( & Û( % ) & () N O) - ) . Ì) + û) + '* + S* + * + «* , ×* , + 6 1+ ~ h+ * ç+ D , C W, d , ^ - < _- R - 8 ï- 1 (. E Z. = . B Þ. f !/ E / { Î/ { J0 Q Æ0 1 / 1 Ê1 E é1 ? /2 _ o2 R Ï2 ¿ "3 | â3 X _4 7 ž4 H ð4 ! 95 [5 ! z5 8 5 ö Õ5 9 Ì6 7 7 K >7 W 7 ? â7 , "8 S O8 > £8 K â8 ` .9 9 9 B É9 M : b Z: â œ: R ; - ó; !< @ ¹< 9 ú< 7 4= ' l= : = Š Ï= v> O > ã> E ÿ> + E? q? ( ? 6 ³? X ê? 0 C@
t@ U @ C Ø@ A 7 (A . `A I A s ÙA = MB = B . ÉB + øB : $C : _C + C , ÆC F óC 4 :D + oD 4 D « ÐD N |E T ËE V F wF X F 6 ìF ] #G J G D ÌG Q H M cH 6 ±H n èH c WI o »I 6 +J < bJ + J 6 ËJ K , K HK e \K 7 ÂK @ úK B ;L ÷ ~L I vM / ÀM } ðM Q nN M ÀN k O T zO P ÏO a P / P J ²P u ýP c sQ Z ×Q H 2R ` {R M ÜR W *S ] S ! àS ? T _ BT ` ¢T N U 6 RU Z U J äU 3 /V cV V - V 9 µV B ïV H 2W ) {W ( ¥W ÎW ÛW ëW õW
X *X ) 9X " cX " X ©X " ÆX éX
Y Y $Y =Y RY cY 2 wY ªY ŸY ' ÖY þY Z $ )Z 0 NZ Z Z ¥Z »Z ÓZ äZ õZ 1
[ K <[ A [ H Ê[ ) \ =\ " ]\ \ # \ " Ä\ ç\ ] 7 ] W] x] Þ J j î Î t
f T q ³ k E Y ó + a M Ç § X ¯ Ã f ó | i ò Ñ Õ ? e / ¹ º ! ý ` 2 v V S F m ÿ ` z h Ý ø ª h g î È à . Í & ì Ô ¿ R = > € ä
Ï Q q ¢ â # K F ) 3 Í Œ § Á # Ò 4 Ú q b ) ( Ä i G 6 ¥ ç 7 P X » ¿ _ c &  õ ® o Á 8 ; W R Ø y ñ » [ Ó D N ² : L @ G ¡ t è ¿ ® Ø + · \ Ë Š ; h ô l û ã À % u ã U ) | ² ( ~ « à @ a Ä $ ß C ç I s W ( Å Ö Ÿ x B 0 š k ' Ð ] å ë > - ± Ù 7 g t 8 Ž = A / ± í d œ 0 º 4 Ù A ª 2 £ œ ¢ c 4 È ß = Ÿ
0 é [ ] € . o y Ð V \ s É Æ I a u A º O ë W § à Ñ ÷ ¹ $ ? £ ž 1 ~ œ ³ T ! ¬ ê C ^ M Ü ? 9 À 2 J / Ž : 8 ô ; Ü
Ÿ ì í ¥ Ö g Ú # © G V © l m × Å £ 6 w [ Z % Â n ^ : ° Q L y å Y ü ú Ž · E ª ê µ
Ä x P T j k 9 è Ê B ~
ï ž ¶ D % c š E p > Ê ¯ 5 Õ Ì < ý ` X Î 3 n v H é } á ¢ ¬ ® ¶ þ { F , e ä * « Ý Ô 1 ü Ê U 7 z ù ± r ò ¥ z € Z Á ³ r ° @
Z _ Ò ö d
Œ S - | Y < * * É ¬ - ð ¹ É \ ž S J ø . Æ Ó B { Ì 6 ú m p 1 ÿ ð » K _ °
u « Ë H $ p i à j Û æ 5 w & 3 H f ö x M Ç P Û ï û Þ " Q b á ù e ^ æ " ¡ R Ï µ v O Š ¯ d Œ ñ I , þ L !  , × Ç ¶ n ¡ } " Æ r l O N Š C o ÷ s š õ ² b · Å { ' 5 È â U ' ] } N µ 9 < + D K À © w ] Ä; Ø; ] ÿÿÿÿ¥] 2 ÿÿÿÿ
Attribute: %1$s
%s is not present in cache.
- gecos: %s
- group id: %d
- home directory: %s
- no env -
- no mapped users found - - shell: %s
- user id: %d
- user name: %s
%1$-25s %2$#.4x
%1$-25s Unknown domain
%1$-25s Unreachable service
%1$s must be run as root
%s: Unable to read value [%d]: %s
, your cached password will expire at: A comma-separated list of groups, members of which should be excluded from recording, only when scope=all. A comma-separated list of groups, members of which should have session recording enabled. Matches group names as returned by NSS. I.e. after the possible space replacement, case changes, etc. A comma-separated list of users to be excluded from recording, only when scope=all A comma-separated list of users which should have session recording enabled. Matches user names as returned by NSS. I.e. after the possible space replacement, case changes, etc. A list of extra attributes to download along with the user entry A mapping from user names to Kerberos principal names A specific order of the domains to be looked up Access control provider Action not provided
Active Directory backup server address Active Directory client hostname Active Directory domain Active Directory primary group attribute for ID-mapping Active Directory server address Active servers:
Additional timeout to wait for a card if requested Address of backup IPA server After changing the OTP password, you need to log out and back in order to acquire a ticket All spaces in group or user names will be replaced with this character Allow certificate based/Smartcard authentication. Allow core dumps Allow passkey device authentication. Allow to generate ssh-keys from certificates Allowed services for using smartcards Allows to retain local users as members of an LDAP group for servers that use the RFC2307 schema. Always query all the caches before querying the Data Providers An error occurred, but no description can be found. An open file descriptor for the debug logs Analyze logged data Archive SSSD log files in tarball Archiving log files into %s...
Attribute %1$s already indexed.
Attribute %1$s not indexed.
Attribute (-a) not provided
Attribute indicating that server side password policies are active Attribute listing authorized PAM services Attribute listing authorized server hosts Attribute listing authorized server rhosts Attribute to index Attribute with the name of the view Attribute with the reference to the original object Authenticate at %1$s and press ENTER. Authenticate with PIN %1$s at %2$s and press ENTER. Authenticated with cached credentials Authentication is denied until: Authentication provider Authentication timeout Autofs provider Automatic full refresh period Automatic smart refresh period Automounter map entry key attribute Automounter map entry value attribute Automounter map name attribute Backup local data Backup local data and remove cached content Base DN for IP hosts lookups Base DN for IP networks lookups Base DN for automounter map lookups Base DN for group lookups Base DN for netgroup lookups Base DN for service lookups Base DN for sudo rules lookups Base DN for user lookups Become a daemon (default) Cache credentials for offline login Cache entry creation date Cache entry expiration time Cache entry last update time Cached in InfoPipe Cannot get stat of SSSD socket. Certificate does not match rule.
Certificate matches rule.
Certificate related tools: Change or print information about SSSD debug level Check PAC flags Check mapping and matching rule with a certificate Comma separated list of allowed users Comma separated list of groups that are allowed to log in. This applies only to groups within this SSSD domain. Local groups are not evaluated. Comma separated list of groups that are explicitly denied access. This applies only to groups within this SSSD domain. Local groups are not evaluated. Comma separated list of prohibited users Command '%s' failed with [%d]
Command to start service Configuration files tools: Control enumeration of trusted domains Controls if SSSD should monitor the state of resolv.conf to identify when it needs to update its internal DNS resolver. Could not open available domains
Could not open domain %1$s. If the domain is a subdomain (trusted domain), use fully qualified name instead of --domain/-d parameter.
Couldn't invalidate %1$s
Couldn't invalidate %1$s %2$s
Create clean cache files and import local data Creating backup of local data...
Creating cache index for domain %1$s
Current Password: DN for ppolicy queries DNS service name for LDAP password change server Default logon right (or permit/deny) to use for unmapped PAM service names Default subdomain homedir value Delete log files instead of truncating Deleting cache index for domain %1$s
Deleting log files...
Directory on the filesystem where SSSD should store Kerberos replay cache files. Directory to store credential caches Disable Active Directory range retrieval Disable netlink interface Disable the LDAP paging control Discovered %s servers:
Display a warning N days before the password expires. Display users/groups in fully-qualified form Do not filter domain local groups from other domains Domain of the information provider (mandatory) Domain to add to names without a domain component. Don't forget to also update the indexes on the remote providers.
Don't include group members in group lookups ERROR: Tevent chain ID support missing, log analyzer is unsupported.
Enable DNS sites - location based service discovery Enable credential validation Enable debugging in the libfido2 library Enable enumerating all users/groups Enable or disable core dumps for all SSSD processes. Enable or disable the domain Enable or disable the implicit files domain Enable/disable debug backtrace Enabled Active Directory domains Enables FAST Enables enterprise principals Enables principal canonicalization Enables using of subdomains realms for authentication Enter PIN: Entry cache background update timeout length (seconds) Entry cache timeout length (seconds) Enumeration cache timeout length (seconds) Error during certificate matching [%d][%s].
Error looking up public keys
Error setting the locale
Error while executing external command
Error while executing external command '%s'
Error while reading configuration directory.
Error: Unable to get object [%d]: %s
FAST options ('never', 'try', 'demand') Failed to add mapping and matching rules with error [%d][%s].
Failed to decode base64 string.
Failed to generate mapping filter [%d][%s].
Failed to load configuration from %s.
Failed to open %s
Failed to run validators Failed to setup certmap context.
File %1$s does not exist.
File ownership and permissions check failed. Expected root:root and 0600.
File that contains CA certificates File that contains the client certificate File that contains the client key Files negative cache timeout length (seconds) Filter PAM responses sent to the pam_sss Filter for group lookups Filter for user lookups First Factor (Current Password): First Factor: Follow LDAP referrals Full Name GECOS attribute GID attribute Generate access report for a domain Group UUID attribute Group member attribute Group name Group password Groups that SSSD should explicitly ignore Home directory attribute Host identity provider Host not specified
Hostnames and/or fully qualified domain names of this machine to filter sudo rules How long (minutes) to deny login after offline_failed_login_attempts has been reached How long can cached credentials be used for cached authentication How long should SSSD talk to single DNS server before trying next server (miliseconds) How long should keep trying to resolve single DNS query (seconds) How long the PAC data is considered valid How long to allow cached logins between online logins (days) How long to keep cached entries after last successful login (days) How long to retain a connection to the LDAP server before disconnecting How long to wait for replies from DNS when resolving servers (seconds) How long will be in-memory cache records valid How many days before password expiration a warning should be displayed How many failed logins attempts are allowed when offline How many maximum entries to fetch during a wildcard request How many seconds to keep a host in the known_hosts file after its host keys were requested How many seconds to keep a host ssh key after refresh. IE how long to cache the host key for. How many seconds to keep identity information cached for PAM requests How many seconds will pam_sss wait for p11_child to finish How many seconds will pam_sss wait for passkey_child to finish How often should expired entries be refreshed in background How often should subdomains list be refreshed How often to periodically update the client's DNS entry How to dereference aliases IP host entryUSN attribute IP host name attribute IP host number (address) attribute IP network entryUSN attribute IP network name attribute IP network number (address) attribute IPA client hostname IPA domain IPA server address IPv4 or IPv6 addresses or network of this machine to filter sudo rules Identity provider Idle time before automatic disconnection of a client Idle time before automatic shutdown of the responder If 2-Factor-Authentication (2FA) is used and credentials should be saved this value determines the minimal length the first authentication factor (long term password) must have to be saved as SHA512 hash into the cache. If a shell stored in central directory is allowed but not available, use this fallback If set to false, host argument given by PAM will be ignored If true, SSSD will switch back to lower-wins ordering logic Ignore unreadable LDAP references Include microseconds in timestamps in debug logs Include timestamps in debug logs Index operation failed: %1$s
Indexes for domain %1$s:
Indicates what is the syntax of the config file. SSSD 0.6.0 and later use version 2. InfoPipe User lookup with [%s] failed.
Information about cached content: Information about cached group Information about cached netgroup Information about cached user Informs that the responder has been dbus-activated Informs that the responder has been socket-activated Initgroups expiration time Insert your passkey device, then press ENTER. Invalid input, please provide either '%s' or '%s'.
Invalid port
Invalid result. Invalidate all SSH hosts Invalidate all autofs maps Invalidate all cached entries Invalidate all cached sudo rules Invalidate all groups Invalidate all netgroups Invalidate all services Invalidate all users Invalidate cached objects Invalidate particular SSH host Invalidate particular autofs map Invalidate particular group Invalidate particular netgroup Invalidate particular service Invalidate particular sudo rule Invalidate particular user Issues identified by validators: %zu
Kerberos backup server address Kerberos realm Kerberos realm to use Kerberos server address Kerberos service keytab LDAP filter to determine access privileges Length of time between attempts to reconnect while offline Length of time between cache cleanups Length of time between enumeration updates Length of time to attempt connection Length of time to attempt synchronous LDAP operations Length of time to wait for a enumeration request Length of time to wait for a search request Lifetime of TGT for LDAP connection Lifetime of the TGT List available domains List of PAM services that are allowed to authenticate with GSSAPI. List of UIDs or user names allowed to access the PAC responder List of domains accessible even for untrusted users. List of options that should be inherited into a subdomain List of pairs : that must be enforced for PAM access with GSSAPI authentication List of possible ciphers suites List of trusted uids or user's name List of user attributes the InfoPipe is allowed to publish Local data tools: Location of the keytab to validate credentials Location of the user's credential cache Log files tools: Lower bound for ID-mapping Manage cache indexes Mapping filter:
%s
Mapping rule Matching rule Maximum age in days before the machine account password should be renewed Maximum nesting level SSSD will follow Maximum number of rules that can be refreshed at once. If this is exceeded, full refresh is performed. Maximum period deviation between enumeration updates Maximum period deviation when refreshing expired entries in background Maximum period deviation when refreshing the subdomain list Maximum period deviation when updating the client's DNS entry Maximum time deviation between cache cleanups Maximum user ID Message printed when user account is expired. Message printed when user account is locked. Messages generated during configuration merging: %zu
Minimum user ID Mode used to change user password Modification time attribute Modification time attribute for groups Modification time attribute for netgroups Name Name of attribute that is used as object class for sudo rules Name of the default domain for ID-mapping Negative cache timeout length (seconds) Netgroup name Netgroup triple attribute Netgroups members attribute New Password: No cache object matched the specified search
No servers discovered.
None so far.
Not enough memory
Number of IDs for each slice when ID-mapping Number of secondary slices Number of times to attempt connection to Data Providers Object class for IP hosts Object class for IP networks Object class for automounter map entries Object class for automounter maps Object class for sudo rules Objectclass for group override objects Objectclass for groups Objectclass for netgroups Objectclass for override objects Objectclass for services Objectclass for user override objects Objectclass for users Objectclass for view containers Offline One of the following strings specifying the scope of session recording: none - No users are recorded. some - Users/groups specified by users and groups options are recorded. all - All users are recorded. Online Online status: %s
Only invalidate entries from a particular domain Operation mode for GPO-based access control Option -g is incompatible with -D or -i
Option -i|--interactive is not allowed together with -D|--daemon
Option for tuning the machine account renewal task Out of memory!
Override GID value from the identity provider with this value Override existing backup Override homedir value from the identity provider with this value Override shell value from the identity provider with this value Override the DNS server used to perform the DNS update PAM Environment:
PAM action [auth|acct|setc|chau|open|clos], default: PAM service names for which GPO-based access is always denied PAM service names for which GPO-based access is always granted PAM service names that map to the GPO (Deny)BatchLogonRight policy settings PAM service names that map to the GPO (Deny)InteractiveLogonRight policy settings PAM service names that map to the GPO (Deny)NetworkLogonRight policy settings PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight policy settings PAM service names that map to the GPO (Deny)ServiceLogonRight policy settings PAM service, default: PAM stack to use PIN locked PKCS#11 URI to restrict the selection of devices for Smartcard authentication Passkey related tools: Password change failed. Password change provider Password expired. Change your password now. Password reset by root is not supported. Password: Passwords do not match Path of group file sources. Path of passwd file sources. Path to CA certificate directory Path to certificate database with PKCS#11 modules. Path to storage of trusted CA certificates Perform cache upgrade Perform passkey registration Perform static analysis of SSSD configuration Permission denied. Please (re)insert (different) Smartcard Please select at least one object to invalidate
Policy to evaluate the password expiration Primary GID attribute Print information about a user and check authentication Print information about domain Print information about the certificate Print the host ssh public keys Print version number and exit Printf-compatible format for displaying fully-qualified names Privileged socket has wrong ownership or permissions. Public socket has wrong ownership or permissions. Reenter new Password: Refresh the configuration database, then exit Regex to parse username and domain Remove existing SSSD log files Removing cache files...
Renewable lifetime of the TGT Requested lifetime of the ticket Requested renewable lifetime of the ticket Requests canonicalization of the principal name Require TLS certificate verification Require TLS for ID lookups Resolver provider Restart SSSD after data import Restore local data from backup Restoring local data...
Restrict or prefer a specific address family when performing DNS lookups Run PAC responder automatically for AD and IPA provider Run interactive (not a daemon) SELinux provider SID of the default domain for ID-mapping SSH public key attribute SSSD Domains to start SSSD InfoPipe user lookup result:
SSSD Services to start SSSD Status: SSSD backup of local data already exists, override? SSSD is already running
SSSD is not run by root. SSSD is not running.
SSSD monitors the state of resolv.conf to identify when it needs to update its internal DNS resolver. By default, we will attempt to use inotify for this, and will fall back to polling resolv.conf every five seconds if inotify cannot be used. SSSD must not be running. Stop SSSD now? SSSD needs to be restarted. Restart SSSD now? SSSD needs to be running. Start SSSD now? SSSD nss user lookup result:
SSSD socket does not exist. SUDO provider Scope of group lookups Scope of user lookups Search base for Desktop Profile related objects Search base for HBAC related objects Search base for SUBID ranges Search base for object containing info about IPA domain Search base for objects containing info about ID ranges Search base for view containers Search by SID Search by group ID Search by user ID Second Factor (optional): Second Factor: Selects the principal to use for FAST Server message: Server where the change password service is running if not on the KDC Service name attribute Service name for DNS service lookups Service port attribute Service protocol attribute Session management provider Set libldap debug level Set lower boundary for allowed IDs from the LDAP server Set the verbosity of the debug logging Set upper boundary for allowed IDs from the LDAP server Shell attribute Shell to use if the provider does not list one Should filtered users appear in groups Show debug information Show domain list including primary or trusted domain type Show information about active server Show list of discovered servers Show online status Show users mapped to the certificate Similar to --genconf, but only refreshes the given section Size (in megabytes) of the data table allocated inside fast in-memory cache for group requests Size (in megabytes) of the data table allocated inside fast in-memory cache for initgroups requests Size (in megabytes) of the data table allocated inside fast in-memory cache for passwd requests Smart and full refresh random offset Specifies the server principal to use for FAST Specifies time in seconds for which the list of subdomains will be considered valid. Specify a non-default config file Specify a non-default snippet dir (The default is to look in the same place where the main config file is located. For example if the config is set to "/my/path/sssd.conf", the snippet dir "/my/path/conf.d" is used) Specify base64 encoded certificate. Specify debug level you want to set Specify domain name. Specify name. Specify the maximal SSF for LDAP sasl authorization Specify the minimal SSF for LDAP sasl authorization Specify the sasl authorization id to use Specify the sasl authorization realm to use Specify the sasl mechanism to use Specify user name. Start SSSD if it is not running Start SSSD when the cache is removed Stop SSSD before removing the cache Store password if offline for later online authentication Substitute empty homedir value from the identity provider with this value Sudo rule command attribute Sudo rule host attribute Sudo rule name Sudo rule notafter attribute Sudo rule notbefore attribute Sudo rule option attribute Sudo rule order attribute Sudo rule runas attribute Sudo rule runasgroup attribute Sudo rule runasuser attribute Sudo rule user attribute System is offline, password change not possible Target a specific domain Target the AUTOFS service Target the IFP service Target the NSS service Target the PAC service Target the PAM service Target the SSH service Target the SSSD service Target the SUDO service Tevent chain ID used for logging purposes The LDAP attribute that contains DN of HBAC rule which can be used for matching instead of memberUser and memberHost. The LDAP attribute that contains FQDN of the host. The LDAP attribute that contains NIS domain name of the netgroup. The LDAP attribute that contains SELinux user string itself. The LDAP attribute that contains all hosts / hostgroups this rule match against. The LDAP attribute that contains all users / groups this rule match against. The LDAP attribute that contains host category such as 'all'. The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object. The LDAP attribute that contains the host's SSH public keys. The LDAP attribute that contains the name of SELinux usermap. The LDAP attribute that contains the names of the netgroup's members. The LDAP attribute that contains unique ID of the user map. The LDAP attribute that contains user category such as 'all'. The LDAP attribute that contains whether or not is user map enabled for usage. The LDAP attribute that corresponds to the netgroup name. The LDAP attribute that lists FQDNs of hosts and host groups that are members of the netgroup. The LDAP attribute that lists hosts and host groups that are direct members of the netgroup. The LDAP attribute that lists netgroup's memberships. The LDAP attribute that lists system users and groups that are direct members of the netgroup. The LDAP group external member attribute The SSSD domain to use The Schema Type in use on the LDAP server, rfc2307 The TTL to apply to the client's DNS entry after updating it The amount of time between lookups of the GPO policy files against the AD server The amount of time between lookups of the HBAC rules against the IPA server The amount of time in minutes between lookups of Desktop Profiles rules against the IPA server when the last request did not find any rule The amount of time in seconds between lookups of the Desktop Profile rules against the IPA server The amount of time in seconds between lookups of the SELinux maps against the IPA server The authentication token of the default bind DN The automounter location this IPA client is using The debug level to run with The default base DN The default bind DN The domain part of service discovery DNS query The entry cache can be set to automatically update entries in the background if they are requested beyond a percentage of the entry_cache_timeout value for the domain. The group ID to run the server as The group to create FAST ccache as The interface whose IP should be used for dynamic DNS updates The list of shells that will be vetoed, and replaced with the fallback shell The list of shells users are allowed to log in with The name of the NSS library to use The name of the NSS library to use for hosts and networks lookups The name of the automount master map in LDAP. The number of file descriptors that may be opened by this responder The number of members that must be missing to trigger a full deref The number of preforked proxy children. The number of records to retrieve in a single LDAP query The object class of a host entry in LDAP. The object class of a netgroup entry in LDAP. The option denotes that the SSSD is running on IPA server and should perform lookups of users and groups from trusted domains differently. The path to the proxy command must be absolute
The port to use to connect to the host The provider which should handle fetching of subdomains. This value should be always the same as id_provider. The type of the authentication token of the default bind DN The user ID to run the server as The user to create FAST ccache as The user to drop privileges to The value of the password field the NSS provider should return The value of this option will be used in the expansion of the override_homedir option if the template contains the format string %H. There is no configuration.
This domain has no active servers.
Time between two checks for renewal Treat usernames as case sensitive Truncating log files...
Tune certificate verification Tune certificate verification for PAM authentication. Tune passkey verification behavior Tune sssd to honor or ignore netlink state changes Type of the group and other flags UID attribute URI of a backup LDAP server where password changes are allowed URI of an LDAP server where password changes are allowed UUID attribute Unable to archive log files
Unable to connect to system bus!
Unable to create backup directory [%d]: %s Unable to create backup of local data, can not remove the cache.
Unable to export group overrides
Unable to export user overrides
Unable to get online status
Unable to get server list
Unable to import group overrides
Unable to import user overrides
Unable to parse command arguments
Unable to parse name %s.
Unable to read user input
Unable to remove cache files
Unable to remove log files
Unable to truncate log files
Unexpected argument(s) provided, options that invalidate a single object only accept a single provided argument.
Unexpected error while looking for an error description Unexpected format of the server credential message. Unknown action: %1$s
Valid actions are "%2$s", "%3$s and "%4$s"
Upper bound for ID-mapping Use ID-mapping of objectSID instead of pre-set IDs Use Kerberos auth for LDAP connection Use LDAPS port for LDAP and Global Catalog requests Use anonymous PKINIT to request FAST armor ticket Use anonymous PKINIT to request FAST credentials Use autorid-compatible algorithm for ID-mapping Use custom version of krb5_get_init_creds_password Use only the upper case for realm names Use the following matching rules to filter the certificates for ssh-key generation Use the given string as search base for host objects. Use the given string as search base for trusted domains. Used configuration snippet files: %zu
User name lookup with [%s] failed.
User not specified
User principal attribute (for Kerberos) Username attribute Users that SSSD should explicitly ignore Validate the PAC Various tags stored by the realmd configuration service for this domain. Watchdog timeout before restarting service What kind of authentication should be used to perform the DNS update What kind of messages are displayed to the user during authentication When SSSD switches to offline mode the amount of time before it tries to go back online will increase based upon the time spent disconnected. This value is in seconds and calculated by the following: offline_timeout + random_offset. When shall the PAM responder force an initgroups request Where to drop krb5 config snippets Whether the LDAP library should perform a reverse lookup to canonicalize the host name during a SASL bind Whether the domain is usable by the OS or by applications Whether the nsupdate utility should default to using TCP Whether the provider should explicitly update the PTR record as well Whether to automatically create private groups for users Whether to automatically update the client's DNS entry Whether to automatically update the client's DNS entry in FreeIPA Whether to create kdcinfo files Whether to evaluate the time-based attributes in sudo rules Whether to filter rules by hostname, IP addresses and network Whether to hash host names and addresses in the known_hosts file Whether to include rules that contains netgroup in host attribute Whether to include rules that contains regular expression in host attribute Whether to look up canonical group name from cache if possible Whether to match authenticated UPN with target user Whether to update the ldap_user_shadow_last_change attribute after a password change Whether to update the machine account password in the Samba database Whether to use Token-Groups Whether to use the Global Catalog for lookups Which PAM services are permitted to contact application domains Which attributes shall be used to evaluate if an account is expired Which rules should be used to evaluate access control Your password has expired. Your password has expired. You have %1$d grace login(s) remaining. Your password will expire in %1$d %2$s. a particular site to be used by the client accountExpires attribute of AD attribute attribute containing the X509 certificate of the user attribute containing the email address of the user attribute containing the passkey mapping data of the user attribute listing allowed authentication types for a user dlopen failed with [%s].
dlsym failed with [%s].
domain entryUSN attribute error krbLastPwdChange attribute krbPasswordExpiration attribute lastUSN attribute ldap_backup_uri, The URI of the LDAP server ldap_uri, The URI of the LDAP server loginAllowedTimeMap attribute of NDS loginDisabled attribute of NDS loginExpirationTime attribute of NDS malloc failed.
memberOf attribute no not connected nsAccountLock attribute objectSID attribute pam_acct_mgmt: %s
pam_authenticate for user [%s]: %s
pam_chauthtok: %s
pam_close_session: %s
pam_get_item failed: %s
pam_open_session: %s
pam_setcred: [%s]
pam_start failed: %s
set_debug_file_from_fd failed.
shadowExpire attribute shadowFlag attribute shadowInactive attribute shadowLastChange attribute shadowMax attribute shadowMin attribute shadowWarning attribute sss_getpwnam_r failed with [%d].
sss_ssh_knownhostsproxy: Could not resolve hostname %s
sss_ssh_knownhostsproxy: connect to host %s port %d: %s
sss_ssh_knownhostsproxy: unable to proxy data: %s
talloc_asprintf failed.
testing pam_acct_mgmt
testing pam_authenticate
testing pam_chauthtok
testing pam_close_session
testing pam_open_session
testing pam_setcred
unknown action
user: %s
action: %s
service: %s
userAccountControl attribute of AD yes Project-Id-Version: PACKAGE VERSION
Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org
PO-Revision-Date: 2023-06-10 12:20+0000
Last-Translator: Ludek Janda
Language-Team: Japanese
Language: ja
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Plural-Forms: nplurals=1; plural=0;
X-Generator: Weblate 4.17
å±æ§: %1$s
%s ã¯ãã£ãã·ã¥ã«ãããŸããã
- gecos: %s
- ã°ã«ãŒã id: %d
- ããŒã ãã£ã¬ã¯ããªãŒ: %s
- no env -
- ãããã³ã°ããããŠãŒã¶ãŒãèŠã€ãããŸãã - - shell: %s
- ãŠãŒã¶ãŒ id: %d
- ãŠãŒã¶ãŒå: %s
%1$-25s %2$#.4x
%1$-25s äžæãªãã¡ã€ã³
%1$-25s ã¢ã¯ã»ã¹ã§ããªããµãŒãã¹
%1$s 㯠root ãšããŠå®è¡ããå¿
èŠããããŸã
%s: å€ [%d] ã®èªã¿èŸŒã¿ãã§ããŸãã: %s
ããã£ãã·ã¥ããããã¹ã¯ãŒãã倱å¹ããŸã: scope=all ã®å Žåã«ã®ã¿èšé²ããé€å€ãããã¹ãã¡ã³ããŒããæãã°ã«ãŒãã®ã³ã³ãåºåããªã¹ãã ã»ãã·ã§ã³èšé²ãæå¹ã«ããŠããã¹ããŠãŒã¶ãŒã®ã°ã«ãŒãããšã®ã«ã³ãåºåãã®ãªã¹ãã§ããNSS ãè¿ãã°ã«ãŒãåã«ãããããŸããã€ãŸããã¹ããŒã¹ã®çœ®æã倧æåå°æåã®å€æŽãªã©ã®å¯èœæ§ãããå Žåã«ã¯ããã®åŸã«ãªããŸãã é²ç»ããé€å€ããããŠãŒã¶ãŒã®ã³ã³ãåºåããªã¹ããscope=all ã®å Žåã®ã¿ ã»ãã·ã§ã³èšé²ãæå¹ã«ããŠããã¹ããŠãŒã¶ãŒã®ã«ã³ãåºåãã®ãªã¹ãã§ããNSS ãè¿ããŠãŒã¶ãŒåã«ãããããŸããã€ãŸããã¹ããŒã¹ã®çœ®æã倧æåå°æåã®å€æŽãªã©ã®å¯èœæ§ãããå Žåã«ã¯ããã®åŸã«ãªããŸãã ãŠãŒã¶ãŒãšã³ããªãŒãšå
±ã«ããŠã³ããŒãããè¿œå çãªå±æ§ã®äžèŠ§ ãŠãŒã¶ãŒåãã Kerberos ããªã³ã·ãã«åãŸã§ã®ãããã³ã° æ€çŽ¢ãããã¡ã€ã³ã®ç¹å®ã®é çª ã¢ã¯ã»ã¹å¶åŸ¡ãããã€ã㌠ã¢ã¯ã·ã§ã³ãæå®ãããŠããŸãã
Active Directory ããã¯ã¢ãããµãŒããŒã®ã¢ãã¬ã¹ Active Directory ã¯ã©ã€ã¢ã³ããã¹ãå Active Directory ãã¡ã€ã³ ID ãããã³ã°ã® Active Directory ãã©ã€ããªãŒã°ã«ãŒãå±æ§ Active Directory ãµãŒããŒã¢ãã¬ã¹ ã¢ã¯ãã£ããµãŒããŒ:
èŠæ±ãããå Žåã«ãã«ãŒããåŸ
ã€è¿œå ã®ã¿ã€ã ã¢ãŠã ããã¯ã¢ãã IPA ãµãŒããŒã®ã¢ãã¬ã¹ OTP ãã¹ã¯ãŒãã®å€æŽåŸããã±ãããååŸããããã«ãã°ã¢ãŠãåŸã«åã³ãã°ã€ã³ããå¿
èŠããããŸã ã°ã«ãŒãåãŸãã¯ãŠãŒã¶ãŒåã®ãã¹ãŠã®ã¹ããŒã¹ã¯ããã®æåã«çœ®ãæããããŸã 蚌ææžããŒã¹ãŸãã¯ã¹ããŒãã«ãŒãã«ããèªèšŒãèš±å¯ããŸãã ã³ã¢ãã³ãã®èš±å¯ ãã¹ããŒããã€ã¹èªèšŒãèš±å¯ããŸãã 蚌ææžããã® ssh-key ã®çæãèš±å¯ããŸã ã¹ããŒãã«ãŒãã®äœ¿çšãèš±å¯ããããµãŒãã¹ RFC2307 ã¹ããŒãã䜿çšãããµãŒããŒã® LDAP ã°ã«ãŒãã®ã¡ã³ããŒãšããŠããŒã«ã«ãŠãŒã¶ãŒãä¿æããããšãã§ããŸãã ããŒã¿ãããã€ããŒãã¯ãšãªãŒããåã«ãåžžã«ãã¹ãŠã®ãã£ãã·ã¥ãã¯ãšãªãŒããŸã ãšã©ãŒãçºçããŸãããã説æããããŸããã§ããã ãããã°ãã°ã®ãªãŒãã³ãã¡ã€ã«ãã£ã¹ã¯ãªãã¿ãŒ ãã°ããŒã¿ã®åæ tarball 㧠SSSD ãã°ãã¡ã€ã«ãã¢ãŒã«ã€ã ãã°ãã¡ã€ã«ã %s ãžã¢ãŒã«ã€ãäž...
å±æ§ %1$s ã®ã€ã³ããã¯ã¹ã¯ãã§ã«äœæãããŠããŸãã
å±æ§ %1$s ã®ã€ã³ããã¯ã¹ã¯äœæãããŠããŸããã
å±æ§ (-a) ã¯æå®ãããŠããŸãã
ãµãŒããŒåŽãã¹ã¯ãŒãããªã·ãŒãæå¹ã§ããããšãæå³ããå±æ§ èªå¯ããã PAM ãµãŒãã¹ãäžèŠ§åããå±æ§ èªå¯ããããµãŒããŒãã¹ããäžèŠ§åããå±æ§ èªå¯ããããµãŒã㌠rhosts ãäžèŠ§åããå±æ§ ã€ã³ããã¯ã¹ã®å±æ§ ãã¥ãŒã®ååã®å±æ§ ãªãªãžãã«ãªããžã§ã¯ããåç
§ããå±æ§ %1$s ã§èªèšŒããENTER ãæŒããŸãã %2$s 㧠PIN %1$s ã䜿çšããŠèªèšŒããENTER ãæŒããŸãã ãã£ãã·ã¥ãããŠããã¯ã¬ãã³ã·ã£ã«ãçšããŠèªèšŒãããŸãã 次ãŸã§èªèšŒãæåŠãããŸã: èªèšŒãããã€ã㌠èªèšŒã®ã¿ã€ã ã¢ãŠã Autofs ãããã€ã㌠èªåçãªå®å
šæŽæ°éé èªåçãªã¹ããŒãæŽæ°éé automounter ããããšã³ããªãŒã®éµå±æ§ automounter ããããšã³ããªãŒã®å€å±æ§ ãªãŒãããŠã³ãã®ãããåã®å±æ§ ããŒã«ã«ããŒã¿ã®ããã¯ã¢ãã ããŒã«ã«ããŒã¿ã®ããã¯ã¢ãããšãã£ãã·ã¥ãããã³ã³ãã³ãã®åé€ IP ãã¹ãã®ã«ãã¯ã¢ããã®ããã®ããŒã¹ DN IP ãããã¯ãŒã¯æ€çŽ¢ã®ããã®ããŒã¹ DN automonter ã®ãããæ€çŽ¢ã®ããŒã¹ DN ã°ã«ãŒãæ€çŽ¢ã®ããŒã¹ DN ãããã°ã«ãŒãæ€çŽ¢ã®ããŒã¹ DN ãµãŒãã¹æ€çŽ¢ã®ããŒã¹ DN sudo ã«ãŒã«æ€çŽ¢ã®ããŒã¹ DN ãŠãŒã¶ãŒæ€çŽ¢ã®ããŒã¹ DN ããŒã¢ã³ãšããŠå®è¡ (ããã©ã«ã) ãªãã©ã€ã³ãã°ã€ã³ã®ããã«ã¯ã¬ãã³ã·ã£ã«ããã£ãã·ã¥ãã ãã£ãã·ã¥ãšã³ããªãŒã®äœææ¥ ãã£ãã·ã¥ãšã³ããªãŒã®æéåãæé ãã£ãã·ã¥ãšã³ããªãŒãæåŸã«æŽæ°ãããæé InfoPipe ã«ãã£ãã·ã¥ SSSD ãœã±ããã®çµ±èšãååŸã§ããŸããã 蚌ææžã¯ã«ãŒã«ã«äžèŽããŸããã
蚌ææžã¯ã«ãŒã«ãšäžèŽããŸãã
蚌ææžé¢é£ããŒã«: SSSD ãããã°ã¬ãã«æ
å ±ã®å€æŽãŸãã¯åºå PAC ãã©ã°ã確èªãã 蚌ææžã«ãããããã³ã°ããã³ãããã³ã°ã«ãŒã«ã®ç¢ºèª èš±å¯ãŠãŒã¶ãŒã®ã«ã³ãåºåãäžèŠ§ ãã°ã€ã³ãèš±å¯ãããã°ã«ãŒãã®ã«ã³ãåºåãã®äžèŠ§ãããã¯ãSSSDãã¡ã€ã³å
ã®ã°ã«ãŒãã«ã®ã¿é©çšãããŸããããŒã«ã«ã°ã«ãŒãã¯è©äŸ¡ãããŸããã æä»çã«ã¢ã¯ã»ã¹ãæåŠãããã°ã«ãŒãã®ã«ã³ãåºåãã®äžèŠ§ãããã¯ããã® SSSD ãã¡ã€ã³å
ã®ã°ã«ãŒãã«ã®ã¿é©çšãããŸããããŒã«ã«ã°ã«ãŒãã¯è©äŸ¡ãããŸããã çŠæ¢ãŠãŒã¶ãŒã®ã«ã³ãåºåãäžèŠ§ ã³ãã³ã '%s' ã [%d] ã§å€±æããŸãã
ãµãŒãã¹éå§ã®ã³ãã³ã èšå®ãã¡ã€ã«ããŒã«: ä¿¡é Œããããã¡ã€ã³ã®åæãå¶åŸ¡ å
éš DNS ãªãŸã«ããŒãæŽæ°ããå¿
èŠããããšããå€æããããã« SSSD ã resolv.conf ã®ç¶æ
ãç£èŠãããã©ãããå¶åŸ¡ããŸãã å©çšå¯èœãªãã¡ã€ã³ãéããŸããã§ãã
ãã¡ã€ã³ %1$s ãéããŸããã§ããããã¡ã€ã³ããµããã¡ã€ã³ (ä¿¡é Œæžã¿ãã¡ã€ã³) ã§ããã°ã--domain/-d ãã©ã¡ãŒã¿ãŒã®ä»£ããã«å®å
šä¿®é£Ÿåã䜿çšããŠãã ããã
%1$s ãç¡å¹åã§ããŸããã§ãã
%1$s %2$s ãç¡å¹åã§ããŸããã§ãã
ã¯ãªãŒã³ãªãã£ãã·ã¥ãã¡ã€ã«ãäœæããããŒã«ã«ããŒã¿ãã€ã³ããŒãããŸã ããŒã«ã«ããŒã¿ã®ããã¯ã¢ãããäœæäž...
ãã¡ã€ã³ %1$s ã®ãã£ãã·ã¥ã€ã³ããã¯ã¹ã®äœæ
çŸåšã®ãã¹ã¯ãŒã: ppolicy ã¯ãšãªãŒã® DN LDAP ãã¹ã¯ãŒãã®å€æŽãµãŒããŒã® DNS ãµãŒãã¹å ãããã³ã°ãããŠããªã PAM ãµãŒãã¹åã«äœ¿çšããããã©ã«ãã®ãã°ãªã³æš©å© (ãŸãã¯èš±å¯/æåŠ) ããã©ã«ãã®ãµããã¡ã€ã³ããŒã ãã£ã¬ã¯ããªãŒã®å€ åãæšãŠã代ããã«ãã°ãã¡ã€ã«ãåé€ããŸã ãã¡ã€ã³ %1$s ã®ãã£ãã·ã¥ã€ã³ããã¯ã¹ã®åé€
ãã°ãã¡ã€ã«ãåé€äž...
SSSD ã Kerberos ãªãã¬ã€ãã£ãã·ã¥ãã¡ã€ã«ãä¿åãããã¡ã€ã«ã·ã¹ãã ã®ãã£ã¬ã¯ããªãŒã§ãã ã¯ã¬ãã³ã·ã£ã«ã®ãã£ãã·ã¥ãä¿åãããã£ã¬ã¯ããªãŒ Active Directory ç¯å²ã®ååŸã®ç¡å¹å netlink ã€ã³ã¿ãŒãã§ãŒã¹ãç¡å¹ã«ãã LDAP ããŒãžã³ã°å¶åŸ¡ãç¡å¹åãã %s ãµãŒããŒãèŠã€ãããŸãã:
ãã¹ã¯ãŒãã®æéãåãã N æ¥åã®èŠåã衚瀺ããŸãã ãŠãŒã¶ãŒã»ã°ã«ãŒããå®å
šä¿®é£Ÿåœ¢åŒã§è¡šç€ºãã ä»ã®ãã¡ã€ã³ããã®ãã¡ã€ã³ããŒã«ã«ã°ã«ãŒãããã£ã«ã¿ãŒããªã æ
å ±ãããã€ããŒã®ãã¡ã€ã³ (å¿
é ) domain èŠçŽ ãªãã§è¿œå ãããã¡ã€ã³ã®ååã ãªã¢ãŒããããã€ããŒã®ã€ã³ããã¯ã¹ãå¿ããæŽæ°ããŠãã ããã
ã°ã«ãŒãæ€çŽ¢ã«ã°ã«ãŒãã¡ã³ããŒãå«ããªã ãšã©ãŒ: Tevent chain ID ãµããŒãããªãããã°ã¢ãã©ã€ã¶ãŒã¯ãµããŒããããŸããã
DNS ãµã€ãã®æå¹å - äœçœ®ããŒã¹ã®ãµãŒãã¹æ€çŽ¢ ã¯ã¬ãã³ã·ã£ã«ã®æ€èšŒãæå¹ã«ãã lifido2 ã©ã€ãã©ãªãŒã§ãããã°ãæå¹ã«ãã ãã¹ãŠã®ãŠãŒã¶ãŒã»ã°ã«ãŒãã®åæãæå¹ã«ãã ãã¹ãŠã® SSSD ããã»ã¹ã®ã³ã¢ãã³ããæå¹ãŸãã¯ç¡å¹ã«ããŸãã ãã¡ã€ã³ãæå¹ãŸãã¯ç¡å¹ã«ãã æé»ã®ãã¡ã€ã«ãã¡ã€ã³ãæå¹åãŸãã¯ç¡å¹åãã ãããã°ããã¯ãã¬ãŒã¹ã®æå¹å/ç¡å¹å æå¹åããã Active Directory ãã¡ã€ã³ FAST ãæå¹ã«ãã ãšã³ã¿ãŒãã©ã€ãºã»ããªã³ã·ãã«ã®æå¹å ããªã³ã·ãã«æ£èŠåãæå¹ã«ãã èªèšŒã«ãµããã¡ã€ã³ã¬ã«ã ã®äœ¿çšãæå¹å PIN ã®å
¥å: ãšã³ããªãŒãã£ãã·ã¥ã®ããã¯ã°ã©ãŠã³ãæŽæ°ã®ã¿ã€ã ã¢ãŠãæé (ç§) ãšã³ããªãŒãã£ãã·ã¥ã®ã¿ã€ã ã¢ãŠãé· (ç§) åæãã£ãã·ã¥ã®ã¿ã€ã ã¢ãŠã (ç§) 蚌ææžç
§äŒæã®ãšã©ãŒ [%d][%s]ã
å
¬ééµã®æ€çŽ¢äžã«ãšã©ãŒãçºçããŸãã
ãã±ãŒã«ã®èšå®äžã«ãšã©ãŒãçºçããŸãã
å€éšã®ã³ãã³ããå®è¡äžã«ãšã©ãŒãçºçããŸãã
å€éšã³ãã³ã '%s' ã®å®è¡æã®ãšã©ãŒ
èšå®ãã£ã¬ã¯ããªãŒã®èªã¿èŸŒã¿äžã«ãšã©ãŒãçºçããŸããã
ãšã©ãŒ: ãªããžã§ã¯ã [%d] ãååŸã§ããŸãã: %s
FAST ã®ãªãã·ã§ã³ ('never'ã'try'ã'demand') ãšã©ãŒ [%d][%s] ã«ããããããã³ã°ããã³ãããã³ã°ã«ãŒã«ãè¿œå ã§ããŸããã§ããã
base64 æååã®ãã³ãŒãã«å€±æããŸããã
ãããã³ã°ãã£ã«ã¿ãŒãçæã§ããŸããã§ãã [%d][%s]ã
%s ããã®èšå®ã®èªã¿èŸŒã¿ã«å€±æããŸããã
%s ãéãããšã«å€±æããŸãã
ããªããŒã¿ãŒã®å®è¡ã«å€±æããŸãã certmap ã³ã³ããã¹ãã®èšå®ã«å€±æããŸããã
ãã¡ã€ã« %1$s ã¯ååšããŸããã
ãã¡ã€ã«ã®æææš©ãšããŒããã·ã§ã³ã®ç¢ºèªã«å€±æããŸãããäºæããã root:root ããã³ 0600ã
CA 蚌ææžãå«ããã¡ã€ã« ã¯ã©ã€ã¢ã³ã蚌ææžãå«ããã¡ã€ã« ã¯ã©ã€ã¢ã³ãã®éµãå«ããã¡ã€ã« ãã¡ã€ã«ãã¬ãã£ããã£ãã·ã¥ã®ã¿ã€ã ã¢ãŠãæé (ç§) pam_sss ãžéä¿¡ããã PAM ã®ã¬ã¹ãã³ã¹ããã£ã«ã¿ãªã³ã°ããŸã ã°ã«ãŒãæ€çŽ¢ã®ãã£ã«ã¿ãŒ ãŠãŒã¶ãŒæ€çŽ¢ã®ãã£ã«ã¿ãŒ 1 çªç®ã®èŠçŽ (çŸåšã®ãã¹ã¯ãŒã): 1 çªç®ã®èŠçŽ : LDAP ãªãã§ã©ã«ã«ãããã æ°å GECOS ã®å±æ§ GID å±æ§ ãã¡ã€ã³ã®ã¢ã¯ã»ã¹ã¬ããŒããçæããŸã ã°ã«ãŒã UUID å±æ§ ã°ã«ãŒãã¡ã³ããŒå±æ§ ã°ã«ãŒãå ã°ã«ãŒãã®ãã¹ã¯ãŒã SSSD ãæ瀺çã«ç¡èŠããã°ã«ãŒã ããŒã ãã£ã¬ã¯ããªãŒã®å±æ§ ãã¹ãèå¥ãããã€ã㌠ãã¹ããæå®ãããŠããŸãã
sudo ã«ãŒã«ããã£ã«ã¿ãŒãããã®ãã·ã³ã®ãã¹ãåããã³/ãŸãã¯å®å
šä¿®é£Ÿãã¡ã€ã³å offline_failed_login_attempts ã«éããåŸã«ãã°ã€ã³ãæåŠããæé (å) 蚌ææžãã£ãã·ã¥ãèªèšŒãã£ãã·ã¥ã«äœ¿çšã§ããæé 次ã®ãµãŒããŒãè©Šè¡ãããŸã§ã« SSSD ãåäžã® DNS ãµãŒããŒãšéä¿¡ããæé (ããªç§) åäžã® DNS ã¯ãšãªãŒã®è§£æ±ºãè©Šè¡ããæé (ç§) PAC ããŒã¿ãæå¹ãšãããæé ãªã³ã©ã€ã³ãã°ã€ã³äžã«ãã£ãã·ã¥ã«ãããã°ã€ã³ã蚱容ãããæé (æ¥æ°) æçµãã°ã€ã³æåæãããã£ãã·ã¥ãšã³ããªãŒãä¿æããæ¥æ° LDAP ãµãŒããŒãåæããåã«æ¥ç¶ãä¿æããæé ãµãŒããŒãåå解決ããæã« DNS ããå¿çãåŸ
ã€æé (ç§) ã¡ã¢ãªãŒå
ã®ãã£ãã·ã¥ã¬ã³ãŒããæå¹ãªæé èŠåã衚瀺ããããã¹ã¯ãŒã倱å¹åã®æ¥æ° ãªãã©ã€ã³ã®æã«èš±å®¹ããããã°ã€ã³è©Šè¡å€±æåæ° ã¯ã€ã«ãã«ãŒãã®èŠæ±ã®éã«ååŸããæ倧ãšã³ããªãŒã®æ° ãã¹ãéµãèŠæ±ãããåŸ known_hosts ãã¡ã€ã«ã«ãã¹ããä¿æããç§æ° ãªãã¬ãã·ã¥åŸã«ãã¹ãã® ssh éµãä¿æããã«ã¯äœç§ãããããIE ãã¹ãããŒãäœç§ãã£ãã·ã¥ãããã PAM èŠæ±ã«å¯ŸããŠãã£ãã·ã¥ãããèªèšŒæ
å ±ãä¿æããç§æ° p11_child ãå®äºãããŸã§ã« pam_sss ãåŸ
ã€ç§æ° pam_sss ã passkey_child ã®çµäºãåŸ
æ©ããç§æ° æéåãã®ãšã³ããªãŒãããã¯ã°ã©ãŠã³ãã§æŽæ°ãããé »åºŠ ãµããã¡ã€ã³ã®äžèŠ§ã®ãªãã¬ãã·ã¥åæ° ã©ã®ãããå®æçã«ã¯ã©ã€ã¢ã³ãã® DNS ãšã³ããªãŒãæŽæ°ããã ãšã€ãªã¢ã¹ãåç
§è§£æ±ºããæ¹æ³ IP ãã¹ããšã³ããªãŒ USN å±æ§ IP ãã¹ãåå±æ§ IP ãã¹ãçªå· (ã¢ãã¬ã¹) å±æ§ IP ãããã¯ãŒã¯ãšã³ããªãŒ USN å±æ§ IP ãããã¯ãŒã¯åå±æ§ IP ãããã¯ãŒã¯çªå· (ã¢ãã¬ã¹) å±æ§ IPA ã¯ã©ã€ã¢ã³ãã®ãã¹ãå IPA ãã¡ã€ã³ IPA ãµãŒããŒã®ã¢ãã¬ã¹ sudo ã«ãŒã«ããã£ã«ã¿ãŒãããã®ãã·ã³ã® IPv4 ãŸã㯠IPv6 ã¢ãã¬ã¹ãŸãã¯ãããã¯ãŒã¯ ã¢ã€ãã³ãã£ãã£ãŒãããã€ã㌠ã¯ã©ã€ã¢ã³ãã®èªååæãŸã§ã®ã¢ã€ãã«æé ã¬ã¹ãã³ããŒã®èªåã·ã£ããããŠã³ãŸã§ã®ã¢ã€ãã«æé 2-Factor-Authentication (2FA) ã䜿çšãããèªèšŒæ
å ±ãä¿åããå¿
èŠãããå Žåããã®å€ã¯ãæåã®èªèšŒèŠçŽ (é·æãã¹ã¯ãŒã) ã SHA512 ããã·ã¥ãšããŠãã£ãã·ã¥ã«ä¿åããå¿
èŠãããæå°ã®é·ãã決å®ããŸãã äžå€®ãã£ã¬ã¯ããªãŒã«ä¿åãããã·ã§ã«ãèš±å¯ãããããå©çšã§ããªãå Žåããã®ãã©ãŒã«ããã¯ã䜿çšãã ããåœã«èšå®ãããŠãããšãPAM ã«ããæž¡ããããã¹ãåŒæ°ã¯ç¡èŠãããŸã æ£ããå ŽåãSSSD ã¯å°ããçªå·ãåªå
ãããé äœä»ãã®ããžãã¯ãžæ»ããŸã èªãããšã®ã§ããªã LDAP åç
§ãç¡èŠãã ãããã°ãã°ã«ããªç§åäœã®ã¿ã€ã ã¹ã¿ã³ããå«ãã ãããã°ãã°ã«ã¿ã€ã ã¹ã¿ã³ããå«ãã ã€ã³ããã¯ã¹æäœã«å€±æããŸãã: %1$s
ãã¡ã€ã³ %1$s ã®ã€ã³ããã¯ã¹:
èšå®ãã¡ã€ã«ã®æ§æã瀺ããŸããSSSD 0.6.0 以éã¯ããŒãžã§ã³ 2 ã䜿çšããŸãã [%s] ã§ã® InfoPipe ãŠãŒã¶ãŒã®æ€çŽ¢ã«å€±æããŸããã
ãã£ãã·ã¥ãããã³ã³ãã³ãã®æ
å ±: ãã£ãã·ã¥ãããã°ã«ãŒãã®æ
å ± ãã£ãã·ã¥ããã netgroup ã®æ
å ± ãã£ãã·ã¥ããããŠãŒã¶ãŒã®æ
å ± ã¬ã¹ãã³ããŒã dbus ã§ã¢ã¯ãã£ããŒãããããšç¥ãããŸã ã¬ã¹ãã³ããŒããœã±ããã§ã¢ã¯ãã£ããŒãããããšç¥ãããŸã Initgroups ã®æéåãæé ãã¹ããŒããã€ã¹ãæ¿å
¥ããENTER ããŒãæŒããŸãã ç¡å¹ãªã€ã³ãããã§ãã'%s' ãŸã㯠'%s' ã®ãããããæäŸããŠãã ããã
ç¡å¹ãªããŒã
ç¡å¹ãªçµæã ãã¹ãŠã® SSH ãã¹ããç¡å¹åããŸã ãã¹ãŠã® autofs ãããã®ç¡å¹å ãã¹ãŠã®ãã£ãã·ã¥ãšã³ããªãŒãç¡å¹åããŸã ãã¹ãŠã®ãã£ãã·ã¥ sudo ã«ãŒã«ãç¡å¹åããŸã ãã¹ãŠã®ã°ã«ãŒããç¡å¹ã«ãã ãã¹ãŠã®ãããã¯ãŒã¯ã°ã«ãŒããç¡å¹ã«ãã ãã¹ãŠã®ãµãŒãã¹ã®ç¡å¹å ãã¹ãŠã®ãŠãŒã¶ãŒãç¡å¹ã«ãã ãã£ãã·ã¥ããããªããžã§ã¯ãã®ç¡å¹å ç¹å®ã® SSH ãã¹ããç¡å¹åããŸã ç¹å®ã® autofs ãããã®ç¡å¹å ç¹å®ã®ã°ã«ãŒããç¡å¹ã«ãã ç¹å®ã®ãããã¯ãŒã¯ã°ã«ãŒããç¡å¹ã«ãã ç¹å®ã®ãµãŒãã¹ã®ç¡å¹å ç¹å®ã® sudo ã«ãŒã«ãç¡å¹åããŸã ç¹å®ã®ãŠãŒã¶ãŒãç¡å¹ã«ãã ããªããŒã¿ãŒã§ç¹å®ãããåé¡: %zu
Kerberos ããã¯ã¢ãããµãŒããŒã®ã¢ãã¬ã¹ Kerberos ã¬ã«ã 䜿çšãã Kerberos ã¬ã«ã Kerberos ãµãŒããŒã®ã¢ãã¬ã¹ Kerberos ãµãŒãã¹ã®ããŒããŒãã« ã¢ã¯ã»ã¹æš©éã決ããããã® LDAP ãã£ã«ã¿ãŒ ãªãã©ã€ã³ã®éã«åæ¥ç¶ãè©Šè¡ããæé ãã£ãã·ã¥ãã¯ãªãŒã³ã¢ããããéé åæã®æŽæ°éé æ¥ç¶ãè©Šè¡ããæé LDAP åææäœãè©Šè¡ããæé åæã®èŠæ±ãåŸ
ã€æé æ€çŽ¢èŠæ±ãåŸ
ã€æé LDAP æ¥ç¶ã® TGT ã®æå¹æé TGT ã®æå¹æé å©çšå¯èœãªãã¡ã€ã³ãäžèŠ§è¡šç€ºããŸã GSSAPI ã§ã®èªèšŒãèš±å¯ããã PAM ãµãŒãã¹ã®äžèŠ§ã PAC ã¬ã¹ãã³ããŒãžã®ã¢ã¯ã»ã¹ãèš±å¯ããã UID ãŸãã¯ãŠãŒã¶ãŒåã®äžèŠ§ ä¿¡é Œã§ããªããŠãŒã¶ãŒã§ããã¢ã¯ã»ã¹å¯èœãªãã¡ã€ã³ã®äžèŠ§ã ãµããã¡ã€ã³ã«ç¶æ¿ãã¹ããªãã·ã§ã³ã®äžèŠ§ GSSAPI èªèšŒã§ PAM ã¢ã¯ã»ã¹ã匷å¶ããå¿
èŠãããã㢠: ã®ãªã¹ã å©çšå¯èœãªæå·ã®äžèŠ§ ä¿¡é Œã§ãã UID ãŸãã¯ãŠãŒã¶ãŒåã®äžèŠ§ InfoPipe ããããªãã·ã¥ãèš±å¯ããããŠãŒã¶ãŒå±æ§ã®äžèŠ§ ããŒã«ã«ããŒã¿ããŒã«: ã¯ã¬ãã³ã·ã£ã«ãæ€èšŒããããŒããŒãã«ã®å Žæ ãŠãŒã¶ãŒã®ã¯ã¬ãã³ã·ã£ã«ãã£ãã·ã¥ã®äœçœ® ãã°ãã¡ã€ã«ããŒã«: ID ãããã³ã°ã®äžé ãã£ãã·ã¥ã€ã³ããã¯ã¹ã®ç®¡ç ãããã³ã°ãã£ã«ã¿ãŒ:
%s
ãããã³ã°ã«ãŒã« ãããã³ã°ã«ãŒã« ãã·ã³ã¢ã«ãŠã³ãã®ãã¹ã¯ãŒãã®æŽæ°ãå¿
èŠãšãªããŸã§ã®æ倧æ¥æ° SSSD ãåŸãæ倧ãã¹ãã¬ãã« äžåºŠã«ãªãã¬ãã·ã¥å¯èœãªã«ãŒã«ã®æ倧æ°ãæ倧æ°ãè¶
ãããšããã«ãªãã¬ãã·ã¥ãå®è¡ãããŸãã åææŽæ°ééã®æ倧æéã®éžè± ããã¯ã°ã©ãŠã³ãã§æéåãã®ãšã³ããªãŒãæŽæ°ãããšãã®æ倧æéã®éžè± ãµããã¡ã€ã³ãªã¹ããæŽæ°ãããšãã®æ倧æéã®éžè± ã¯ã©ã€ã¢ã³ãã® DNS ãšã³ããªãŒãæŽæ°ãããšãã®æ倧æéã®éžè± ãã£ãã·ã¥ã¯ãªãŒã³ã¢ããééã®æ倧æéã®éžè± æ倧ãŠãŒã¶ãŒ ID ãŠãŒã¶ãŒã¢ã«ãŠã³ãã®æå¹æéãåãããšãã¡ãã»ãŒãžãå°å·ãããŸãã ãŠãŒã¶ãŒã¢ã«ãŠã³ããããã¯ããããšãã¡ãã»ãŒãžãå°å·ãããŸãã èšå®ã®ããŒãžäžã«çæãããã¡ãã»ãŒãž: %zu
æå°ãŠãŒã¶ãŒ ID ãŠãŒã¶ãŒã®ãã¹ã¯ãŒãã®å€æŽã«ã¢ãŒãã䜿çšããŸãã å€æŽæ¥æã®å±æ§ ã°ã«ãŒãã®å€æŽæ¥æã®å±æ§ ãããã°ã«ãŒãã®å€æŽæ¥æã®å±æ§ åå sudo ã«ãŒã«ã®ãªããžã§ã¯ãã¯ã©ã¹ãšããŠäœ¿çšãããå±æ§ã®åå ID ãããã³ã°ã«å¯Ÿããããã©ã«ããã¡ã€ã³ã®åå ãã¬ãã£ããã£ãã·ã¥ã®ã¿ã€ã ã¢ãŠã (ç§) ãããã°ã«ãŒãå ãããã°ã«ãŒãã®äžã€çµã®å±æ§ ãããã°ã«ãŒãã¡ã³ããŒã®å±æ§ æ°ãããã¹ã¯ãŒã: æå®ãããæ€çŽ¢ã«äžèŽãããã£ãã·ã¥ãªããžã§ã¯ãããããŸãã
ãµãŒããŒãèŠã€ãããŸããã
ä»ã®ãšãããããŸããã
ååãªã¡ã¢ãªãŒããããŸãã
ID ãããã³ã°ãããšããåã¹ã©ã€ã¹ã«å¯Ÿãã ID ã®æ° ã»ã«ã³ããªãŒã¹ã©ã€ã¹ã®æ° ããŒã¿ãããã€ããŒã®æ¥ç¶ãè©Šè¡ããåæ° IP ãã¹ãã®ãªããžã§ã¯ãã¯ã©ã¹ IP ãããã¯ãŒã¯ã®ãªããžã§ã¯ãã¯ã©ã¹ automounter ããããšã³ããªãŒã®ãªããžã§ã¯ãã¯ã©ã¹ automounter ãããã®ãªããžã§ã¯ãã¯ã©ã¹ sudo ã«ãŒã«ã®ãªããžã§ã¯ãã¯ã©ã¹ ã°ã«ãŒããäžæžããããªããžã§ã¯ãã®ãªããžã§ã¯ãã¯ã©ã¹ ã°ã«ãŒãã®ãªããžã§ã¯ãã¯ã©ã¹ ãããã°ã«ãŒãã®ãªããžã§ã¯ãã¯ã©ã¹ äžæžãããããªããžã§ã¯ãã®ãªããžã§ã¯ãã¯ã©ã¹ ãµãŒãã¹ã®ãªããžã§ã¯ãã¯ã©ã¹ ãŠãŒã¶ãŒãäžæžããããªããžã§ã¯ãã®ãªããžã§ã¯ãã¯ã©ã¹ ãŠãŒã¶ãŒã®ãªããžã§ã¯ãã¯ã©ã¹ ãã¥ãŒã³ã³ãããŒã®ãªããžã§ã¯ãã¯ã©ã¹ ãªãã©ã€ã³ ã»ãã·ã§ã³èšé²ã®ç¯å²ãæå®ãã以äžã®æååã® 1 ã€: none: èšé²ããããŠãŒã¶ãŒã¯ããŸãããsome: ãŠãŒã¶ãŒãšã°ã«ãŒããªãã·ã§ã³ã«ãã£ãŠæå®ãããŠãããŠãŒã¶ãŒ/ã°ã«ãŒããèšé²ãããŠããŸããall: ãã¹ãŠã®ãŠãŒã¶ãŒãèšé²ãããŸãã ãªã³ã©ã€ã³ ãªã³ã©ã€ã³ç¶æ
: %s
ç¹å®ã®ãã¡ã€ã³ã®ã¿ãããšã³ããªãŒãç¡å¹ã«ãã ã°ããŒãã«ã«ã¿ãã°ããŒã¹ã®ã¢ã¯ã»ã¹å¶åŸ¡ã«å¯Ÿãããªãã¬ãŒã·ã§ã³ã¢ãŒã Option -g 㯠-D ãŸã㯠-i ãšäºææ§ããããŸãã
Option -i|--interactive iã¯ã -D|--daemon ãšã¯äœ¿çšã§ããŸãã
ãã·ã³ã¢ã«ãŠã³ãã®æŽæ°ã¿ã¹ã¯ããã¥ãŒãã³ã°ãããªãã·ã§ã³ ã¡ã¢ãªãŒã®ç©ºã容éããããŸããã
èå¥ãããã€ããŒããã® GID å€ããã®å€ã§äžæžããã æ¢åã®ããã¯ã¢ãããäžæžã èå¥ãããã€ããŒããã®ããŒã ãã£ã¬ã¯ããªãŒã®å€ããã®å€ã§äžæžããã ã¢ã€ãã³ãã£ãã£ãŒãããã€ããŒããã®ã·ã§ã«å€ããã®å€ã§äžæžãããŸã DNS ã®æŽæ°ãå®è¡ããéã«äœ¿çšãã DNS ãµãŒããŒãäžæžã PAM ç°å¢:
PAM ã¢ã¯ã·ã§ã³ [auth|acct|setc|chau|open|clos]ãããã©ã«ã: GPO ããŒã¹ã®ã¢ã¯ã»ã¹ãåžžã«æåŠããã PAM ãµãŒãã¹å GPO ããŒã¹ã®ã¢ã¯ã»ã¹ãåžžã«èš±å¯ããã PAM ãµãŒãã¹å GPO (Deny)BatchLogonRight ã®ããªã·ãŒèšå®ã«ãããã³ã°ãã PAM ãµãŒãã¹å GPO (Deny)InteractiveLogonRight ã®ããªã·ãŒèšå®ã«ãããã³ã°ãã PAM ãµãŒãã¹å GPO (Deny)NetworkLogonRight ã®ããªã·ãŒèšå®ã«ãããã³ã°ãã PAM ãµãŒãã¹å GPO (Deny)RemoteInteractiveLogonRight ã®ããªã·ãŒèšå®ã«ãããã³ã°ãã PAM ãµãŒãã¹å (Deny)ServiceLogonRight ã®ããªã·ãŒèšå®ã«ãããã³ã°ãã PAM ãµãŒãã¹å PAM ãµãŒãã¹ãããã©ã«ã: 䜿çšãã PAM ã¹ã¿ã㯠PIN ãããã¯ãããŸãã ã¹ããŒãã«ãŒãèªèšŒåãã®ããã€ã¹ã®éžæã PKCS#11 URI ãå¶é ãã¹ããŒé¢é£ã®ããŒã«: ãã¹ã¯ãŒãã®å€æŽã«å€±æããŸããã ãã¹ã¯ãŒãå€æŽãããã€ã㌠ãã¹ã¯ãŒãã®æéãåããŸãããããŸãããã¹ã¯ãŒããå€æŽããŠãã ããã root ã«ãããã¹ã¯ãŒãã®ãªã»ããã¯ãµããŒããããŸããã ãã¹ã¯ãŒã: ãã¹ã¯ãŒããäžèŽããŸãã ã°ã«ãŒããã¡ã€ã«ãœãŒã¹ãžã®ãã¹ã passwd ãã¡ã€ã«ãœãŒã¹ãžã®ãã¹ã CA 蚌ææžã®ãã£ã¬ã¯ããªãŒã®ãã¹ PKCS#11 ã¢ãžã¥ãŒã«ã§ã®èšŒææžããŒã¿ããŒã¹ãžã®ãã¹ã ä¿¡é Œããã CA 蚌ææžã®ã¹ãã¬ãŒãžãžã®ãã¹ ãã£ãã·ã¥ã¢ããã°ã¬ãŒãã®å®è¡ ãã¹ããŒç»é²ã®å®è¡ SSSD èšå®ã®éçåæãå®è¡ ããŒããã·ã§ã³ãæåŠãããŸããã (å¥ã®)ã¹ããŒãã«ãŒããæ¿å
¥(ãçŽ)ããŠãã ãã ç¡å¹åãããªããžã§ã¯ããå°ãªããšãäžã€éžæããŠãã ãã
ãã¹ã¯ãŒã倱å¹ã®è©äŸ¡ã®ããªã·ãŒ ãã©ã€ããªãŒ GID ã®å±æ§ ãŠãŒã¶ãŒã«é¢ããæ
å ±ãåºåããèªèšŒã確èªããŸã ãã¡ã€ã³æ
å ±ãåºåããŸã 蚌ææžã®æ
å ±ãåºå ãã¹ã SSH å
¬ééµãå°å· ããŒãžã§ã³çªå·ã衚瀺ããŠçµäºãã å®å
šä¿®é£Ÿåã衚瀺ããããã® printf äºæã®åœ¢åŒ ç¹æš©ãœã±ããã®ææè
ãŸãã¯ããŒããã·ã§ã³ã誀ã£ãŠããŸãã å
¬éãœã±ããã®ææè
ãŸãã¯ããŒããã·ã§ã³ã誀ã£ãŠããŸãã æ°ãããã¹ã¯ãŒãã®åå
¥å: èšå®ããŒã¿ããŒã¹ããªãã¬ãã·ã¥ãããã®åŸçµäºããŸã ãŠãŒã¶ãŒåãšãã¡ã€ã³ãæ§æ解æããæ£èŠè¡šçŸ æ¢å SSSD ãã°ãã¡ã€ã«ã®åé€ ãã£ãã·ã¥ãã¡ã€ã«ã®åé€äž...
æŽæ°å¯èœãª TGT ã®æå¹æé ãã±ããã®èŠæ±ãããæå¹æé ãã±ããã®èŠæ±ãããæŽæ°å¯èœãªæå¹æé ããªã³ã·ãã«åã®æ£èŠåãèŠæ±ããŸã TLS 蚌ææžã®æ€èšŒãèŠæ±ãã ID æ€çŽ¢ã« TLS ãèŠæ±ãã ãªãŸã«ããŒãããã€ã ããŒã¿ã®ã€ã³ããŒãã®åŸãSSSD ãåèµ·åããŸã ããã¯ã¢ããããããŒã«ã«ããŒã¿ã埩å
ããŒã«ã«ããŒã¿ã®åŸ©å
äž...
DNS æ€çŽ¢ãå®è¡ããæã«ç¹å®ã®ã¢ãã¬ã¹ãã¡ããªãŒãå¶éãŸãã¯åªå
ããŸã AD ããã³ IPA ãããã€ããŒã«å¯Ÿã㊠PAC ã¬ã¹ãã³ããŒãèªåçã«å®è¡ãã 察話çã«å®è¡ (ããŒã¢ã³ã§ã¯ãªã) SELinux ãããã€ã㌠ID ãããã³ã°ã«å¯Ÿããããã©ã«ããã¡ã€ã³ã® SID SSH å
¬ééµã®å±æ§ éå§ãã SSSD ãã¡ã€ã³ SSSD InfoPipe ãŠãŒã¶ãŒæ€çŽ¢ã®çµæ:
éå§ãã SSSD ãµãŒãã¹ SSSD ã¹ããŒã¿ã¹: ããŒã«ã«ããŒã¿ã® SSSD ããã¯ã¢ããã¯ãã§ã«ååšããŸãããäžæžãããŸãã? SSSD ã¯ãã§ã«å®è¡äžã§ã
SSSD 㯠root ã«ããå®è¡ãããŸããã SSSD ã¯å®è¡ãããŠããŸããã
SSSD ã¯ãå
éš DNSãªãŸã«ããŒãæŽæ°ããå¿
èŠããããšããèå¥ããããã« resolv.conf ã®ç¶æ
ãç£èŠããŸããããã©ã«ãã§ã¯ãinotify ã®äœ¿çšãè©Šè¡ããŸãããŸããinotify ã䜿çšã§ããªãå Žåã¯ã5 ç§ããšã« resolv.conf ã®ããŒãªã³ã°ã«ãã©ãŒã«ããã¯ããŸãã SSSD ãå®è¡ããŠã¯ãããŸãããSSSD ãä»ãåæ¢ããŸãã? SSSD ã¯åèµ·åãå¿
èŠã§ããSSSD ãä»ãåèµ·åããŸãã? SSSD ãå®è¡ããå¿
èŠããããŸããSSSD ãããã«å®è¡ããŸãã? SSSD nss ãŠãŒã¶ãŒæ€çŽ¢ã®çµæ:
SSSD ãœã±ããã¯ååšããŸããã SUDO ãããã€ã㌠ã°ã«ãŒãæ€çŽ¢ã®ç¯å² ãŠãŒã¶ãŒæ€çŽ¢ã®ç¯å² ãã¹ã¯ããããããã¡ã€ã«ã«é¢é£ãããªããžã§ã¯ãã®æ€çŽ¢ããŒã¹ HBAC é¢é£ãªããžã§ã¯ãã®æ€çŽ¢ããŒã¹ SUBID ç¯å²ã®æ€çŽ¢ããŒã¹ IPA ãã¡ã€ã³ã«é¢ããæ
å ±ãå«ããªããžã§ã¯ãã«å¯Ÿããæ€çŽ¢ããŒã¹ ID ç¯å²ã«é¢ããæ
å ±ãå«ããªããžã§ã¯ãã«å¯Ÿããæ€çŽ¢ããŒã¹ ãã¥ãŒã³ã³ãããŒã®æ€çŽ¢ããŒã¹ SID ã§æ€çŽ¢ ã°ã«ãŒã ID ã§æ€çŽ¢ ãŠãŒã¶ãŒID ã§æ€çŽ¢ 2 çªç®ã®èŠçŽ (ãªãã·ã§ã³): 2 çªç®ã®èŠçŽ : FAST ã«äœ¿çšããããªã³ã·ãã«ãéžæãã ãµãŒããŒã®ã¡ãã»ãŒãž: KDC ã«ãªããã°ããã¹ã¯ãŒãå€æŽãµãŒãã¹ãå®è¡ãããŠãããµãŒã㌠ãµãŒãã¹åã®å±æ§ DNS ãµãŒãã¹æ€çŽ¢ã®ãµãŒãã¹å ãµãŒãã¹ããŒãã®å±æ§ ãµãŒãã¹ãããã³ã«ã®å±æ§ ã»ãã·ã§ã³ãããŒãžã£ãŒã®ãããã€ã㌠libldap ãããã°ã¬ãã«ã®èšå® LDAP ãµãŒããŒããèš±å¯ããã ID ã®äžéã®èšå® ãããã°ã®ãã®ã³ã°ã®åé·æ§ãèšå®ãã LDAP ãµãŒããŒããèš±å¯ããã ID ã®äžéã®èšå® ã·ã§ã«ã®å±æ§ ãããã€ããŒãäžèŠ§ã«æã£ãŠããªããšã䜿çšããã·ã§ã« ãã£ã«ã¿ãŒããããŠãŒã¶ãŒãã°ã«ãŒãã«è¡šç€ºãã ãããã°æ
å ±ã®è¡šç€º ãã©ã€ããªãŒãŸãã¯ä¿¡é Œããããã¡ã€ã³ã¿ã€ããå«ããã¡ã€ã³ãªã¹ãã衚瀺ããŸã ã¢ã¯ãã£ããµãŒããŒã«é¢ããæ
å ±ã®è¡šç€º èŠã€ãã£ããµãŒããŒã«é¢ããäžèŠ§ã衚瀺 ãªã³ã©ã€ã³ç¶æ
ã衚瀺 蚌ææžã«ãããã³ã°ããããŠãŒã¶ãŒã®è¡šç€º --genconf ãšäŒŒãŠããŸãããä»»æã®ã»ã¯ã·ã§ã³ã®ã¿ããªãã¬ãã·ã¥ããŸã ã°ã«ãŒãèŠæ±ã®é«éã€ã³ã¡ã¢ãªãŒãã£ãã·ã¥å
ã§å²ãåœãŠãããããŒã¿ããŒãã«ã®ãµã€ãº (ã¡ã¬ãã€ã) initgroups èŠæ±ã®é«éã€ã³ã¡ã¢ãªãŒãã£ãã·ã¥å
ã§å²ãåœãŠãããããŒã¿ããŒãã«ã®ãµã€ãº (ã¡ã¬ãã€ã) ãã¹ã¯ãŒãèŠæ±ã®é«éã€ã³ã¡ã¢ãªãŒãã£ãã·ã¥å
ã§å²ãåœãŠãããããŒã¿ããŒãã«ã®ãµã€ãº (ã¡ã¬ãã€ã) ã¹ããŒãããã³ãã«æŽæ°ã©ã³ãã ãªãã»ãã FAST ã§äœ¿çšãããµãŒããŒããªã³ã·ãã«ãæå®ããŸã ãµããã¡ã€ã³ã®ãªã¹ããæå¹ãšã¿ãªãããæéãç§åäœã§æå®ããŸãã éæšæºã®èšå®ãã¡ã€ã«ã®æå® ããã©ã«ã以å€ã®ã¹ãããããã£ã¬ã¯ããªãŒãæå®ããŸã (ããã©ã«ãã§ã¯ãã¡ã€ã³ã®èšå®ãã¡ã€ã«ãååšããå Žæãšåãå Žæãæ€çŽ¢ããŸã)ãããšãã°ãèšå®ã "/my/path/sssd.conf" ã«èšå®ãããŠããå Žåã¯ãã¹ãããã dir "/my/path/conf.d" ã䜿çšãããŸã base64 ã§ãšã³ã³ãŒãããã蚌ææžãæå®ããŸãã èšå®ãããããã°ã¬ãã«ãæå®ããŸã ãã¡ã€ã³åãæå®ããŸãã ååãæå®ããŸãã LDAP SASL èªå¯ã®æ倧 SSF ãæå®ãã LDAP SASL èªå¯ã®æå° SSF ãæå®ãã 䜿çšãã SASL èªå¯ ID ãæå®ãã 䜿çšãã SASL èªå¯ã¬ã«ã ãæå®ãã 䜿çšãã SASL ã¡ã«ããºã ãæå®ãã ãŠãŒã¶ãŒåãæå®ããŸãã å®è¡äžã§ãªãå ŽåãSSSD ãéå§ããŸã ãã£ãã·ã¥ã®åé€åŸã« SSSD ãéå§ããŸã ãã£ãã·ã¥ãåé€ããåã« SSSD ãåæ¢ããŸã åŸãããªã³ã©ã€ã³èªèšŒããããã«ãªãã©ã€ã³ã®å Žåã«ãã¹ã¯ãŒããä¿åããŸã ã¢ã€ãã³ãã£ãã£ãŒãããã€ããŒããã®ç©ºã®ããŒã ãã£ã¬ã¯ããªãŒããã®å€ã§çœ®ãæããŸã sudo ã«ãŒã«ã®ã³ãã³ãã®å±æ§ sudo ã«ãŒã«ã®ãã¹ãã®å±æ§ sudo ã«ãŒã«å sudo ã«ãŒã«ã® notafter ã®å±æ§ sudo ã«ãŒã«ã® notbefore ã®å±æ§ sudo ã«ãŒã«ã®ãªãã·ã§ã³ã®å±æ§ sudo ã«ãŒã«ã® order ã®å±æ§ sudo ã«ãŒã«ã® runas ã®å±æ§ sudo ã«ãŒã«ã® runasgroup ã®å±æ§ sudo ã«ãŒã«ã® runasuser ã®å±æ§ sudo ã«ãŒã«ã®ãŠãŒã¶ãŒã®å±æ§ ã·ã¹ãã ããªãã©ã€ã³ã§ãããã¹ã¯ãŒãå€æŽãã§ããŸãã ç¹å®ãã¡ã€ã³ãã¿ãŒã²ããã«æå® AUTOFS ãµãŒãã¹ãã¿ãŒã²ããã«èšå® IFP ãµãŒãã¹ãã¿ãŒã²ããã«èšå® NSS ãµãŒãã¹ãã¿ãŒã²ããã«èšå® PAC ãµãŒãã¹ãã¿ãŒã²ããã«èšå® PAM ãµãŒãã¹ãã¿ãŒã²ããã«èšå® SSH ãµãŒãã¹ãã¿ãŒã²ããã«èšå® SSSD ãµãŒãã¹ãã¿ãŒã²ããã«èšå® SUDO ãµãŒãã¹ãã¿ãŒã²ããã«èšå® ãããã°ã®ãã®ã³ã°ã®åé·æ§ãèšå®ãã memberUser ããã³ memberHost ã®ä»£ããã«ãããã³ã°ã«äœ¿çšã§ãã HBAC ã«ãŒã«ã® DN ãå«ã LDAP å±æ§ã ãã¹ãã® FQDN ãå«ã LDAP å±æ§ã ãããã°ã«ãŒãã® NIS ãã¡ã€ã³åãå«ã LDAP å±æ§ã SELinuxã®ãŠãŒã¶ãŒæååãã®ãã®ãå«ã LDAP å±æ§ã ãã®ã«ãŒã«ãããããããã¹ãŠã®ãã¹ã/ãã¹ãã°ã«ãŒããå«ã LDAP å±æ§ã ãã®ã«ãŒã«ãããããããã¹ãŠã®ãŠãŒã¶ãŒ/ã°ã«ãŒããå«ã LDAP å±æ§ã 'all' ãªã©ã®ãã¹ãã«ããŽãªãå«ã LDAP å±æ§ã LDAP ãããã°ã«ãŒããªããžã§ã¯ãã® UUID/GUID ãå«ã LDAP å±æ§ã ãã¹ãã® SSH å
¬ééµãå«ã LDAP å±æ§ã§ãã SELinux usermap ã®ååãå«ã LDAP å±æ§ã ãããã°ã«ãŒãã®ã¡ã³ããŒã®ååãå«ã LDAP å±æ§ã ãŠãŒã¶ãŒãããã®äžæã® ID ãå«ã LDAP å±æ§ã 'all' ãªã©ã®ãŠãŒã¶ãŒã«ããŽãªãŒãå«ã LDAP å±æ§ã 䜿çšã®ããã«ãŠãŒã¶ãŒããããæå¹ã«ãªã£ãŠãããã©ãããå«ã LDAP å±æ§ã ãããã¯ãŒã¯ã°ã«ãŒãåã«å¯Ÿå¿ãã LDAP å±æ§ã§ãã ãããã°ã«ãŒãã®ã¡ã³ããŒã§ãããã¹ããšãã¹ãã°ã«ãŒãã® FQDN ãäžèŠ§è¡šç€ºãã LDAP å±æ§ã ãããã°ã«ãŒãã®çŽæ¥ã®ã¡ã³ããŒã§ãããã¹ããšãã¹ãã°ã«ãŒããäžèŠ§è¡šç€ºãã LDAP å±æ§ã ãããã°ã«ãŒãã®ã¡ã³ããŒã·ãããäžèŠ§è¡šç€ºãã LDAP å±æ§ã ãããã°ã«ãŒãã®çŽæ¥ã®ã¡ã³ããŒã§ããã·ã¹ãã ãŠãŒã¶ãŒãšã°ã«ãŒããäžèŠ§è¡šç€ºãã LDAP å±æ§ã LDAP ã°ã«ãŒãã®å€éšã¡ã³ããŒã®å±æ§ 䜿çšãã SSSD ãã¡ã€ã³ LDAP ãµãŒããŒã«ãããŠäœ¿çšäžã®ã¹ããŒã圢åŒãrfc2307 ã¯ã©ã€ã¢ã³ãã® DNS é
ç®ãæŽæ°åŸãé©çšãã TTL AD ãµãŒããŒã«å¯Ÿãã GPO ããªã·ãŒãã¡ã€ã«ãæ€çŽ¢ããŠããéã®åèšæé IPA ãµãŒããŒã«å¯Ÿãã HBAC ã«ãŒã«ãæ€çŽ¢ããŠããéã®åèšæé æåŸã®èŠæ±ãã«ãŒã«ãäœãèŠã€ããªãã£ãå Žåã® IPA ãµãŒããŒã«å¯Ÿãããã¹ã¯ããããããã¡ã€ã«ã«ãŒã«ãæ€çŽ¢ããŠããéã®ååäœã®åèšæé IPA ãµãŒããŒã«å¯Ÿãããã¹ã¯ããããããã¡ã€ã«ã«ãŒã«ãæ€çŽ¢ããŠããéã®ç§åäœã®åèšæé IPA ãµãŒããŒã«å¯Ÿãã SELinux ãããã®æ€çŽ¢ã®éã®ç§åäœã®åèšæé ããã©ã«ãã®ãã€ã³ã DN ã®èªèšŒããŒã¯ã³ ãã® IPA ã¯ã©ã€ã¢ã³ãã䜿çšããŠãã automounter ã®å Žæ å®è¡ãããããã°ã¬ãã« ããã©ã«ãã®ããŒã¹ DN ããã©ã«ãã®ãã€ã³ã DN ãµãŒãã¹æ€çŽ¢ DNS ã¯ãšãªãŒã®ãã¡ã€ã³éšå ãšã³ããªãŒãã£ãã·ã¥ã¯ããã¡ã€ã³ã® entry_cache_timeout å€ã®ããŒã»ã³ããè¶
ãããªã¯ãšã¹ããè¡ãããå Žåã«ãããã¯ã°ã©ãŠã³ãã§ãšã³ããªãŒãèªåçã«æŽæ°ããããã«èšå®ã§ããŸãã 次ã®ããã«ãµãŒããŒãå®è¡ããã°ã«ãŒã ID 次ã®ããã« FAST ccache ãäœæããã°ã«ãŒã åç DNS æŽæ°ã®ããã«äœ¿çšããã IP ã®ã€ã³ã¿ãŒãã§ãŒã¹ æåŠãããŠãã©ãŒã«ããã¯ã·ã§ã«ã§çœ®ãæããããã·ã§ã«ã®äžèŠ§ ãŠãŒã¶ãŒããã°ã€ã³ãèš±å¯ãããã·ã§ã«ã®äžèŠ§ 䜿çšãã NSS ã©ã€ãã©ãªãŒã®åå ãã¹ãããããã¯ãŒã¯ã®æ€çŽ¢ã«äœ¿çšãã NSS ã©ã€ãã©ãªã®åå LDAP ã®ãªãŒãããŠã³ããã¹ã¿ãŒãããã®ååã ãã®ã¬ã¹ãã³ããŒã«ã«ããéããããã¡ã€ã«èšè¿°åã®æ° å®å
šãªåç
§è§£æ±ºãåŒãèµ·ããããã«æ¬ ããŠããå¿
èŠãããã¡ã³ããŒã®æ° äºåã«ãã©ãŒã¯ãããåãããã·ãŒã®æ°ã åäžã® LDAP ã¯ãšãªãŒã«ãããŠååŸããã¬ã³ãŒãæ° LDAP ã«ãããã¹ããšã³ããªãŒã®ãªããžã§ã¯ãã¯ã©ã¹ã§ãã LDAP ã«ãããããã¯ãŒã¯ã°ã«ãŒããšã³ããªãŒã®ãªããžã§ã¯ãã¯ã©ã¹ã§ãã ãã®ãªãã·ã§ã³ã¯ãSSSD ã IPA ãµãŒããŒäžã§å®è¡ãããŠãããä¿¡é Œããããã¡ã€ã³ããã®ãŠãŒã¶ãŒãšã°ã«ãŒãã®æ€çŽ¢ãç°ãªãæ¹æ³ã§å®è¡ããå¿
èŠãããããšã瀺ããŸãã ãããã·ã³ãã³ããžã®ãã¹ã¯çµ¶å¯Ÿãã¹ã«ããå¿
èŠããããŸã
ãã¹ããžã®æ¥ç¶ã«äœ¿çšããããŒã ãµããã¡ã€ã³ã®ååŸãåŠçããå¿
èŠã®ãããããã€ããŒããã®å€ã¯åžžã« id_provider ãšåãã§ãªããã°ãªããŸããã ããã©ã«ãã®ãã€ã³ã DN ã®èªèšŒããŒã¯ã³ã®çš®é¡ 次ã®ããã«ãµãŒããŒãå®è¡ãããŠãŒã¶ãŒ ID 次ã®ããã« FAST ccache ãäœæãããŠãŒã¶ãŒ ãŠãŒã¶ãŒãç¹æš©ãåæ¢ããŸã NSS ãããã€ããŒãè¿ããã¹ã¯ãŒãé
ç®ã®å€ ãã®ãªãã·ã§ã³ã®å€ã¯ããã³ãã¬ãŒãã«æžåŒæåå %H ãå«ãã§ããå Žåã« override_homedir ãªãã·ã§ã³ã®æ¡åŒµã§äœ¿çšãããŸãã èšå®ã¯ãããŸããã
ãã®ãã¡ã€ã³ã«ã¯ãã¢ã¯ãã£ããªãµãŒããŒã¯ãããŸããã
æŽæ°ã確èªããéé ãŠãŒã¶ãŒåã倧æåå°æåãåºå¥ããããåãæ±ã ãã°ãã¡ã€ã«ãåãæšãŠãŸã...
蚌ææžæ€èšŒã®èª¿æŽ PAM èªèšŒã®èšŒææžæ€èšŒã®èª¿æŽã ãã¹ããŒæ€èšŒã®åäœããã¥ãŒãã³ã°ãã SSSD ã調æŽããnetlink ã®ç¶æ
å€æŽãå°éãããããŸãã¯ç¡èŠããŸã ã°ã«ãŒãããã³ä»ã®ãã©ã°ã®ã¿ã€ã UID ã®å±æ§ ãã¹ã¯ãŒãã®å€æŽãèš±å¯ãããããã¯ã¢ãã LDAP ãµãŒããŒã® URI ãã¹ã¯ãŒãã®å€æŽãèš±å¯ããã LDAP ãµãŒããŒã® URI UUID å±æ§ ãã°ãã¡ã€ã«ã®ã¢ãŒã«ã€ããã§ããŸãã
ã·ã¹ãã ãã¹ã«æ¥ç¶ã§ããŸããã
ããã¯ã¢ãããã£ã¬ã¯ããªãŒ [%d] ãäœæã§ããŸãã: %s ããŒã«ã«ããŒã¿ã®ããã¯ã¢ããã®äœæãã§ããŸããããã£ãã·ã¥ãåé€ã§ããŸããã
ã°ã«ãŒãã®äžæžãããšã¯ã¹ããŒãã§ããŸãã
ãŠãŒã¶ãŒã®äžæžãããšã¯ã¹ããŒãã§ããŸãã
ãªã³ã©ã€ã³ç¶æ
ãååŸã§ããŸãã
ãµãŒããŒäžèŠ§ãååŸã§ããŸãã
ã°ã«ãŒãã®äžæžããã€ã³ããŒãã§ããŸãã
ãŠãŒã¶ãŒã®äžæžããã€ã³ããŒãã§ããŸãã
ã³ãã³ãåŒæ°ã解æã§ããŸãã
åå %s ãæ§æ解æã§ããŸããã
ãŠãŒã¶ãŒã€ã³ãããã®èªã¿èŸŒã¿ãã§ããŸããã§ãã
ãã£ãã·ã¥ãã¡ã€ã«ãåé€ã§ããŸãã
ãã°ãã¡ã€ã«ãåé€ã§ããŸãã
ãã°ãã¡ã€ã«ã®åãæšãŠãã§ããŸãã
äºæããªãåŒæ°ãæäŸãããå Žåã1 ã€ã®ãªããžã§ã¯ããç¡å¹åãããªãã·ã§ã³ã¯ãæäŸãããåŒæ°ã 1 ã€ã ãåãåããŸãã
ãšã©ãŒã®èª¬æãæ€çŽ¢äžã«äºæããªããšã©ãŒãçºçããŸãã ãµãŒããŒã®ã¯ã¬ãã³ã·ã£ã«ã¡ãã»ãŒãžã®äºæããªã圢åŒã§ãã äžæãªã¢ã¯ã·ã§ã³: %1$s
æå¹ãªã¢ã¯ã·ã§ã³ã¯ %2$sã%3$sã%4$s ã§ã
ID ãããã³ã°ã®äžé äºåèšå®æžã¿ ID ã®ä»£ããã« objectSID ã® ID ãããã³ã°ã䜿çšããŸã LDAP æ¥ç¶ã«å¯Ÿã㊠Kerberos èªèšŒã䜿çšãã LDAP ããã³ã°ããŒãã«ã«ã¿ãã°ã®ãªã¯ãšã¹ãã« LDAPS ããŒãã䜿çšãã å¿åã® PKINIT ã䜿çšã㊠FAST ã® armo ãã±ãããèŠæ±ãã å¿åã® PKINIT ã䜿çšã㊠FAST ã®èªèšŒæ
å ±ãèŠæ±ãã ID ãããã³ã°ã«å¯Ÿãã autorid äºæã¢ã«ãŽãªãºã ã䜿çšããŸã krb5_get_init_creds_password ã®ã«ã¹ã¿ã ããŒãžã§ã³ã䜿çšããŸã ã¬ã«ã åã«å¯ŸããŠå€§æåã®ã¿ã䜿çšãã 以äžã®äžèŽããã«ãŒã«ã䜿çšããŠãssh-key çæçšã®èšŒææžããã£ã«ã¿ãªã³ã°ããŸã ãã¹ããªããžã§ã¯ãã®æ€çŽ¢ããŒã¹ãšããŠäžããããæååã䜿çšããŸãã ä¿¡é Œããããã¡ã€ã³ã«å¯Ÿããæ€çŽ¢ããŒã¹ãšããŠãäžããããæååã䜿çšããŸãã 䜿çšãããèšå®ã¹ãããããã¡ã€ã«: %zu
[%s] ã§ã®ãŠãŒã¶ãŒåã®æ€çŽ¢ã«å€±æããŸããã
ãŠãŒã¶ãŒãæå®ãããŠããŸãã
ãŠãŒã¶ãŒããªã³ã·ãã«ã®å±æ§ (Kerberos çš) ãŠãŒã¶ãŒåã®å±æ§ SSSD ãæ瀺çã«ç¡èŠãããŠãŒã¶ãŒ PAC ãæ€èšŒãã ãã®ãã¡ã€ã³ã®ããã® realmd èšå®ãµãŒãã¹ã«ãã£ãŠæ ŒçŽãããæ§ã
ãªã¿ã°ã ãµãŒãã¹åèµ·ååã® Watchdog ã¿ã€ã ã¢ãŠã DNS æŽæ°ãå®è¡ããããã«äœ¿çšãã¹ãèªèšŒã®çš®é¡ èªèšŒäžã«ãŠãŒã¶ãŒã«è¡šç€ºãããã¡ãã»ãŒãžã®çš®é¡ SSSD ããªãã©ã€ã³ã¢ãŒãã«åãæ¿ãããšããªã³ã©ã€ã³ã«æ»ãããšãããŸã§ã®æéããåæã®æéã«åºã¥ããŠé·ããªããŸãããã®å€ã¯ç§åäœã§ãoffline_timeout + random_offset ã§èšç®ãããŸãã PAM ã¬ã¹ãã³ããŒã initgroups ãªã¯ãšã¹ãã匷å¶ãããšã krb5 èšå®ã¹ãããããåé€ããå Žæ LDAP ã©ã€ãã©ãªãŒã SASL ãã€ã³ãäžã«ãã¹ãåãæ£èŠåããããã«éåŒããå®è¡ãããã©ãã OS ãŸãã¯ã¢ããªã±ãŒã·ã§ã³ããã¡ã€ã³ã䜿çšã§ãããã©ãã nsupdate ãŠãŒãã£ãªãã£ãŒãæšæºã§ TCP ã䜿çšãããã©ãã ãããã€ããŒãåãããã« PTR ã¬ã³ãŒããæ瀺çã«æŽæ°ããå¿
èŠããããã©ãã ãŠãŒã¶ãŒã«ãã©ã€ããŒãã°ã«ãŒããèªåçã«äœæãããã©ãã èªåçã«ã¯ã©ã€ã¢ã³ãã® DNS ãšã³ããªãŒãæŽæ°ãããã©ãã FreeIPA ã«ããã¯ã©ã€ã¢ã³ãã® DNS ãšã³ããªãŒãèªåçã«æŽæ°ãããã©ãã kdcinfo ãã¡ã€ã«ãäœæãããã©ãã sudo ã«ãŒã«ã«ãããŠæéã«ããå±æ§ãè©äŸ¡ãããã©ãã ãã¹ãåãIP ã¢ãã¬ã¹ããã³ãããã¯ãŒã¯ã«ãããã£ã«ã¿ãŒã«ãŒã«ã䜿çšãããã©ãã known_hosts ãã¡ã€ã«ã«ãããŠãã¹ãåãšã¢ãã¬ã¹ãããã·ã¥åãããã©ãã ãã¹ãå±æ§ã«ãããã¯ãŒã¯ã°ã«ãŒããå«ãã«ãŒã«ãå«ãããã©ãã ãã¹ãå±æ§ã«æ£èŠè¡šçŸãå«ãã«ãŒã«ãå«ãããã©ãã å¯èœãªãã°ãã£ãã·ã¥ããæ£èŠåãããã°ã«ãŒãåãæ€çŽ¢ãããã©ãã ã¿ãŒã²ãããŠãŒã¶ãŒãšèªèšŒããã UPN ã«äžèŽãããã©ãã ãã¹ã¯ãŒãå€æŽåŸ ldap_user_shadow_last_change å±æ§ãæŽæ°ãããã©ãã Samba ããŒã¿ããŒã¹ã®ãã·ã³ã¢ã«ãŠã³ããã¹ã¯ãŒããæŽæ°ãããã©ãã Token-Group ã䜿ããã©ãã æ€çŽ¢ã«ã°ããŒãã«ã«ã¿ãã°ã䜿çšãããã©ãã ã¢ããªã±ãŒã·ã§ã³ãã¡ã€ã³ãžã®æ¥ç¶ãèš±å¯ããã PAM ãµãŒãã¹ã¯ã©ãã ã©ã®å±æ§ãã¢ã«ãŠã³ãã倱å¹ããŠããããè©äŸ¡ããããã«äœ¿çšãããã ã©ã®ã«ãŒã«ãã¢ã¯ã»ã¹å¶åŸ¡ãè©äŸ¡ããããã«äœ¿çšãããã ãã¹ã¯ãŒãã®æå¹æéãåããŠããŸãã ãã¹ã¯ãŒãã®æéãåããŠããŸããããš %1$d åãã°ã€ã³ã§ããŸãã ããªãã®ãã¹ã¯ãŒã㯠%1$d %2$s ã«æéåãã«ãªããŸãã ã¯ã©ã€ã¢ã³ãã䜿çšããç¹å®ã®ãµã€ã AD ã® accountExpires å±æ§ å±æ§ ãŠãŒã¶ãŒã® X509 蚌ææžãå«ãå±æ§ ãŠãŒã¶ãŒã®é»åã¡ãŒã«ã¢ãã¬ã¹ãå«ãå±æ§ ãŠãŒã¶ãŒã®ãã¹ããŒãããã³ã°ããŒã¿ãå«ãå±æ§ ãŠãŒã¶ãŒçšã«èš±å¯ãããèªèšŒã¿ã€ããäžèŠ§åããå±æ§ dlopen 㯠[%s] ã§å€±æããŸããã
dlsym 㯠[%s] ã§å€±æããŸããã
ãã¡ã€ã³ entryUSN å±æ§ ãšã©ãŒ krbLastPwdChange å±æ§ krbPasswordExpiration å±æ§ lastUSN å±æ§ ldap_backup_uri, LDAP ãµãŒããŒã® URI ldap_uri, LDAP ãµãŒããŒã® URI NDS ã® loginAllowedTimeMap å±æ§ NDS ã® loginDisabled å±æ§ NDS ã® loginExpirationTime å±æ§ malloc ã¯å€±æããŸããã
memberOf å±æ§ ããã æ¥ç¶ããŠããŸãã nsAccountLock å±æ§ objectSID å±æ§ pam_acct_mgmt: %s
ãŠãŒã¶ãŒ [%s] åãã® pam_authenticate: %s
pam_chauthtok: %s
pam_close_session: %s
pam_get_item ã«å€±æããŸãã: %s
pam_open_session: %s
pam_setcred: [%s]
pam_start ã«å€±æããŸãã: %s
set_debug_file_from_fd ã¯å€±æããŸããã
shadowExpire å±æ§ shadowFlag å±æ§ shadowInactive å±æ§ shadowLastChange å±æ§ shadowMax å±æ§ shadowMin å±æ§ shadowWarning å±æ§ sss_getpwnam_r ã [%d] ã§å€±æããŸããã
sss_ssh_knownhostsproxy: ãã¹ãå %s ã解決ã§ããŸããã§ãã
sss_ssh_knownhostsproxy: ãã¹ã %s ããŒã %d ã«æ¥ç¶: %s
sss_ssh_knownhostsproxy: ããŒã¿ããããã·ãŒã§ããŸãã: %s
talloc_asprintf ã¯å€±æããŸããã
pam_acct_mgmt ã®ãã¹ãäž
pam_authenticate ã®ãã¹ãäž
pam_chauthtok ã®ãã¹ãäž
pam_close_session ã®ãã¹ãäž
pam_open_session ã®ãã¹ãäž
pam_setcred ã®ãã¹ãäž
äžæãªã¢ã¯ã·ã§ã³
ãŠãŒã¶ãŒ: %s
ã¢ã¯ã·ã§ã³: %s
ãµãŒãã¹: %s
AD ã® userAccountControl å±æ§ ã¯ã PRIu64 Running under %, must be root
% ã§å®è¡ (root ã§ãªããã°ãªããŸãã)