From 74aa0bc6779af38018a03fd2cf4419fe85917904 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Fri, 19 Apr 2024 07:31:45 +0200 Subject: Adding upstream version 2.9.4. Signed-off-by: Daniel Baumann --- src/man/ja/include/ad_modified_defaults.xml | 104 ++++++++++ src/man/ja/include/autofs_attributes.xml | 64 ++++++ src/man/ja/include/autofs_restart.xml | 5 + src/man/ja/include/debug_levels.xml | 97 +++++++++ src/man/ja/include/debug_levels_tools.xml | 77 ++++++++ src/man/ja/include/failover.xml | 118 +++++++++++ src/man/ja/include/homedir_substring.xml | 17 ++ src/man/ja/include/ipa_modified_defaults.xml | 123 ++++++++++++ src/man/ja/include/krb5_options.xml | 148 ++++++++++++++ src/man/ja/include/ldap_id_mapping.xml | 282 +++++++++++++++++++++++++++ src/man/ja/include/ldap_search_bases.xml | 30 +++ src/man/ja/include/local.xml | 17 ++ src/man/ja/include/override_homedir.xml | 77 ++++++++ src/man/ja/include/param_help.xml | 10 + src/man/ja/include/param_help_py.xml | 10 + src/man/ja/include/seealso.xml | 49 +++++ src/man/ja/include/service_discovery.xml | 37 ++++ src/man/ja/include/upstream.xml | 3 + 18 files changed, 1268 insertions(+) create mode 100644 src/man/ja/include/ad_modified_defaults.xml create mode 100644 src/man/ja/include/autofs_attributes.xml create mode 100644 src/man/ja/include/autofs_restart.xml create mode 100644 src/man/ja/include/debug_levels.xml create mode 100644 src/man/ja/include/debug_levels_tools.xml create mode 100644 src/man/ja/include/failover.xml create mode 100644 src/man/ja/include/homedir_substring.xml create mode 100644 src/man/ja/include/ipa_modified_defaults.xml create mode 100644 src/man/ja/include/krb5_options.xml create mode 100644 src/man/ja/include/ldap_id_mapping.xml create mode 100644 src/man/ja/include/ldap_search_bases.xml create mode 100644 src/man/ja/include/local.xml create mode 100644 src/man/ja/include/override_homedir.xml create mode 100644 src/man/ja/include/param_help.xml create mode 100644 src/man/ja/include/param_help_py.xml create mode 100644 src/man/ja/include/seealso.xml create mode 100644 src/man/ja/include/service_discovery.xml create mode 100644 src/man/ja/include/upstream.xml (limited to 'src/man/ja/include') diff --git a/src/man/ja/include/ad_modified_defaults.xml b/src/man/ja/include/ad_modified_defaults.xml new file mode 100644 index 0000000..6ee0537 --- /dev/null +++ b/src/man/ja/include/ad_modified_defaults.xml @@ -0,0 +1,104 @@ + + MODIFIED DEFAULT OPTIONS + + Certain option defaults do not match their respective backend provider +defaults, these option names and AD provider-specific defaults are listed +below: + + + KRB5 Provider + + + + krb5_validate = true + + + + + krb5_use_enterprise_principal = true + + + + + + LDAP Provider + + + + ldap_schema = ad + + + + + ldap_force_upper_case_realm = true + + + + + ldap_id_mapping = true + + + + + ldap_sasl_mech = GSS-SPNEGO + + + + + ldap_referrals = false + + + + + ldap_account_expire_policy = ad + + + + + ldap_use_tokengroups = true + + + + + ldap_sasl_authid = sAMAccountName@REALM (typically SHORTNAME$@REALM) + + + The AD provider looks for a different principal than the LDAP provider by +default, because in an Active Directory environment the principals are +divided into two groups - User Principals and Service Principals. Only User +Principal can be used to obtain a TGT and by default, computer object's +principal is constructed from its sAMAccountName and the AD realm. The +well-known host/hostname@REALM principal is a Service Principal and thus +cannot be used to get a TGT with. + + + + + + NSS configuration + + + + fallback_homedir = /home/%d/%u + + + The AD provider automatically sets "fallback_homedir = /home/%d/%u" to +provide personal home directories for users without the homeDirectory +attribute. If your AD Domain is properly populated with Posix attributes, +and you want to avoid this fallback behavior, you can explicitly set +"fallback_homedir = %o". + + + Note that the system typically expects a home directory in /home/%u +folder. If you decide to use a different directory structure, some other +parts of your system may need adjustments. + + + For example automated creation of home directories in combination with +selinux requires selinux adjustment, otherwise the home directory will be +created with wrong selinux context. + + + + + diff --git a/src/man/ja/include/autofs_attributes.xml b/src/man/ja/include/autofs_attributes.xml new file mode 100644 index 0000000..0a453aa --- /dev/null +++ b/src/man/ja/include/autofs_attributes.xml @@ -0,0 +1,64 @@ + + + ldap_autofs_map_object_class (文字列) + + + LDAP にある automount マップエントリーのオブジェクトクラスです。 + + + Default: nisMap (rfc2307, autofs_provider=ad), otherwise automountMap + + + + + + ldap_autofs_map_name (文字列) + + + LDAP における automount のマップエントリーの名前です。 + + + Default: nisMapName (rfc2307, autofs_provider=ad), otherwise +automountMapName + + + + + + ldap_autofs_entry_object_class (文字列) + + + The object class of an automount entry in LDAP. The entry usually +corresponds to a mount point. + + + Default: nisObject (rfc2307, autofs_provider=ad), otherwise automount + + + + + + ldap_autofs_entry_key (文字列) + + + LDAP にある automount エントリーのキーです。エントリーは一般的にマウントポイントと対応します。 + + + Default: cn (rfc2307, autofs_provider=ad), otherwise automountKey + + + + + + ldap_autofs_entry_value (文字列) + + + LDAP にある automount エントリーのキーです。エントリーは一般的にマウントポイントと対応します。 + + + Default: nisMapEntry (rfc2307, autofs_provider=ad), otherwise +automountInformation + + + + diff --git a/src/man/ja/include/autofs_restart.xml b/src/man/ja/include/autofs_restart.xml new file mode 100644 index 0000000..f31efe5 --- /dev/null +++ b/src/man/ja/include/autofs_restart.xml @@ -0,0 +1,5 @@ + + Please note that the automounter only reads the master map on startup, so if +any autofs-related changes are made to the sssd.conf, you typically also +need to restart the automounter daemon after restarting the SSSD. + diff --git a/src/man/ja/include/debug_levels.xml b/src/man/ja/include/debug_levels.xml new file mode 100644 index 0000000..70361f1 --- /dev/null +++ b/src/man/ja/include/debug_levels.xml @@ -0,0 +1,97 @@ + + + SSSD supports two representations for specifying the debug level. The +simplest is to specify a decimal value from 0-9, which represents enabling +that level and all lower-level debug messages. The more comprehensive option +is to specify a hexadecimal bitmask to enable or disable specific levels +(such as if you wish to suppress a level). + + + Please note that each SSSD service logs into its own log file. Also please +note that enabling debug_level in the [sssd] +section only enables debugging just for the sssd process itself, not for the +responder or provider processes. The debug_level parameter +should be added to all sections that you wish to produce debug logs from. + + + In addition to changing the log level in the config file using the +debug_level parameter, which is persistent, but requires SSSD +restart, it is also possible to change the debug level on the fly using the + sss_debuglevel +8 tool. + + + 現在サポートされるデバッグレベル: + + + 0, 0x0010: Fatal +failures. Anything that would prevent SSSD from starting up or causes it to +cease running. + + + 1, 0x0020: Critical failures. An +error that doesn't kill SSSD, but one that indicates that at least one major +feature is not going to work properly. + + + 2, 0x0040: Serious failures. An +error announcing that a particular request or operation has failed. + + + 3, 0x0080: Minor failures. These +are the errors that would percolate down to cause the operation failure of +2. + + + 4, 0x0100: Configuration settings. + + + 5, 0x0200: Function data. + + + 6, 0x0400: Trace messages for +operation functions. + + + 7, 0x1000: Trace messages for +internal control functions. + + + 8, 0x2000: Contents of +function-internal variables that may be interesting. + + + 9, 0x4000: Extremely low-level +tracing information. + + + 9, 0x20000: Performance and +statistical data, please note that due to the way requests are processed +internally the logged execution time of a request might be longer than it +actually was. + + + 10, 0x10000: Even more low-level +libldb tracing information. Almost never really required. + + + To log required bitmask debug levels, simply add their numbers together as +shown in following examples: + + + 例: 致命的なエラー、重大なエラー、深刻なエラーおよび関数データをログに取得するには 0x0270 +を使用します。 + + + 例: 致命的なエラー、設定値の設定、関数データ、内部制御関数のトレースメッセージをログに取得するには +0x1310 を使用します。 + + + Note: The bitmask format of debug levels was introduced +in 1.7.0. + + + Default: 0x0070 (i.e. fatal, critical and serious +failures; corresponds to setting 2 in decimal notation) + + diff --git a/src/man/ja/include/debug_levels_tools.xml b/src/man/ja/include/debug_levels_tools.xml new file mode 100644 index 0000000..57f81cc --- /dev/null +++ b/src/man/ja/include/debug_levels_tools.xml @@ -0,0 +1,77 @@ + + + SSSD supports two representations for specifying the debug level. The +simplest is to specify a decimal value from 0-9, which represents enabling +that level and all lower-level debug messages. The more comprehensive option +is to specify a hexadecimal bitmask to enable or disable specific levels +(such as if you wish to suppress a level). + + + 現在サポートされるデバッグレベル: + + + 0, 0x0010: Fatal +failures. Anything that would prevent SSSD from starting up or causes it to +cease running. + + + 1, 0x0020: Critical failures. An +error that doesn't kill SSSD, but one that indicates that at least one major +feature is not going to work properly. + + + 2, 0x0040: Serious failures. An +error announcing that a particular request or operation has failed. + + + 3, 0x0080: Minor failures. These +are the errors that would percolate down to cause the operation failure of +2. + + + 4, 0x0100: Configuration settings. + + + 5, 0x0200: Function data. + + + 6, 0x0400: Trace messages for +operation functions. + + + 7, 0x1000: Trace messages for +internal control functions. + + + 8, 0x2000: Contents of +function-internal variables that may be interesting. + + + 9, 0x4000: Extremely low-level +tracing information. + + + 10, 0x10000: Even more low-level +libldb tracing information. Almost never really required. + + + To log required bitmask debug levels, simply add their numbers together as +shown in following examples: + + + 例: 致命的なエラー、重大なエラー、深刻なエラーおよび関数データをログに取得するには 0x0270 +を使用します。 + + + 例: 致命的なエラー、設定値の設定、関数データ、内部制御関数のトレースメッセージをログに取得するには +0x1310 を使用します。 + + + Note: The bitmask format of debug levels was introduced +in 1.7.0. + + + Default: 0x0070 (i.e. fatal, critical and serious +failures; corresponds to setting 2 in decimal notation) + + diff --git a/src/man/ja/include/failover.xml b/src/man/ja/include/failover.xml new file mode 100644 index 0000000..bd16e22 --- /dev/null +++ b/src/man/ja/include/failover.xml @@ -0,0 +1,118 @@ + + フェイルオーバー + + The failover feature allows back ends to automatically switch to a different +server if the current server fails. + + + フェイルオーバーの構文 + + サーバーの一覧がカンマ区切り一覧として与えられます。カンマの前後で空白はいくつでも許されます。サーバーは性能の順番で一覧化されます。一覧はサーバーをいくつでも含められます。 + + + For each failover-enabled config option, two variants exist: +primary and backup. The idea is +that servers in the primary list are preferred and backup servers are only +searched if no primary servers can be reached. If a backup server is +selected, a timeout of 31 seconds is set. After this timeout SSSD will +periodically try to reconnect to one of the primary servers. If it succeeds, +it will replace the current active (backup) server. + + + + フェイルオーバーのメカニズム + + The failover mechanism distinguishes between a machine and a service. The +back end first tries to resolve the hostname of a given machine; if this +resolution attempt fails, the machine is considered offline. No further +attempts are made to connect to this machine for any other service. If the +resolution attempt succeeds, the back end tries to connect to a service on +this machine. If the service connection attempt fails, then only this +particular service is considered offline and the back end automatically +switches over to the next service. The machine is still considered online +and might still be tried for another service. + + + Further connection attempts are made to machines or services marked as +offline after a specified period of time; this is currently hard coded to 30 +seconds. + + + If there are no more machines to try, the back end as a whole switches to +offline mode, and then attempts to reconnect every 30 seconds. + + + + Failover time outs and tuning + + Resolving a server to connect to can be as simple as running a single DNS +query or can involve several steps, such as finding the correct site or +trying out multiple host names in case some of the configured servers are +not reachable. The more complex scenarios can take some time and SSSD needs +to balance between providing enough time to finish the resolution process +but on the other hand, not trying for too long before falling back to +offline mode. If the SSSD debug logs show that the server resolution is +timing out before a live server is contacted, you can consider changing the +time outs. + + + This section lists the available tunables. Please refer to their description +in the +sssd.conf5 +, manual page. + + + dns_resolver_server_timeout + + + + Time in milliseconds that sets how long would SSSD talk to a single DNS +server before trying next one. + + + 初期値: 1000 + + + + + + dns_resolver_op_timeout + + + + Time in seconds to tell how long would SSSD try to resolve single DNS query +(e.g. resolution of a hostname or an SRV record) before trying the next +hostname or discovery domain. + + + 初期値: 3 + + + + + + dns_resolver_timeout + + + + How long would SSSD try to resolve a failover service. This service +resolution internally might include several steps, such as resolving DNS SRV +queries or locating the site. + + + 初期値: 6 + + + + + + + For LDAP-based providers, the resolve operation is performed as part of an +LDAP connection operation. Therefore, also the +ldap_opt_timeout timeout should be set to a larger value than +dns_resolver_timeout which in turn should be set to a larger +value than dns_resolver_op_timeout which should be larger +than dns_resolver_server_timeout. + + + diff --git a/src/man/ja/include/homedir_substring.xml b/src/man/ja/include/homedir_substring.xml new file mode 100644 index 0000000..d7533de --- /dev/null +++ b/src/man/ja/include/homedir_substring.xml @@ -0,0 +1,17 @@ + + homedir_substring (string) + + + The value of this option will be used in the expansion of the +override_homedir option if the template contains the +format string %H. An LDAP directory entry can directly +contain this template so that this option can be used to expand the home +directory path for each client machine (or operating system). It can be set +per-domain or globally in the [nss] section. A value specified in a domain +section will override one set in the [nss] section. + + + Default: /home + + + diff --git a/src/man/ja/include/ipa_modified_defaults.xml b/src/man/ja/include/ipa_modified_defaults.xml new file mode 100644 index 0000000..4ad4b45 --- /dev/null +++ b/src/man/ja/include/ipa_modified_defaults.xml @@ -0,0 +1,123 @@ + + MODIFIED DEFAULT OPTIONS + + Certain option defaults do not match their respective backend provider +defaults, these option names and IPA provider-specific defaults are listed +below: + + + KRB5 Provider + + + + krb5_validate = true + + + + + krb5_use_fast = try + + + + + krb5_canonicalize = true + + + + + + LDAP Provider - General + + + + ldap_schema = ipa_v1 + + + + + ldap_force_upper_case_realm = true + + + + + ldap_sasl_mech = GSSAPI + + + + + ldap_sasl_minssf = 56 + + + + + ldap_account_expire_policy = ipa + + + + + ldap_use_tokengroups = true + + + + + + LDAP Provider - User options + + + + ldap_user_member_of = memberOf + + + + + ldap_user_uuid = ipaUniqueID + + + + + ldap_user_ssh_public_key = ipaSshPubKey + + + + + ldap_user_auth_type = ipaUserAuthType + + + + + + LDAP Provider - Group options + + + + ldap_group_object_class = ipaUserGroup + + + + + ldap_group_object_class_alt = posixGroup + + + + + ldap_group_member = member + + + + + ldap_group_uuid = ipaUniqueID + + + + + ldap_group_objectsid = ipaNTSecurityIdentifier + + + + + ldap_group_external_member = ipaExternalMember + + + + + diff --git a/src/man/ja/include/krb5_options.xml b/src/man/ja/include/krb5_options.xml new file mode 100644 index 0000000..65c5246 --- /dev/null +++ b/src/man/ja/include/krb5_options.xml @@ -0,0 +1,148 @@ + + + krb5_auth_timeout (整数) + + + オンライン認証またはパスワード変更要求が中止された後の秒単位のタイムアウトです。可能ならば、認証要求がオフラインで継続されます。 + + + 初期値: 6 + + + + + + krb5_validate (論理値) + + + Verify with the help of krb5_keytab that the TGT obtained has not been +spoofed. The keytab is checked for entries sequentially, and the first entry +with a matching realm is used for validation. If no entry matches the realm, +the last entry in the keytab is used. This process can be used to validate +environments using cross-realm trust by placing the appropriate keytab entry +as the last entry or the only entry in the keytab file. + + + Default: false (IPA and AD provider: true) + + + Please note that the ticket validation is the first step when checking the +PAC (see 'pac_check' in the +sssd.conf 5 + manual page for details). If ticket validation is disabled +the PAC checks will be skipped as well. + + + + + + krb5_renewable_lifetime (文字列) + + + Request a renewable ticket with a total lifetime, given as an integer +immediately followed by a time unit: + + + 秒は s + + + 分は m + + + 時間は h + + + 日は d + + + 単位が指定されていないと、s と仮定されます。 + + + 注: 単位を混在できないことに注意してください。更新可能な生存期間を1時間30分に指定したい場合、'1h30m' の代わりに '90m' を使用します。 + + + 初期値: 設定されません、つまり TGT は更新可能ではありません + + + + + + krb5_lifetime (文字列) + + + Request ticket with a lifetime, given as an integer immediately followed by +a time unit: + + + 秒は s + + + 分は m + + + 時間は h + + + 日は d + + + 単位が指定されていないと、s と仮定されます。 + + + 注: 単位を混在できないことに注意してください。更新可能な生存期間を1時間30分に指定したい場合、'1h30m' の代わりに '90m' +を使用してください。 + + + 初期値: 設定されません、つまり KDC において設定されているチケット有効期間の初期値です。 + + + + + + krb5_renew_interval (文字列) + + + The time in seconds between two checks if the TGT should be renewed. TGTs +are renewed if about half of their lifetime is exceeded, given as an integer +immediately followed by a time unit: + + + 秒は s + + + 分は m + + + 時間は h + + + 日は d + + + 単位が指定されていないと、s と仮定されます。 + + + 注: 単位を混在できないことに注意してください。更新可能な生存期間を1時間30分に指定したい場合、'1h30m' の代わりに '90m' を使用します。 + + + このオプションが設定されていない場合、または 0 に設定されている場合、自動更新は無効になります。 + + + 初期値: 設定されません + + + + + + krb5_canonicalize (論理値) + + + ホストとユーザーのプリンシパルが正規化されるかどうかを指定します。この機能は MIT Kerberos 1.7 およびそれ以降で利用可能です。 + + + + 初期値: false + + + + diff --git a/src/man/ja/include/ldap_id_mapping.xml b/src/man/ja/include/ldap_id_mapping.xml new file mode 100644 index 0000000..e4ec141 --- /dev/null +++ b/src/man/ja/include/ldap_id_mapping.xml @@ -0,0 +1,282 @@ + + ID マッピング + + The ID-mapping feature allows SSSD to act as a client of Active Directory +without requiring administrators to extend user attributes to support POSIX +attributes for user and group identifiers. + + + NOTE: When ID-mapping is enabled, the uidNumber and gidNumber attributes are +ignored. This is to avoid the possibility of conflicts between +automatically-assigned and manually-assigned values. If you need to use +manually-assigned values, ALL values must be manually-assigned. + + + Please note that changing the ID mapping related configuration options will +cause user and group IDs to change. At the moment, SSSD does not support +changing IDs, so the SSSD database must be removed. Because cached passwords +are also stored in the database, removing the database should only be +performed while the authentication servers are reachable, otherwise users +might get locked out. In order to cache the password, an authentication must +be performed. It is not sufficient to use +sss_cache 8 + to remove the database, rather the process consists of: + + + + Making sure the remote servers are reachable + + + + + Stopping the SSSD service + + + + + Removing the database + + + + + Starting the SSSD service + + + + Moreover, as the change of IDs might necessitate the adjustment of other +system properties such as file and directory ownership, it's advisable to +plan ahead and test the ID mapping configuration thoroughly. + + + + マッピング・アルゴリズム + + Active Directory provides an objectSID for every user and group object in +the directory. This objectSID can be broken up into components that +represent the Active Directory domain identity and the relative identifier +(RID) of the user or group object. + + + The SSSD ID-mapping algorithm takes a range of available UIDs and divides it +into equally-sized component sections - called "slices"-. Each slice +represents the space available to an Active Directory domain. + + + When a user or group entry for a particular domain is encountered for the +first time, the SSSD allocates one of the available slices for that +domain. In order to make this slice-assignment repeatable on different +client machines, we select the slice based on the following algorithm: + + + The SID string is passed through the murmurhash3 algorithm to convert it to +a 32-bit hashed value. We then take the modulus of this value with the total +number of available slices to pick the slice. + + + NOTE: It is possible to encounter collisions in the hash and subsequent +modulus. In these situations, we will select the next available slice, but +it may not be possible to reproduce the same exact set of slices on other +machines (since the order that they are encountered will determine their +slice). In this situation, it is recommended to either switch to using +explicit POSIX attributes in Active Directory (disabling ID-mapping) or +configure a default domain to guarantee that at least one is always +consistent. See Configuration for details. + + + + + 設定 + + 最小の設定 ([domain/DOMAINNAME] セクションにおいて): + + + +ldap_id_mapping = True +ldap_schema = ad + + + + The default configuration results in configuring 10,000 slices, each capable +of holding up to 200,000 IDs, starting from 200,000 and going up to +2,000,200,000. This should be sufficient for most deployments. + + + 高度な設定 + + + ldap_idmap_range_min (整数) + + + Specifies the lower (inclusive) bound of the range of POSIX IDs to use for +mapping Active Directory user and group SIDs. It is the first POSIX ID which +can be used for the mapping. + + + NOTE: This option is different from min_id in that +min_id acts to filter the output of requests to this domain, +whereas this option controls the range of ID assignment. This is a subtle +distinction, but the good general advice would be to have +min_id be less-than or equal to +ldap_idmap_range_min + + + 初期値: 200000 + + + + + ldap_idmap_range_max (整数) + + + Specifies the upper (exclusive) bound of the range of POSIX IDs to use for +mapping Active Directory user and group SIDs. It is the first POSIX ID which +cannot be used for the mapping anymore, i.e. one larger than the last one +which can be used for the mapping. + + + NOTE: This option is different from max_id in that +max_id acts to filter the output of requests to this domain, +whereas this option controls the range of ID assignment. This is a subtle +distinction, but the good general advice would be to have +max_id be greater-than or equal to +ldap_idmap_range_max + + + 初期値: 2000200000 + + + + + ldap_idmap_range_size (整数) + + + 各スライスに利用可能な ID +番号を指定します。範囲の大きさが最小値、最大値の中にうまく分けられなければ、できる限り多くの完全なスライスとして作成されます。 + + + NOTE: The value of this option must be at least as large as the highest user +RID planned for use on the Active Directory server. User lookups and login +will fail for any user whose RID is greater than this value. + + + For example, if your most recently-added Active Directory user has +objectSid=S-1-5-21-2153326666-2176343378-3404031434-1107, +ldap_idmap_range_size must be at least 1108 as range size is +equal to maximal SID minus minimal SID plus one (e.g. 1108 = 1107 - 0 + 1). + + + It is important to plan ahead for future expansion, as changing this value +will result in changing all of the ID mappings on the system, leading to +users with different local IDs than they previously had. + + + 初期値: 200000 + + + + + ldap_idmap_default_domain_sid (文字列) + + + Specify the domain SID of the default domain. This will guarantee that this +domain will always be assigned to slice zero in the ID map, bypassing the +murmurhash algorithm described above. + + + 初期値: 設定されません + + + + + ldap_idmap_default_domain (文字列) + + + 初期ドメインの名前を指定します。 + + + 初期値: 設定されません + + + + + ldap_idmap_autorid_compat (論理値) + + + winbind の idmap_autorid アルゴリズムとより同じように振る舞うために ID +マッピングのアルゴリズムの振る舞いを変更します。 + + + When this option is configured, domains will be allocated starting with +slice zero and increasing monotonically with each additional domain. + + + 注記: このアルゴリズムは非決定的です (ユーザーとグループが要求された順番に依存します)。このモードはマシンが実行中の winbind +と互換性が必要ならば、少なくとも一つのドメインが一貫してスライス 0 +に割り当てられることを保証するために、ldap_idmap_default_domain_sid +オプションも使用することが推奨されます。 + + + 初期値: 偽 + + + + + ldap_idmap_helper_table_size (integer) + + + Maximal number of secondary slices that is tried when performing mapping +from UNIX id to SID. + + + Note: Additional secondary slices might be generated when SID is being +mapped to UNIX id and RID part of SID is out of range for secondary slices +generated so far. If value of ldap_idmap_helper_table_size is equal to 0 +then no additional secondary slices are generated. + + + 初期値: 10 + + + + + + + + + Well-Known SIDs + + SSSD supports to look up the names of Well-Known SIDs, i.e. SIDs with a +special hardcoded meaning. Since the generic users and groups related to +those Well-Known SIDs have no equivalent in a Linux/UNIX environment no +POSIX IDs are available for those objects. + + + The SID name space is organized in authorities which can be seen as +different domains. The authorities for the Well-Known SIDs are + + Null Authority + World Authority + Local Authority + Creator Authority + Mandatory Label Authority + Authentication Authority + NT Authority + Built-in + + The capitalized version of these names are used as domain names when +returning the fully qualified name of a Well-Known SID. + + + Since some utilities allow to modify SID based access control information +with the help of a name instead of using the SID directly SSSD supports to +look up the SID by the name as well. To avoid collisions only the fully +qualified names can be used to look up Well-Known SIDs. As a result the +domain names NULL AUTHORITY, WORLD AUTHORITY, +LOCAL AUTHORITY, CREATOR AUTHORITY, +MANDATORY LABEL AUTHORITY, AUTHENTICATION +AUTHORITY, NT AUTHORITY and BUILTIN +should not be used as domain names in sssd.conf. + + + + diff --git a/src/man/ja/include/ldap_search_bases.xml b/src/man/ja/include/ldap_search_bases.xml new file mode 100644 index 0000000..9b3118b --- /dev/null +++ b/src/man/ja/include/ldap_search_bases.xml @@ -0,0 +1,30 @@ + + + オプションのベース DN。この属性の種別に対する LDAP 検索を制限する、検索範囲および LDAP フィルター。 + + + 構文: +search_base[?scope?[filter][?search_base?scope?[filter]]*] + + + + The scope can be one of "base", "onelevel" or "subtree". The scope functions +as specified in section 4.5.1.2 of http://tools.ietf.org/html/rfc4511 + + + フィルターは http://www.ietf.org/rfc/rfc2254.txt により指定されたような有効な LDAP +検索フィルターである必要があります。 + + + For examples of this syntax, please refer to the +ldap_search_base examples section. + + + 初期値: ldap_search_base の値 + + + Please note that specifying scope or filter is not supported for searches +against an Active Directory Server that might yield a large number of +results and trigger the Range Retrieval extension in the response. + + diff --git a/src/man/ja/include/local.xml b/src/man/ja/include/local.xml new file mode 100644 index 0000000..d293c3b --- /dev/null +++ b/src/man/ja/include/local.xml @@ -0,0 +1,17 @@ + + ローカルドメイン + + In order to function correctly, a domain with +id_provider=local must be created and the SSSD must be +running. + + + The administrator might want to use the SSSD local users instead of +traditional UNIX users in cases where the group nesting (see +sss_groupadd 8 +) is needed. The local users are also useful for testing and +development of the SSSD without having to deploy a full remote server. The +sss_user* and sss_group* tools use a +local LDB storage to store users and groups. + + diff --git a/src/man/ja/include/override_homedir.xml b/src/man/ja/include/override_homedir.xml new file mode 100644 index 0000000..13bafd7 --- /dev/null +++ b/src/man/ja/include/override_homedir.xml @@ -0,0 +1,77 @@ + +override_homedir (文字列) + + + ユーザーのホームディレクトリーを上書きします。絶対パスまたはテンプレートを提供できます。テンプレートでは、以下のシーケンスが置換されます: + + + %u + ログイン名 + + + %U + UID 番号 + + + %d + ドメイン名 + + + %f + 完全修飾ユーザー名 (user@domain) + + + %l + The first letter of the login name. + + + %P + UPN - User Principal Name (name@REALM) + + + %o + + The original home directory retrieved from the identity provider. + + + + %h + + The original home directory retrieved from the identity provider, but in +lower case. + + + + %H + + The value of configure option homedir_substring. + + + + %% + 文字 '%' + + + + + + このオプションはドメインごとに設定できます。 + + + 例: +override_homedir = /home/%u + + + + 初期値: 設定なし (SSSD は LDAP から取得された値を使用します) + + + Please note, the home directory from a specific override for the user, +either locally (see +sss_override +8) or centrally managed IPA +id-overrides, has a higher precedence and will be used instead of the value +given by override_homedir. + + + diff --git a/src/man/ja/include/param_help.xml b/src/man/ja/include/param_help.xml new file mode 100644 index 0000000..49af3ff --- /dev/null +++ b/src/man/ja/include/param_help.xml @@ -0,0 +1,10 @@ + + + , + + + + ヘルプメッセージを表示して終了します。 + + + diff --git a/src/man/ja/include/param_help_py.xml b/src/man/ja/include/param_help_py.xml new file mode 100644 index 0000000..c239492 --- /dev/null +++ b/src/man/ja/include/param_help_py.xml @@ -0,0 +1,10 @@ + + + , + + + + ヘルプメッセージを表示して終了します。 + + + diff --git a/src/man/ja/include/seealso.xml b/src/man/ja/include/seealso.xml new file mode 100644 index 0000000..82d0d32 --- /dev/null +++ b/src/man/ja/include/seealso.xml @@ -0,0 +1,49 @@ + + 関連項目 + + sssd8 +, +sssd.conf5 +, +sssd-ldap5 +, +sssd-ldap-attributes5 +, +sssd-krb55 +, +sssd-simple5 +, +sssd-ipa5 +, +sssd-ad5 +, +sssd-files5 +, +sssd-sudo 5 +, +sssd-session-recording +5 , +sss_cache8 +, +sss_debuglevel8 +, +sss_obfuscate8 +, +sss_seed8 +, +sssd_krb5_locator_plugin8 +, +sss_ssh_authorizedkeys +8 , +sss_ssh_knownhostsproxy +8 , sssd-ifp +5 , +pam_sss8 +. +sss_rpcidmapd 5 + +sssd-systemtap 5 + + + diff --git a/src/man/ja/include/service_discovery.xml b/src/man/ja/include/service_discovery.xml new file mode 100644 index 0000000..1e0efb9 --- /dev/null +++ b/src/man/ja/include/service_discovery.xml @@ -0,0 +1,37 @@ + + サービス探索 + + The service discovery feature allows back ends to automatically find the +appropriate servers to connect to using a special DNS query. This feature is +not supported for backup servers. + + + 設定 + + 何もサーバーが指定されていなければ、バックエンドがサーバーを見つけようとするために、サービス探索を自動的に使用します。オプションとして、サーバーの一覧に特別なキーワード +_srv_ +を挿入することにより、ユーザーが固定サーバーアドレスおよびサービス探索のどちらも使用することを選択できます。これは設定の順番が維持されます。たとえば、ユーザーができる限りサービス探索を使用し、DNS +を使用してサーバーを探索できないときに特定のサーバーにフォールバックしたい場合、この機能は有用です。 + + + + ドメイン名 + + 詳細は sssd.conf +5 マニュアルページにある +dns_discovery_domain パラメーターを参照してください。 + + + + プロトコル + + 問い合わせは通常プロトコルとして _tcp を指定します。その他はそれぞれのオプションの説明にドキュメント化されています。 + + + + 関連項目 + + サービス検索メカニズムに関する詳細は RFC 2782 を参照してください。 + + + diff --git a/src/man/ja/include/upstream.xml b/src/man/ja/include/upstream.xml new file mode 100644 index 0000000..2a4ad16 --- /dev/null +++ b/src/man/ja/include/upstream.xml @@ -0,0 +1,3 @@ + +SSSD The SSSD upstream - +https://github.com/SSSD/sssd/ -- cgit v1.2.3