Translation

(itstool) path: sect1/para
English
There are (basically) two areas of the LDAP service which need configuration. The first is setting up a server to receive connections properly, and the second is adding entries to the server's directory so that FreeBSD tools know how to interact with it.
284/2540
Context English Portuguese (Brazil) State
LDAP Authentication Autenticação LDAP

<email>kurin@causa-sui.net</email>
<email>kurin@causa-sui.net</email>
<personname> <firstname>Toby</firstname> <surname>Burress</surname> </personname> <affiliation> <_:address-1/> </affiliation> <personname> <firstname>Toby</firstname> <surname>Burress</surname> </personname> <affiliation> <_:address-1/> </affiliation>
<year>2007</year> <year>2008</year> <holder>The FreeBSD Documentation Project</holder> <year>2007</year> <year>2008</year> <holder>Projeto de Documentação do FreeBSD</holder>
FreeBSD is a registered trademark of the FreeBSD Foundation. FreeBSD is a registered trademark of the FreeBSD Foundation.
Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this document, and the FreeBSD Project was aware of the trademark claim, the designations have been followed by the <quote>™</quote> or the <quote>®</quote> symbol. Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this document, and the FreeBSD Project was aware of the trademark claim, the designations have been followed by the <quote>™</quote> or the <quote>®</quote> symbol.
$FreeBSD$
This document is intended as a guide for the configuration of an LDAP server (principally an <application>OpenLDAP</application> server) for authentication on FreeBSD. This is useful for situations where many servers need the same user accounts, for example as a replacement for <application>NIS</application>. Este documento pretende ser um guia para a configuração de um servidor LDAP (principalmente um servidor <application>OpenLDAP</application>) para autenticação no FreeBSD. Isso é útil para situações em que muitos servidores precisam das mesmas contas de usuário, por exemplo, como substituto do <application>NIS</application>.
Preface Prefácio
This document is intended to give the reader enough of an understanding of LDAP to configure an LDAP server. This document will attempt to provide an explanation of <package>net/nss_ldap</package> and <package>security/pam_ldap</package> for use with client machines services for use with the LDAP server. Este documento destina-se a fornecer ao leitor uma compreensão suficiente do LDAP para configurar um servidor LDAP. Este documento tentará fornecer uma explicação de <package>net/nss_ldap</package> e <package>security/pam_ldap</package> para uso com serviços de máquinas cliente para uso com o servidor LDAP.
When finished, the reader should be able to configure and deploy a FreeBSD server that can host an LDAP directory, and to configure and deploy a FreeBSD server which can authenticate against an LDAP directory. Quando terminar, o leitor deve ser capaz de configurar e implantar um servidor FreeBSD que possa hospedar um diretório LDAP e configurar e implantar um servidor FreeBSD que possa autenticar em um diretório LDAP.
This article is not intended to be an exhaustive account of the security, robustness, or best practice considerations for configuring LDAP or the other services discussed herein. While the author takes care to do everything correctly, they do not address security issues beyond a general scope. This article should be considered to lay the theoretical groundwork only, and any actual implementation should be accompanied by careful requirement analysis. Este artigo não pretende ser um relato exaustivo da segurança, robustez ou considerações sobre práticas recomendadas para configurar o LDAP ou os outros serviços discutidos aqui. Embora o autor tenha o cuidado de fazer tudo corretamente, ele não aborda problemas de segurança além do escopo geral. Este artigo deve ser considerado para estabelecer as bases teóricas somente, e qualquer implementação real deve ser acompanhada por uma análise cuidadosa dos requisitos.
Configuring LDAP Configurando o LDAP
LDAP stands for <quote>Lightweight Directory Access Protocol</quote> and is a subset of the X.500 Directory Access Protocol. Its most recent specifications are in <link xlink:href="http://www.ietf.org/rfc/rfc4510.txt">RFC4510</link> and friends. Essentially it is a database that expects to be read from more often than it is written to. LDAP significa <quote>Lightweight Directory Access Protocol</quote> e é um subconjunto do X.500 Directory Access Protocol. Suas especificações mais recentes estão na <link xlink:href="http://www.ietf.org/rfc/rfc4510.txt">RFC4510</link> e documentos amigaveis. Essencialmente, é um banco de dados que espera ser lido com mais frequência do que é escrito.
The LDAP server <link xlink:href="http://www.openldap.org/">OpenLDAP</link> will be used in the examples in this document; while the principles here should be generally applicable to many different servers, most of the concrete administration is <application>OpenLDAP</application>-specific. There are several server versions in ports, for example <package>net/openldap24-server</package>. Client servers will need the corresponding <package>net/openldap24-client</package> libraries. O servidor LDAP <link xlink:href="http://www.openldap.org/">OpenLDAP</link> será usado nos exemplos deste documento; embora os princípios aqui devam ser geralmente aplicáveis a muitos servidores diferentes, a maior parte da administração concreta é especificamente para <application>OpenLDAP</application>. Existem várias versões de servidor nos ports, por exemplo <package>net/openldap24-server</package>. Os servidores clientes precisarão das bibliotecas <package>net/openldap24-client</package> correspondentes.
There are (basically) two areas of the LDAP service which need configuration. The first is setting up a server to receive connections properly, and the second is adding entries to the server's directory so that FreeBSD tools know how to interact with it. Existem (basicamente) duas áreas do serviço LDAP que precisam de configuração. A primeira é a configuração de um servidor para receber as conexões corretamente, e o segundo é adicionar entradas ao diretório do servidor para que as ferramentas do FreeBSD saibam como interagir com ele.
Setting Up the Server for Connections Configurando o servidor para conexões
This section is specific to <application>OpenLDAP</application>. If you are using another server, you will need to consult that server's documentation. Esta seção é específica do <application>OpenLDAP</application>. Se você estiver usando outro servidor, precisará consultar a documentação desse servidor.
Installing <application>OpenLDAP</application> Instalando o <application>OpenLDAP</application>
First, install <application>OpenLDAP</application>: Primeiro, instale o <application>OpenLDAP</application>:
<prompt>#</prompt> <userinput>cd /usr/ports/net/openldap24-server</userinput>
<prompt>#</prompt> make install clean 		<prompt>#</prompt> <userinput>cd /usr/ports/net/openldap24-server</userinput>
<prompt>#</prompt> make install clean
This installs the <command>slapd</command> and <command>slurpd</command> binaries, along with the required <application>OpenLDAP</application> libraries. Isso instala os binários <command>slapd</command> e <command>slurpd</command>, juntamente com as bibliotecas <application>OpenLDAP</application> requeridas.
Configuring <application>OpenLDAP</application> Configurando o <application>OpenLDAP</application>
Next we must configure <application>OpenLDAP</application>. Em seguida, devemos configurar o <application>OpenLDAP</application>.
You will want to require encryption in your connections to the LDAP server; otherwise your users' passwords will be transferred in plain text, which is considered insecure. The tools we will be using support two very similar kinds of encryption, SSL and TLS. Você desejará exigir criptografia em suas conexões com o servidor LDAP; caso contrário, as senhas de seus usuários serão transferidas em texto simples, o que é considerado inseguro. As ferramentas que usaremos suportam dois tipos muito semelhantes de criptografia, SSL e TLS.
TLS stands for <quote>Transportation Layer Security</quote>. Services that employ TLS tend to connect on the <emphasis>same</emphasis> ports as the same services without TLS; thus an SMTP server which supports TLS will listen for connections on port 25, and an LDAP server will listen on 389. TLS significa <quote>Segurança da Camada de Transporte</quote>. Serviços que empregam TLS tendem a se conectar nas <emphasis>mesmas</emphasis> portas que os mesmos serviços sem TLS; assim, um servidor SMTP que suporte o TLS escutará as conexões na porta 25 e um servidor LDAP escutará no 389.
SSL stands for <quote>Secure Sockets Layer</quote>, and services that implement SSL do <emphasis>not</emphasis> listen on the same ports as their non-SSL counterparts. Thus SMTPS listens on port 465 (not 25), HTTPS listens on 443, and LDAPS on 636. SSL significa <quote>Secure Sockets Layer</quote>, e serviços que implementam SSL <emphasis>não</emphasis> escutam nas mesmas portas que seus equivalentes não-SSL. Assim, o SMTPS atende na porta 465 (não 25), HTTPS escuta na 443 e LDAPS na 636.
The reason SSL uses a different port than TLS is because a TLS connection begins as plain text, and switches to encrypted traffic after the <literal>STARTTLS</literal> directive. SSL connections are encrypted from the beginning. Other than that there are no substantial differences between the two. A razão pela qual o SSL usa uma porta diferente do TLS é porque uma conexão TLS começa como texto simples e alterna para o tráfego criptografado após a diretiva <literal>STARTTLS</literal>. As conexões SSL são criptografadas desde o início. Além disso, não há diferenças substanciais entre os dois.
We will adjust <application>OpenLDAP</application> to use TLS, as SSL is considered deprecated. Ajustaremos o <application>OpenLDAP</application> para usar o TLS, já que o SSL é considerado obsoleto.
Once <application>OpenLDAP</application> is installed via ports, the following configuration parameters in <filename>/usr/local/etc/openldap/slapd.conf</filename> will enable TLS: Uma vez que o <application>OpenLDAP</application> esteja instalado via ports, os seguintes parâmetros de configuração em <filename>/usr/local/etc/openldap/slapd.conf</filename> irão ativar o TLS:
security ssf=128

TLSCertificateFile /path/to/your/cert.crt
TLSCertificateKeyFile /path/to/your/cert.key
TLSCACertificateFile /path/to/your/cacert.crt 		security ssf=128

TLSCertificateFile /caminho/para/seu/cert.crt
TLSCertificateKeyFile /caminho/para/sua/cert.key
TLSCACertificateFile /caminho/para/seu/cacert.crt

Loading…

No matching activity found.

Browse all component changes

Glossary

English Portuguese (Brazil)
No related strings found in the glossary.

Source information

Source string comment
(itstool) path: sect1/para
Source string location
article.translate.xml:96
String age
a year ago
Source string age
a year ago
Translation file
articles/pt_BR/ldap-auth.po, string 17