diff options
Diffstat (limited to 'it/using-d-i/modules')
| -rw-r--r-- | it/using-d-i/modules/kbd-chooser.xml | 6 | ||||
| -rw-r--r-- | it/using-d-i/modules/mdcfg.xml | 15 | ||||
| -rw-r--r-- | it/using-d-i/modules/partman-crypto.xml | 363 | ||||
| -rw-r--r-- | it/using-d-i/modules/partman.xml | 128 |
4 files changed, 468 insertions, 44 deletions
diff --git a/it/using-d-i/modules/kbd-chooser.xml b/it/using-d-i/modules/kbd-chooser.xml index 1482311dc..1e1faa907 100644 --- a/it/using-d-i/modules/kbd-chooser.xml +++ b/it/using-d-i/modules/kbd-chooser.xml @@ -1,5 +1,5 @@ <!-- retain these comments for translator revision tracking --> -<!-- original version: 28672 --> +<!-- original version: 38231 --> <sect3 id="kbd-chooser"> <!-- <title>Choosing a Keyboard</title> --> @@ -102,12 +102,12 @@ problemi. <!-- To get a working keyboard, you should boot the installer with parameter -<userinput>debconf/priority=medium</userinput>. When you get to keyboard +<userinput>priority=medium</userinput>. When you get to keyboard selection<footnote> --> Per avere una tastiera funzionante si deve lanciare l'installatore con -il parametro <userinput>debconf/priority=medium</userinput>. Al momento +il parametro <userinput>priority=medium</userinput>. Al momento di scegliere una tastiera<footnote> <para> diff --git a/it/using-d-i/modules/mdcfg.xml b/it/using-d-i/modules/mdcfg.xml index 1be1d1f0b..049e2f777 100644 --- a/it/using-d-i/modules/mdcfg.xml +++ b/it/using-d-i/modules/mdcfg.xml @@ -1,5 +1,5 @@ <!-- retain these comments for translator revision tracking --> -<!-- original version: 33725 --> +<!-- original version: 38703 --> <sect3 id="mdcfg"> @@ -301,6 +301,8 @@ dell'installazione manualmente tramite una shell. <!-- Next, you should choose <guimenuitem>Configure software RAID</guimenuitem> from the main <command>partman</command> menu. +(The menu will only appear after you mark at least one partition for +use as <guimenuitem>physical volume for RAID</guimenuitem>.) On the first screen of <command>mdcfg</command> simply select <guimenuitem>Create MD device</guimenuitem>. You will be presented with a list of supported types of MD devices, from which you should choose @@ -308,11 +310,12 @@ one (e.g. RAID1). What follows depends on the type of MD you selected. --> Poi nel menu principale di <command>partman</command> si deve selezionare -<guimenuitem>Configurare il RAID software</guimenuitem>. Nella prima -schermata di <command>mdcfg</command> selezionare <guimenuitem>Creare un -device multidisk (MD)</guimenuitem>, viene presentato un elenco dei tipi -di device MD supportati dal quale scegliere. Quello che segue dipende dal -tipo di device MD scelto. +<guimenuitem>Configurare il RAID software</guimenuitem> (questo menu appare +solo dopo aver marcato almeno una partizione come <guimenuitem>volume fisico +per il RAID</guimenuitem>). Nella prima schermata di <command>mdcfg</command> +selezionare <guimenuitem>Creare un device multidisk (MD)</guimenuitem>, viene +presentato un elenco dei tipi di device MD supportati dal quale scegliere. +Quello che segue dipende dal tipo di device MD scelto. </para> diff --git a/it/using-d-i/modules/partman-crypto.xml b/it/using-d-i/modules/partman-crypto.xml new file mode 100644 index 000000000..08fbbe1ec --- /dev/null +++ b/it/using-d-i/modules/partman-crypto.xml @@ -0,0 +1,363 @@ +<!-- retain these comments for translator revision tracking --> +<!-- original version: 38703 untranslated --> + + <sect3 id="partman-crypto"> + <title>Configuring Encrypted Volumes</title> +<para> + +&d-i; allows you to set up encrypted partitions. Every file you write +to such a partition is immediately saved to the device in encrypted +form. Access to the encrypted data is granted only after entering +the <firstterm>passphrase</firstterm> used when the encrypted +partition was originally created. This feature is useful to protect +sensitive data in case your laptop or hard drive gets stolen. The +thief might get physical access to the hard drive, but without knowing +the right passphrase, the data on the hard drive will look like random +characters. + +</para><para> + +The two most important partitions to encrypt are: the home partition, +where your private data resides, and the swap partition, where +sensitive data might be stored temporarily during operation. Of +course, nothing prevents you from encrypting any other partitions that might +be of interest. For example <filename>/var</filename> where database +servers, mail servers or print servers store their data, or +<filename>/tmp</filename> which is used by various programs to store +potentially interesting temporary files. Some people may even want to +encrypt their whole system. The only exception is +the <filename>/boot</filename> partition which must remain +unencrypted, because currently there is no way to load the kernel from +an encrypted partition. + +</para><note><para> + +Please note that the performance of encrypted partitions will be +less than that of unencrypted ones because the data needs to be +decrypted or encrypted for every read or write. The performance impact +depends on your CPU speed, chosen cipher and a key length. + +</para></note><para> + +To use encryption, you have to create a new partition by selecting +some free space in the main partitioning menu. Another option is to +choose an existing partition (e.g. a regular partition, an LVM logical +volume or a RAID volume). In the <guimenu>Partition setting</guimenu> +menu, you need to select <guimenuitem>physical volume for +encryption</guimenuitem> at the <menuchoice> <guimenu>Use +as:</guimenu> </menuchoice> option. The menu will then change to +include several cryptographic options for the partition. + +</para><para> + +&d-i; supports several encryption methods. The default method +is <firstterm>dm-crypt</firstterm> (included in newer Linux kernels, +able to host LVM physical volumes), the other +is <firstterm>loop-AES</firstterm> (older, maintained separately from +the Linux kernel tree). Unless you have compelling reasons to do +otherwise, it is recommended to use the default. + +<!-- TODO: link to the "Debian block device encryption guide" + once Max writes it :-) --> + +</para><para> + +First, let's have a look at available options available when you +select <userinput>Device-mapper (dm-crypt)</userinput> as the +encryption method. As always: when in doubt, use the defaults, because +they have been carefully chosen with security in mind. + +<variablelist> + +<varlistentry> +<term>Encryption: <userinput>aes</userinput></term> + +<listitem><para> + +This option lets you select the encryption algorithm +(<firstterm>cipher</firstterm>) which will be used to encrypt the data +on the partition. &d-i; currently supports the following block +ciphers: <firstterm>aes</firstterm>, <firstterm>blowfish</firstterm>, +<firstterm>serpent</firstterm>, and <firstterm>twofish</firstterm>. +It is beyond the scope of this document to discuss the qualities of +these different algorithms, however, it might help your decision to +know that in 2000, <emphasis>AES</emphasis> was chosen by the American +National Institute of Standards and Technology as the standard +encryption algorithm for protecting sensitive information in the 21st +century. + +</para></listitem> +</varlistentry> + +<varlistentry> +<term>Key size: <userinput>256</userinput></term> + +<listitem><para> + +Here you can specify the length of the encryption key. With a larger +key size, the strength of the encryption is generally improved. On the +other hand, increasing the length of the key usually has a negative +impact on performance. Available key sizes vary depending on the +cipher. + +</para></listitem> +</varlistentry> + +<varlistentry> +<term>IV algorithm: <userinput>cbc-essiv:sha256</userinput></term> + +<listitem><para> + +The <firstterm>Initialization Vector</firstterm> or +<firstterm>IV</firstterm> algorithm is used in cryptography to ensure +that applying the cipher on the same <firstterm>clear text</firstterm> +data with the same key always produces a unique +<firstterm>cipher text</firstterm>. The idea is to prevent the +attacker from deducing information from repeated patterns in the encrypted +data. + +</para><para> + +From the provided alternatives, the default +<userinput>cbc-essiv:sha256</userinput> is currently the least +vulnerable to known attacks. Use the other alternatives only when you +need to ensure compatibility with some previously installed system +that is not able to use newer algorithms. + +</para></listitem> +</varlistentry> + +<varlistentry> +<term>Encryption key: <userinput>Passphrase</userinput></term> + +<listitem><para> + +Here you can choose the type of the encryption key for this partition. + + <variablelist> + <varlistentry> + <term>Passphrase</term> + <listitem><para> + +The encryption key will be computed<footnote> +<para> + +Using a passphrase as the key currently means that the partition will +be set up using <ulink url="&url-luks;">LUKS</ulink>. + +</para></footnote> on the basis of a passphrase which you will be able +to enter later in the process. + + </para></listitem> + </varlistentry> + + <varlistentry> + <term>Random key</term> + <listitem><para> + +A new encryption key will be generated from random data each time you +try to bring up the encrypted partition. In other words: on every +shutdown the content of the partition will be lost as the key is +deleted from memory. (Of course, you could try to guess the key with a +brute force attack, but unless there is an unknown weakness in the +cipher algorithm, it is not achievable in our lifetime.) + + </para><para> + +Random keys are useful for swap partitions because you do not need to +bother yourself with remembering the passphrase or wiping sensitive +information from the swap partition before shutting down your +computer. However, it also means that you +will <emphasis>not</emphasis> be able to use +the <quote>suspend-to-disk</quote> functionality offered by newer +Linux kernels as it will be impossible (during a subsequent boot) to +recover the suspended data written to the swap partition. + + </para></listitem> + </varlistentry> + </variablelist> + +</para></listitem> +</varlistentry> + +<varlistentry> +<term>Erase data: <userinput>yes</userinput></term> + +<listitem><para> + +Determines whether the content of this partition should be overwritten +with random data before setting up the encryption. This is recommended +because it might otherwise be possible for an attacker to discern +which parts of the partition are in use and which are not. In +addition, this will make it harder to recover any leftover data from +previous installations<footnote><para> + +It is believed that the guys from three-letter agencies can restore +the data even after several rewrites of the magnetooptical media, +though. + +</para></footnote>. + +</para></listitem> +</varlistentry> + +</variablelist> + +</para><para> + +If you select <menuchoice> <guimenu>Encryption method:</guimenu> +<guimenuitem>Loopback (loop-AES)</guimenuitem> </menuchoice>, the menu +changes to provide the following options: + + +<variablelist> +<varlistentry> +<term>Encryption: <userinput>AES256</userinput></term> + +<listitem><para> + +For loop-AES, unlike dm-crypt, the options for cipher and key size are +combined, so you can select both at the same time. Please see the +above sections on ciphers and key sizes for further information. + +</para></listitem> +</varlistentry> + +<varlistentry> +<term>Encryption key: <userinput>Keyfile (GnuPG)</userinput></term> + +<listitem><para> + +Here you can select the type of the encryption key for this partition. + + <variablelist> + <varlistentry> + <term>Keyfile (GnuPG)</term> + <listitem><para> + +The encryption key will be generated from random data during the +installation. Moreover this key will be encrypted +with <application>GnuPG</application>, so to use it, you will need to +enter the proper passphrase (you will be asked to provide one later in +the process). + + </para></listitem> + </varlistentry> + + <varlistentry> + <term>Random key</term> + <listitem><para> + +Please see the the section on random keys above. + + </para></listitem> + </varlistentry> + </variablelist> + +</para></listitem> +</varlistentry> + +<varlistentry> +<term>Erase data: <userinput>yes</userinput></term> + +<listitem><para> + +Please see the the section on erasing data above. + +</para></listitem> +</varlistentry> + +</variablelist> + +</para><note><para> + +Please note that the <emphasis>graphical</emphasis> version of the +installer still has some limitations when compared to the textual +one. For cryptography it means you can set up only volumes using +<emphasis>passphrases</emphasis> as the encryption keys. + +</para></note><para> + + +After you have selected the desired parameters for your encrypted +partitions, return back to the main partitioning menu. There should +now be a new menu item called <guimenu>Configure encrypted +volumes</guimenu>. After you select it, you will be asked to confirm +the deletion of data on partitions marked to be erased and possibly +other actions such as writing a new partition table. For large +partitions this might take some time. + +</para><para> + +Next you will be asked to enter a passphrase for partitions configured +to use one. Good passphrases should be longer than 8 characters, +should be a mixture of letters, numbers and other characters and +should not contain common dictionary words or information easily +associable with you (such as birthdates, hobbies, pet names, names of +family members or relatives, etc.). + +</para><warning><para> + +Before you input any passphrases, you should have made sure that your +keyboard is configured correctly and generates the expected +characters. If you are unsure, you can switch to the second virtual +console and type some text at the prompt. This ensures that you won't be +surprised later, e.g. by trying to input a passphrase using a qwerty +keyboard layout when you used an azerty layout during the installation. +This situation can have several causes. Maybe you switched to another +keyboard layout during the installation, or the selected keyboard layout +might not have been set up yet when entering the passphrase for the +root file system. + +</para></warning><para> + +If you selected to use methods other than a passphrase to create +encryption keys, they will be generated now. Because the kernel may +not have gathered a sufficient amount of entropy at this early stage +of the installation, the process may take a long time. You can help +speed up the process by generating entropy: e.g. by pressing random +keys, or by switching to the shell on the second virtual console and +generating some network and disk traffic (downloading some files, +feeding big files into <filename>/dev/null</filename>, etc.). + +<!-- TODO: Mention hardware random generators when we will support + them --> + +This will be repeated for each partition to be encrypted. + +</para><para> + +After returning to the main partitioning menu, you will see all +encrypted volumes as additional partitions which can be configured in +the same way as ordinary partitions. The following example shows two +different volumes. The first one is encrypted via dm-crypt, the second +one via loop-AES. + +<informalexample><screen> +Encrypted volume (<replaceable>crypt0</replaceable>) - 115.1 GB Linux device-mapper + #1 115.1 GB F ext3 + +Loopback (<replaceable>loop0</replaceable>) - 515.2 MB AES256 keyfile + #1 515.2 MB F ext3 +</screen></informalexample> + +Now is the time to assign mount points to the volumes and optionally +change the file system types if the defaults do not suit you. + +</para><para> + +One thing to note here are the identifiers in parentheses +(<replaceable>crypt0</replaceable> +and <replaceable>loop0</replaceable> in this case) and the mount +points you assigned to each encrypted volume. You will need this +information later when booting the new system. The differences between +ordinary boot process and boot process with encryption involved will +be covered later in <xref linkend="mount-encrypted-volumes"/>. + +</para><para> + +Once you are satisfied with the partitioning scheme, continue with the +installation. + +</para> + </sect3> diff --git a/it/using-d-i/modules/partman.xml b/it/using-d-i/modules/partman.xml index f1ccb728d..c481d8461 100644 --- a/it/using-d-i/modules/partman.xml +++ b/it/using-d-i/modules/partman.xml @@ -1,5 +1,5 @@ <!-- retain these comments for translator revision tracking --> -<!-- original version: 30158 --> +<!-- original version: 38406 --> <sect3 id="partman"> @@ -36,17 +36,38 @@ manualmente</guimenuitem> dal menu. </para><para> <!-- -If you choose guided partitioning, you will be able to choose from the -schemes listed in the table below. All schemes have their pros and cons, +If you choose guided partitioning, you may have two options: to create +partitions directly on the hard disk (classic method) or to use Logical +Volume Management (LVM). In the second case, the installer will create most +partitions inside one big partition; the advantage of this method is that +partitions inside this big partition can be resized relatively easily later. +Note: the option to use LVM may not be available on all architectures. +--> + +Con il partizionamento guidato si hanno due possibilità: creare le partizioni +direttamente sull'hard disk (il metodo classico) oppure usare il Logical +Volume Management (LVM). Nel secondo caso, l'installatore crea la maggior +parte delle partizioni dentro una partizione più grande; il vantaggio di +questo metodo è che in seguito le partizioni interne possono essere +ridimensionate abbastanza facilmente. Nota: la possibilità di usare LVM +potrebbe non essere disponibile su tutte le architetture. + +</para><para> + +<!-- +After you choose guided partitioning (either classic or using LVM), you +will be able to choose from the schemes listed in the table below. +All schemes have their pros and cons, some of which are discussed in <xref linkend="partitioning"/>. If you are -unsure, choose the first one. Bear in mind, that guided partitioning -needs certain minimal amount of free space to operate with. If you don't +unsure, choose the first one. Bear in mind that guided partitioning +needs a certain minimal amount of free space to operate with. If you don't give it at least about 1GB of space (depends on chosen scheme), guided partitioning will fail. --> -Se si sceglie il partizionamento guidato, è possibile scegliere uno degli -schemi elencati nella tabella qui sotto. Tutti gli schemi hanno pro e contro, +Una volta scelto il partizionamento guidato (classico o con LVM), +è possibile scegliere uno degli +schemi elencati nella tabella seguente. Tutti gli schemi hanno pro e contro, alcuni dei quali sono discussi in <xref linkend="partitioning"/>. Si consiglia l'uso del primo schema se si hanno dei dubbi su quale scegliere. Inoltre si deve tener presente che il partizionamento guidato ha bisogno di quantità @@ -73,15 +94,15 @@ guidato non funziona. <entry>600MB</entry> <entry><filename>/</filename>, swap</entry> </row><row> - <entry><!-- Desktop machine --> - Macchina desktop</entry> + <entry><!-- Separate /home partition --> + Partizione /home separata</entry> <entry>500MB</entry> <entry> <filename>/</filename>, <filename>/home</filename>, swap </entry> </row><row> - <entry><!-- Multi-user workstation --> - Stazione di lavoro multi-utente</entry> + <entry><!-- Separate /home, /usr, /var and /tmp partitions --> + Partizioni /home, /usr, /var e /tmp separate</entry> <entry>1GB</entry> <entry> <filename>/</filename>, <filename>/home</filename>, @@ -92,17 +113,29 @@ guidato non funziona. </tbody></tgroup></informaltable> -<para arch="ia64"> +<para> + +<!-- +If you choose guided partitioning using LVM, the installer will also create +a separate /boot partition. The other partitions, except for the swap +partition, will be created inside the LVM partition. +--> + +Se si sceglie il partizionamento guidato con LVM, l'installatore crea +una partizione /boot separata. Le altre partizioni, a eccezione della +partizione di swap, sono create dentro la partizione LVM. + +</para><para arch="ia64"> <!-- -If you chose an automatic partitioning for your IA64 system, there +If you choose guided partitioning for your IA64 system, there will be an additional partition, formatted as a FAT16 bootable filesystem, for the EFI boot loader. There is also an additional menu item in the formatting menu to manually set up a partition as an EFI boot partition. --> -Se si sceglie il partizionamento automatico su un sistema IA64 viene +Se si sceglie il partizionamento guidato su un sistema IA64 viene allocata un'ulteriore partizione avviabile, formattata con un file system FAT16, per il boot loader EFI. C'è anche un'apposita voce nel menu per la formattazione che serve a impostare una partizione come quella d'avvio @@ -111,12 +144,12 @@ per EFI. </para><para arch="alpha"> <!-- -If you chose an automatic partitioning for your Alpha system, an +If you choose guided partitioning for your Alpha system, an additional, unformatted partition will be allocated at the beginning of your disk to reserve this space for the aboot boot loader. --> -Se si sceglie il partizionamento automatico su un sistema Alpha viene +Se si sceglie il partizionamento guidato su un sistema Alpha viene allocata un'ulteriore partizione all'inizio del disco per riservare lo spazio al boot loader aboot. @@ -140,36 +173,40 @@ The list of partitions might look like this: L'elenco delle partizioni dovrebbe assomigliare a questo: -<!-- TODO: show some flags here (lightning, skull, smiley) --> <informalexample><screen> IDE1 master (hda) - 6.4 GB WDC AC36400L - #1 primary 16.4 MB ext2 /boot - #2 primary 551.0 MB swap swap - #3 primary 5.8 GB ntfs - pri/log 8.2 MB FREE SPACE + #1 primary 16.4 MB B f ext2 /boot + #2 primary 551.0 MB swap swap + #3 primary 5.8 GB ntfs + pri/log 8.2 MB FREE SPACE IDE1 slave (hdb) - 80.0 GB ST380021A - #1 primary 15.9 MB ext3 - #2 primary 996.0 MB fat16 - #3 primary 3.9 GB xfs /home - #5 logical 6.0 GB ext3 / - #6 logical 1.0 GB ext3 /var - #7 logical 498.8 MB ext3 - #8 logical 551.5 MB swap swap - #9 logical 65.8 GB ext2 + #1 primary 15.9 MB ext3 + #2 primary 996.0 MB fat16 + #3 primary 3.9 GB xfs /home + #5 logical 6.0 GB f ext3 / + #6 logical 1.0 GB f ext3 /var + #7 logical 498.8 MB ext3 + #8 logical 551.5 MB swap swap + #9 logical 65.8 GB ext2 </screen></informalexample> <!-- This example shows two IDE harddrives divided into several partitions; the first disk has some free space. Each partition line consists of the partition number, its type, size, optional flags, file system, and -mountpoint (if any). +mountpoint (if any). Note: this particular setup cannot be created using +guided partitioning but it does show possible variation that can be achieved +using manual partitioning). --> Questo esempio mostra due dischi IDE divisi in parecchie partizioni; il primo disco dispone anche di un po' di spazio libero. In ogni riga che corrisponde a una partizione è riportato numero, tipo, dimensione, flag opzionali, file system e mout point (se assegnato) della partizione. +Nota: questa particolare impostazione non può essere realizzata usando il +partizionamento guidato poiché mostra delle variazioni che possono essere +realizzate solo con il partizionamento manuale. </para><para> @@ -179,8 +216,7 @@ generated partition table, you can choose <guimenuitem>Finish partitioning and write changes to disk</guimenuitem> from the menu to implement the new partition table (as described at the end of this section). If you are not happy, you can choose to <guimenuitem>Undo -changes to partitions</guimenuitem>, to run guided partitioning again -or modify the proposed changes as described below for manual partitioning. +changes to partitions</guimenuitem><footnote> --> Con questo si conclude la parte guidata del partizionamento. Se si è @@ -189,7 +225,29 @@ soddisfatti della tabella delle partizioni appena creata si può selezionare disco</guimenuitem> dal menu per scrivere la nuova tabella delle partizioni (come descritto alla fine di questa sezione). Invece se il risultato non è soddisfacente si può scegliere <guimenuitem>Annullare i cambiamenti alle -partizioni</guimenuitem> per eseguire un nuovo partizionamento guidato o +partizioni</guimenuitem><footnote> + +<para> + +<!-- +If you selected guided partitioning using LVM, you will not be able to undo +all changes made as some changes will already have been committed to the +hard disk. The installer will warn you before that happens though. +--> + +Se si sceglie il partizionamento guidato con LVM, non è possibile annullare +qualsiasi modifica dato che alcune modifiche vengono effettuate direttamente +sull'hard disk. Comunque, prima di fare questo tipo di operazioni, +l'installatore emette un avviso. + +</para> + +<!-- +</footnote> and run guided partitioning again, or modify the proposed changes +as described below for manual partitioning. +--> + +</footnote> e eseguire un nuovo partizionamento guidato o modificare i cambiamenti proposti usando la stessa procedura (descritta in seguito) per il partizionamento manuale. @@ -243,7 +301,7 @@ use it at all. Other nice feature is the possibility to copy data from existing partition onto this one. When you are satisfied with your new partition, select <guimenuitem>Done setting up the partition</guimenuitem> and you will be -thrown back to the <command>partman</command>'s main screen. +thrown back to <command>partman</command>'s main screen. --> Quando si seleziona dello spazio libero viene data la possibilità di creare @@ -303,7 +361,7 @@ dell'installazione. </para><para arch="ia64"> <!-- -If you forget to select and format an EFI boot partition +If you forget to select and format an EFI boot partition, <command>partman</command> will detect this and will not let you continue until you allocate one. --> |