Units
Translation components API.
See the Weblate's Web API documentation for detailed description of the API.
GET /api/translations/freeipa/ipa-4-8/es/units/?format=api&page=86
{ "count": 4647, "next": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/units/?format=api&page=87", "previous": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/units/?format=api&page=85", "results": [ { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "netgroups to add" ], "previous_source": "netgroups", "target": [ "grupos de red" ], "id_hash": -8855410226324430815, "content_hash": -8855410226324430815, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4190, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 3, "source_unit": "https://translate.fedoraproject.org/api/units/2726312/?format=api", "priority": 100, "id": 4705622, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=051b43512f922021", "url": "https://translate.fedoraproject.org/api/units/4705622/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.089902Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Search for netgroups with these member netgroups." ], "previous_source": "Search for services with these managed by hosts.", "target": [ "Búsqueda de servicios con aquellos gestionados por hosts." ], "id_hash": -5878563974321080361, "content_hash": -5878563974321080361, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4191, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 7, "source_unit": "https://translate.fedoraproject.org/api/units/2725453/?format=api", "priority": 100, "id": 4705623, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=2e6b2536192ef7d7", "url": "https://translate.fedoraproject.org/api/units/4705623/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.113181Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Search for netgroups without these member netgroups." ], "previous_source": "Search for services without these managed by hosts.", "target": [ "Búsqueda de servicios sin aquellos gestionados por hosts." ], "id_hash": 2180856112128262047, "content_hash": 2180856112128262047, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4192, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 7, "source_unit": "https://translate.fedoraproject.org/api/units/2725465/?format=api", "priority": 100, "id": 4705625, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=9e43f5144da4ff9f", "url": "https://translate.fedoraproject.org/api/units/4705625/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.149513Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Search for netgroups with these member users." ], "previous_source": "Search for services with these managed by hosts.", "target": [ "Búsqueda de servicios con aquellos gestionados por hosts." ], "id_hash": -7980157661121504966, "content_hash": -7980157661121504966, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4193, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 7, "source_unit": "https://translate.fedoraproject.org/api/units/2725457/?format=api", "priority": 100, "id": 4705626, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=1140c8e34d3d993a", "url": "https://translate.fedoraproject.org/api/units/4705626/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.176148Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Search for netgroups without these member users." ], "previous_source": "Search for services without these managed by hosts.", "target": [ "Búsqueda de servicios sin aquellos gestionados por hosts." ], "id_hash": -8022641472296252896, "content_hash": -8022641472296252896, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4194, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 7, "source_unit": "https://translate.fedoraproject.org/api/units/2725469/?format=api", "priority": 100, "id": 4705628, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=10a9da1633770a20", "url": "https://translate.fedoraproject.org/api/units/4705628/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.209401Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Search for netgroups with these member groups." ], "previous_source": "Search for services with these managed by hosts.", "target": [ "Búsqueda de servicios con aquellos gestionados por hosts." ], "id_hash": 9073441658790212857, "content_hash": 9073441658790212857, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4195, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 7, "source_unit": "https://translate.fedoraproject.org/api/units/2725447/?format=api", "priority": 100, "id": 4705629, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=fdeb571d926bf4f9", "url": "https://translate.fedoraproject.org/api/units/4705629/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.234591Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Search for netgroups without these member groups." ], "previous_source": "Search for services without these managed by hosts.", "target": [ "Búsqueda de servicios sin aquellos gestionados por hosts." ], "id_hash": -8885434577647603729, "content_hash": -8885434577647603729, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4196, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 7, "source_unit": "https://translate.fedoraproject.org/api/units/2725459/?format=api", "priority": 100, "id": 4705630, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=04b0985424576fef", "url": "https://translate.fedoraproject.org/api/units/4705630/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.256482Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Search for netgroups with these member hosts." ], "previous_source": "Search for services with these managed by hosts.", "target": [ "Búsqueda de servicios con aquellos gestionados por hosts." ], "id_hash": 4077710205644427326, "content_hash": 4077710205644427326, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4197, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 7, "source_unit": "https://translate.fedoraproject.org/api/units/2725451/?format=api", "priority": 100, "id": 4705632, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=b896efd3d06bd03e", "url": "https://translate.fedoraproject.org/api/units/4705632/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.288365Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Search for netgroups without these member hosts." ], "previous_source": "Search for services without these managed by hosts.", "target": [ "Búsqueda de servicios sin aquellos gestionados por hosts." ], "id_hash": -4981993079190289993, "content_hash": -4981993079190289993, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4198, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 7, "source_unit": "https://translate.fedoraproject.org/api/units/2725463/?format=api", "priority": 100, "id": 4705633, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=3adc67b0b16881b7", "url": "https://translate.fedoraproject.org/api/units/4705633/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.317054Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Search for netgroups with these member host groups." ], "previous_source": "Search for services with these managed by hosts.", "target": [ "Búsqueda de servicios con aquellos gestionados por hosts." ], "id_hash": 6441470995615710079, "content_hash": 6441470995615710079, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4199, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 8, "source_unit": "https://translate.fedoraproject.org/api/units/2725449/?format=api", "priority": 100, "id": 4705635, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=d964b3bdfca7fb7f", "url": "https://translate.fedoraproject.org/api/units/4705635/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.354649Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Search for netgroups without these member host groups." ], "previous_source": "Search for services without these managed by hosts.", "target": [ "Búsqueda de servicios sin aquellos gestionados por hosts." ], "id_hash": 7384870289028354603, "content_hash": 7384870289028354603, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4200, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 8, "source_unit": "https://translate.fedoraproject.org/api/units/2725461/?format=api", "priority": 100, "id": 4705636, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=e67c5466b1df122b", "url": "https://translate.fedoraproject.org/api/units/4705636/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.387724Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Search for netgroups with these member of netgroups." ], "previous_source": "Search for services with these managed by hosts.", "target": [ "Búsqueda de servicios con aquellos gestionados por hosts." ], "id_hash": -2346941409587251795, "content_hash": -2346941409587251795, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4201, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 8, "source_unit": "https://translate.fedoraproject.org/api/units/2725455/?format=api", "priority": 100, "id": 4705638, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=5f6dfd38fce5b5ad", "url": "https://translate.fedoraproject.org/api/units/4705638/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.417135Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Search for netgroups without these member of netgroups." ], "previous_source": "Search for services without these managed by hosts.", "target": [ "Búsqueda de servicios sin aquellos gestionados por hosts." ], "id_hash": 1129178580549752088, "content_hash": 1129178580549752088, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4202, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 8, "source_unit": "https://translate.fedoraproject.org/api/units/2725467/?format=api", "priority": 100, "id": 4705639, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=8faba5efb5a5d518", "url": "https://translate.fedoraproject.org/api/units/4705639/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.435292Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "netgroups to remove" ], "previous_source": "%s to remove", "target": [ "%s a eliminar" ], "id_hash": 1072142786623315994, "content_hash": 1072142786623315994, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4203, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 3, "source_unit": "https://translate.fedoraproject.org/api/units/2726314/?format=api", "priority": 100, "id": 4705641, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=8ee1042f192e201a", "url": "https://translate.fedoraproject.org/api/units/4705641/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.463328Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "\nOTP Tokens\n\nManage OTP tokens.\n\nIPA supports the use of OTP tokens for multi-factor authentication. This\ncode enables the management of OTP tokens.\n\nEXAMPLES:\n\n Add a new token:\n ipa otptoken-add --type=totp --owner=jdoe --desc=\"My soft token\"\n\n Examine the token:\n ipa otptoken-show a93db710-a31a-4639-8647-f15b2c70b78a\n\n Change the vendor:\n ipa otptoken-mod a93db710-a31a-4639-8647-f15b2c70b78a --vendor=\"Red Hat\"\n\n Delete a token:\n ipa otptoken-del a93db710-a31a-4639-8647-f15b2c70b78a\n" ], "previous_source": "", "target": [ "" ], "id_hash": -9184665594191245485, "content_hash": -9184665594191245485, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 0, "fuzzy": false, "translated": false, "approved": false, "position": 4204, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 55, "source_unit": "https://translate.fedoraproject.org/api/units/2722388/?format=api", "priority": 100, "id": 4705643, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=0089834df57a8f53", "url": "https://translate.fedoraproject.org/api/units/4705643/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.494149Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Results should contain primary key attribute only (\"id\")" ], "previous_source": "Results should contain primary key attribute only (\"%s\")", "target": [ "Los resultados deberían contener sólo atributo de clave primaria (“%s”)" ], "id_hash": 6625752498028584176, "content_hash": 6625752498028584176, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4205, "has_suggestion": true, "has_comment": false, "has_failing_check": false, "num_words": 8, "source_unit": "https://translate.fedoraproject.org/api/units/2725229/?format=api", "priority": 100, "id": 4705644, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=dbf366cacea69cf0", "url": "https://translate.fedoraproject.org/api/units/4705644/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.526199Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Rename the OTP token object" ], "previous_source": "Rename the permission object", "target": [ "Renombrar el permiso del objeto" ], "id_hash": -2066627687064029586, "content_hash": -2066627687064029586, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4206, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 5, "source_unit": "https://translate.fedoraproject.org/api/units/2725170/?format=api", "priority": 100, "id": 4705646, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=6351dd116d8fb66e", "url": "https://translate.fedoraproject.org/api/units/4705646/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.567517Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "\nYubiKey Tokens\n\nManage YubiKey tokens.\n\nThis code is an extension to the otptoken plugin and provides support for\nreading/writing YubiKey tokens directly.\n\nEXAMPLES:\n\n Add a new token:\n ipa otptoken-add-yubikey --owner=jdoe --desc=\"My YubiKey\"\n" ], "previous_source": "\nThis code is an extension to the otptoken plugin and provides support for\nreading/writing YubiKey tokens directly.\n", "target": [ "\nEste código es una extensión del plugin otptoken y suministra el soporte para\n leer/escribir directamente en las fichasYubiKey.\n" ], "id_hash": 5312162563820132141, "content_hash": 5312162563820132141, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4207, "has_suggestion": false, "has_comment": false, "has_failing_check": true, "num_words": 32, "source_unit": "https://translate.fedoraproject.org/api/units/2728005/?format=api", "priority": 100, "id": 4705647, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=c9b897b4eda0972d", "url": "https://translate.fedoraproject.org/api/units/4705647/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.597155Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "\nPermissions\n\nA permission enables fine-grained delegation of rights. A permission is\na human-readable wrapper around a 389-ds Access Control Rule,\nor instruction (ACI).\nA permission grants the right to perform a specific task such as adding a\nuser, modifying a group, etc.\n\nA permission may not contain other permissions.\n\n* A permission grants access to read, write, add, delete, read, search,\n or compare.\n* A privilege combines similar permissions (for example all the permissions\n needed to add a user).\n* A role grants a set of privileges to users, groups, hosts or hostgroups.\n\nA permission is made up of a number of different parts:\n\n1. The name of the permission.\n2. The target of the permission.\n3. The rights granted by the permission.\n\nRights define what operations are allowed, and may be one or more\nof the following:\n1. write - write one or more attributes\n2. read - read one or more attributes\n3. search - search on one or more attributes\n4. compare - compare one or more attributes\n5. add - add a new entry to the tree\n6. delete - delete an existing entry\n7. all - all permissions are granted\n\nNote the distinction between attributes and entries. The permissions are\nindependent, so being able to add a user does not mean that the user will\nbe editable.\n\nThere are a number of allowed targets:\n1. subtree: a DN; the permission applies to the subtree under this DN\n2. target filter: an LDAP filter\n3. target: DN with possible wildcards, specifies entries permission applies to\n\nAdditionally, there are the following convenience options.\nSetting one of these options will set the corresponding attribute(s).\n1. type: a type of object (user, group, etc); sets subtree and target filter.\n2. memberof: apply to members of a group; sets target filter\n3. targetgroup: grant access to modify a specific group (such as granting\n the rights to manage group membership); sets target.\n\nManaged permissions\n\nPermissions that come with IPA by default can be so-called \"managed\"\npermissions. These have a default set of attributes they apply to,\nbut the administrator can add/remove individual attributes to/from the set.\n\nDeleting or renaming a managed permission, as well as changing its target,\nis not allowed.\n\nEXAMPLES:\n\n Add a permission that grants the creation of users:\n ipa permission-add --type=user --permissions=add \"Add Users\"\n\n Add a permission that grants the ability to manage group membership:\n ipa permission-add --attrs=member --permissions=write --type=group \"Manage Group Members\"\n" ], "previous_source": "\nPermissions\n\nA permission enables fine-grained delegation of rights. A permission is\na human-readable form of a 389-ds Access Control Rule, or instruction (ACI).\nA permission grants the right to perform a specific task such as adding a\nuser, modifying a group, etc.\n\nA permission may not contain other permissions.\n\n* A permission grants access to read, write, add or delete.\n* A privilege combines similar permissions (for example all the permissions\n needed to add a user).\n* A role grants a set of privileges to users, groups, hosts or hostgroups.\n\nA permission is made up of a number of different parts:\n\n1. The name of the permission.\n2. The target of the permission.\n3. The rights granted by the permission.\n\nRights define what operations are allowed, and may be one or more\nof the following:\n1. write - write one or more attributes\n2. read - read one or more attributes\n3. add - add a new entry to the tree\n4. delete - delete an existing entry\n5. all - all permissions are granted\n\nRead permission is granted for most attributes by default so the read\npermission is not expected to be used very often.\n\nNote the distinction between attributes and entries. The permissions are\nindependent, so being able to add a user does not mean that the user will\nbe editable.\n\nThere are a number of allowed targets:\n1. type: a type of object (user, group, etc).\n2. memberof: a member of a group or hostgroup\n3. filter: an LDAP filter\n4. subtree: an LDAP filter specifying part of the LDAP DIT. This is a\n super-set of the \"type\" target.\n5. targetgroup: grant access to modify a specific group (such as granting\n the rights to manage group membership)\n\nEXAMPLES:\n\n Add a permission that grants the creation of users:\n ipa permission-add --type=user --permissions=add \"Add Users\"\n\n Add a permission that grants the ability to manage group membership:\n ipa permission-add --attrs=member --permissions=write --type=group \"Manage Group Members\"\n", "target": [ "\nPermisos\n\nUn permiso habilita una delegación de grano fino de derechos. Un permiso es un formato\nlegible por el hombre de una Regla de Control de Acceso (ACL) 389-ds o una instrucción (ACI).\nUn permiso otorga el derecho de llevar a cabo una tarea específica como añadir un\nusuario, modificar un grupo, etc.\n\nUn permiso puede contener otros permisos.\n\n* Un permiso otorga acceso de escritura, lectura, añadir o borrar.\n* Un privilegio combina permisos similares (por ejemplo los permisos necesarios para \n añadir un usuario).\n* Un rol otorga un conjunto de privilegios a usuarios, grupos, hosts o grupos de hosts.\n\nUn permiso consta de diversas partes:\n\n1. El nombre del permiso.\n2. El objetivo del permiso.\n3. Los derechos otorgados por el permiso.\n\nLos derechos definen que operaciones están permitidas y pueden ser una o más de las\nsiguientes:\n1. write - escribir uno o más atributos\n2. read - leer uno o más atributos\n3. add - añadir una nueva entrada al árbol\n4. delete - borrar una entrada existente\n5. all - se otorgan todos los permisos\n\nEl permiso de lectura se otorga para la mayoría de los atributos por defectos de modo que\nel permiso de lectura no se espera que use con frecuencia.\n\nAdvierta la distinción entre atributos y entradas. Los permisos son independientes, de\nmodo que ser capaz de añadir un usuario no siginifica que el usuario será editable.\n\nHay diversos objetivos permitidos:\n1. type: un tipo de objeto (usuario, grupo, etc).\n2. memberof: un miembro de un grupo o grupo de host\n3. filter: un filtro LDAP\n4. subtree: un filtro LDAP especificando parte del LDAP DIT. Esto es un superconjunto del\n objetivo \"type\".\n5. targetgroup: otorga acceso a modificar un grupo específico (como obteniendo\n derechos para manejar la pertenencia al grupo)\n\nEJEMPLOS:\n\n Añadir un permiso que otorga la creación de usuarios:\n ipa permission-add --type=user --permissions=add \"Add Users\"\n\n Añadir un permiso que otorga la capacidad de manejar la pertenencia al grupo:\n ipa permission-add --attrs=member --permissions=write --type=group \"Manage Group Members\"\n" ], "id_hash": 2467052758254385956, "content_hash": 2467052758254385956, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4208, "has_suggestion": false, "has_comment": false, "has_failing_check": true, "num_words": 405, "source_unit": "https://translate.fedoraproject.org/api/units/2727910/?format=api", "priority": 100, "id": 4705649, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=a23cbb69a1e67b24", "url": "https://translate.fedoraproject.org/api/units/4705649/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.654597Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Deprecated; use extratargetfilter" ], "previous_source": "Deprecated; use %s", "target": [ "Obsoleto; use %s" ], "id_hash": -1974303706311977127, "content_hash": -1974303706311977127, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4209, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 3, "source_unit": "https://translate.fedoraproject.org/api/units/2729399/?format=api", "priority": 100, "id": 4705651, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=6499dd3d4a899759", "url": "https://translate.fedoraproject.org/api/units/4705651/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.702575Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Deprecated; use ipapermlocation" ], "previous_source": "Deprecated; use %s", "target": [ "Obsoleto; use %s" ], "id_hash": 2569929497068907006, "content_hash": 2569929497068907006, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4210, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 3, "source_unit": "https://translate.fedoraproject.org/api/units/2729401/?format=api", "priority": 100, "id": 4705653, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=a3aa3942f29729fe", "url": "https://translate.fedoraproject.org/api/units/4705653/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.728414Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Deprecated; use ipapermright" ], "previous_source": "Deprecated; use %s", "target": [ "Obsoleto; use %s" ], "id_hash": 8669549929853091248, "content_hash": 8669549929853091248, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4211, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 3, "source_unit": "https://translate.fedoraproject.org/api/units/2729403/?format=api", "priority": 100, "id": 4705654, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=f8506dba5b67fdb0", "url": "https://translate.fedoraproject.org/api/units/4705654/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.750929Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "privileges to add" ], "previous_source": "privileges", "target": [ "privilegios" ], "id_hash": 1041841909049038701, "content_hash": 1041841909049038701, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4214, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 3, "source_unit": "https://translate.fedoraproject.org/api/units/2732737/?format=api", "priority": 100, "id": 4705656, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=8e755db244fb976d", "url": "https://translate.fedoraproject.org/api/units/4705656/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.800106Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "privileges to remove" ], "previous_source": "Add privileges to a role.", "target": [ "Añadir privilegios a un rol." ], "id_hash": 6721156633113786961, "content_hash": 6721156633113786961, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4216, "has_suggestion": false, "has_comment": false, "has_failing_check": true, "num_words": 3, "source_unit": "https://translate.fedoraproject.org/api/units/2732739/?format=api", "priority": 100, "id": 4705658, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=dd465858fc81fa51", "url": "https://translate.fedoraproject.org/api/units/4705658/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.846974Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "member role" ], "previous_source": "member group", "target": [ "miembro de grupo" ], "id_hash": -6235191901460979079, "content_hash": -6235191901460979079, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4219, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 2, "source_unit": "https://translate.fedoraproject.org/api/units/2732621/?format=api", "priority": 100, "id": 4705661, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=297826004706a279", "url": "https://translate.fedoraproject.org/api/units/4705661/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.914934Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "roles to add" ], "previous_source": "%s to add", "target": [ "%s a añadir" ], "id_hash": 8203231666232195513, "content_hash": 8203231666232195513, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4220, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 3, "source_unit": "https://translate.fedoraproject.org/api/units/2732765/?format=api", "priority": 100, "id": 4705662, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=f1d7bbbce40179b9", "url": "https://translate.fedoraproject.org/api/units/4705662/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.945195Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Rename the privilege object" ], "previous_source": "Rename the permission object", "target": [ "Renombrar el permiso del objeto" ], "id_hash": 8673318476757909501, "content_hash": 8673318476757909501, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4221, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 4, "source_unit": "https://translate.fedoraproject.org/api/units/2731310/?format=api", "priority": 100, "id": 4705664, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=f85dd1338efcbffd", "url": "https://translate.fedoraproject.org/api/units/4705664/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:10.976622Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "roles to remove" ], "previous_source": "%s to remove", "target": [ "%s a eliminar" ], "id_hash": 2036916024504454672, "content_hash": 2036916024504454672, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4222, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 3, "source_unit": "https://translate.fedoraproject.org/api/units/2726400/?format=api", "priority": 100, "id": 4705666, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=9c4494550de38e10", "url": "https://translate.fedoraproject.org/api/units/4705666/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.001835Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Results should contain primary key attribute only (\"cn\")" ], "previous_source": "Results should contain primary key attribute only (\"name\")", "target": [ "Los resultados deberían contener solo la clave del atributo primario (\"name\")" ], "id_hash": -2723494070523177472, "content_hash": -2723494070523177472, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4223, "has_suggestion": true, "has_comment": false, "has_failing_check": false, "num_words": 8, "source_unit": "https://translate.fedoraproject.org/api/units/2725219/?format=api", "priority": 100, "id": 4705667, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=5a34349292955600", "url": "https://translate.fedoraproject.org/api/units/4705667/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.028989Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Results should contain primary key attribute only (\"group\")" ], "previous_source": "Results should contain primary key attribute only (\"%s\")", "target": [ "Los resultados deberían contener sólo atributo de clave primaria (“%s”)" ], "id_hash": -3042129085055733501, "content_hash": -3042129085055733501, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4224, "has_suggestion": true, "has_comment": false, "has_failing_check": false, "num_words": 8, "source_unit": "https://translate.fedoraproject.org/api/units/2725223/?format=api", "priority": 100, "id": 4705669, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=55c82fb70c5e7103", "url": "https://translate.fedoraproject.org/api/units/4705669/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.065484Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "\nRADIUS Proxy Servers\n\nManage RADIUS Proxy Servers.\n\nIPA supports the use of an external RADIUS proxy server for krb5 OTP\nauthentications. This permits a great deal of flexibility when\nintegrating with third-party authentication services.\n\nEXAMPLES:\n\n Add a new server:\n ipa radiusproxy-add MyRADIUS --server=radius.example.com:1812\n\n Find all servers whose entries include the string \"example.com\":\n ipa radiusproxy-find example.com\n\n Examine the configuration:\n ipa radiusproxy-show MyRADIUS\n\n Change the secret:\n ipa radiusproxy-mod MyRADIUS --secret\n\n Delete a configuration:\n ipa radiusproxy-del MyRADIUS\n" ], "previous_source": "", "target": [ "" ], "id_hash": -8678263612514546238, "content_hash": -8678263612514546238, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 0, "fuzzy": false, "translated": false, "approved": false, "position": 4225, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 74, "source_unit": "https://translate.fedoraproject.org/api/units/2722400/?format=api", "priority": 100, "id": 4705670, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=07909d394cdf4dc2", "url": "https://translate.fedoraproject.org/api/units/4705670/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.094361Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Rename the RADIUS proxy server object" ], "previous_source": "Delete a RADIUS proxy server.", "target": [ "Borrar un servidor proxy RADIUS." ], "id_hash": 4234588596663743474, "content_hash": 4234588596663743474, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4226, "has_suggestion": false, "has_comment": false, "has_failing_check": true, "num_words": 6, "source_unit": "https://translate.fedoraproject.org/api/units/2731304/?format=api", "priority": 100, "id": 4705672, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=bac447e4920ff3f2", "url": "https://translate.fedoraproject.org/api/units/4705672/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.119940Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "\nRealm domains\n\nManage the list of domains associated with IPA realm.\n\nEXAMPLES:\n\n Display the current list of realm domains:\n ipa realmdomains-show\n\n Replace the list of realm domains:\n ipa realmdomains-mod --domain=example.com\n ipa realmdomains-mod --domain={example1.com,example2.com,example3.com}\n\n Add a domain to the list of realm domains:\n ipa realmdomains-mod --add-domain=newdomain.com\n\n Delete a domain from the list of realm domains:\n ipa realmdomains-mod --del-domain=olddomain.com\n" ], "previous_source": "\nRealm domains\n\nManage the list of domains associated with IPA realm.\n\nThis list is useful for Domain Controllers from other realms which have\nestablished trust with this IPA realm. They need the information to know\nwhich request should be forwarded to KDC of this IPA realm.\n\nAutomatic management: a domain is automatically added to the realm domains\nlist when a new DNS Zone managed by IPA is created. Same applies for deletion.\n\nExternally managed DNS: domains which are not managed in IPA server DNS\nneed to be manually added to the list using ipa realmdomains-mod command.\n\nEXAMPLES:\n\n Display the current list of realm domains:\n ipa realmdomains-show\n\n Replace the list of realm domains:\n ipa realmdomains-mod --domain=example.com\n ipa realmdomains-mod --domain={example1.com,example2.com,example3.com}\n\n Add a domain to the list of realm domains:\n ipa realmdomains-mod --add-domain=newdomain.com\n\n Delete a domain from the list of realm domains:\n ipa realmdomains-mod --del-domain=olddomain.com\n", "target": [ "\nDominios de reino\n\nGestiona la lista de dominios asociados con el reino IPA.\n\nEsta lista es útil para los Controladores de Dominio de otros reinos que tienen\nestablecida confianza con este reino IPA. Necesitan la información para saber que \npeticiones deberían ser reenviadas a KDC de este reino IPA.\n\nGestión automática: se añade un dominio automáticamente a la lista de dominios\ncuando se crea una nueva Zona DNS gestionada por IPA. Lo mismo se aplica para el borrado.\n\nDNS extermanete gestionado: los dominios que no son gestionados en el servidor\nIPA DNA necesitan ser añadidos manualmente a la lista usando el comando ipa realmdomains-mod command.\n\nEJEMPLOS:\n\n Muestra la lista actual de dominios reino:\n ipa realmdomains-show\n\n Reemplaza la lista de dominios reino:\n ipa realmdomains-mod --domain=example.com\n ipa realmdomains-mod --domain={example1.com,example2.com,example3.com}\n\n Añade un dominio a la lista de dominios reino:\n ipa realmdomains-mod --add-domain=newdomain.com\n\n Borra un dominio de la lista de dominios reino:\n ipa realmdomains-mod --del-domain=olddomain.com\n" ], "id_hash": 8805162111605521468, "content_hash": 8805162111605521468, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4227, "has_suggestion": false, "has_comment": false, "has_failing_check": true, "num_words": 57, "source_unit": "https://translate.fedoraproject.org/api/units/2722404/?format=api", "priority": 100, "id": 4705674, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=fa323849ebf9bc3c", "url": "https://translate.fedoraproject.org/api/units/4705674/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.170922Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Modify realm domains." ], "previous_source": "Realm domains", "target": [ "Dominios reino" ], "id_hash": 4744492721852152342, "content_hash": 4744492721852152342, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4228, "has_suggestion": false, "has_comment": false, "has_failing_check": true, "num_words": 3, "source_unit": "https://translate.fedoraproject.org/api/units/2724587/?format=api", "priority": 100, "id": 4705676, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=c1d7d2fe3d6c7a16", "url": "https://translate.fedoraproject.org/api/units/4705676/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.222965Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "member service" ], "previous_source": "Member services", "target": [ "Servicios de miembros" ], "id_hash": -370551722212575169, "content_hash": -370551722212575169, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4229, "has_suggestion": true, "has_comment": false, "has_failing_check": false, "num_words": 2, "source_unit": "https://translate.fedoraproject.org/api/units/2732623/?format=api", "priority": 100, "id": 4705678, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=7adb892c029c383f", "url": "https://translate.fedoraproject.org/api/units/4705678/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.269496Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "services to add" ], "previous_source": "services", "target": [ "servicios" ], "id_hash": -7826880883251921679, "content_hash": -7826880883251921679, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4230, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 3, "source_unit": "https://translate.fedoraproject.org/api/units/2732799/?format=api", "priority": 100, "id": 4705679, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=1361554e26793cf1", "url": "https://translate.fedoraproject.org/api/units/4705679/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.298565Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Rename the role object" ], "previous_source": "Rename the permission object", "target": [ "Renombrar el permiso del objeto" ], "id_hash": -6338799541650579000, "content_hash": -6338799541650579000, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4231, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 4, "source_unit": "https://translate.fedoraproject.org/api/units/2731312/?format=api", "priority": 100, "id": 4705680, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=28080f66b98221c8", "url": "https://translate.fedoraproject.org/api/units/4705680/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.324729Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "services to remove" ], "previous_source": "%s to remove", "target": [ "%s a eliminar" ], "id_hash": 3794561182296138246, "content_hash": 3794561182296138246, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4232, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 3, "source_unit": "https://translate.fedoraproject.org/api/units/2732801/?format=api", "priority": 100, "id": 4705682, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=b4a8fd4a753f6206", "url": "https://translate.fedoraproject.org/api/units/4705682/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.356968Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "\nServices\n\nA IPA service represents a service that runs on a host. The IPA service\nrecord can store a Kerberos principal, an SSL certificate, or both.\n\nAn IPA service can be managed directly from a machine, provided that\nmachine has been given the correct permission. This is true even for\nmachines other than the one the service is associated with. For example,\nrequesting an SSL certificate using the host service principal credentials\nof the host. To manage a service using host credentials you need to\nkinit as the host:\n\n # kinit -kt /etc/krb5.keytab host/ipa.example.com@EXAMPLE.COM\n\nAdding an IPA service allows the associated service to request an SSL\ncertificate or keytab, but this is performed as a separate step; they\nare not produced as a result of adding the service.\n\nOnly the public aspect of a certificate is stored in a service record;\nthe private key is not stored.\n\nEXAMPLES:\n\n Add a new IPA service:\n ipa service-add HTTP/web.example.com\n\n Allow a host to manage an IPA service certificate:\n ipa service-add-host --hosts=web.example.com HTTP/web.example.com\n ipa role-add-member --hosts=web.example.com certadmin\n\n Override a default list of supported PAC types for the service:\n ipa service-mod HTTP/web.example.com --pac-type=MS-PAC\n\n A typical use case where overriding the PAC type is needed is NFS.\n Currently the related code in the Linux kernel can only handle Kerberos\n tickets up to a maximal size. Since the PAC data can become quite large it\n is recommended to set --pac-type=NONE for NFS services.\n\n Delete an IPA service:\n ipa service-del HTTP/web.example.com\n\n Find all IPA services associated with a host:\n ipa service-find web.example.com\n\n Find all HTTP services:\n ipa service-find HTTP\n\n Disable the service Kerberos key and SSL certificate:\n ipa service-disable HTTP/web.example.com\n\n Request a certificate for an IPA service:\n ipa cert-request --principal=HTTP/web.example.com example.csr\n\n Allow user to create a keytab:\n ipa service-allow-create-keytab HTTP/web.example.com --users=tuser1\n\n Generate and retrieve a keytab for an IPA service:\n ipa-getkeytab -s ipa.example.com -p HTTP/web.example.com -k /etc/httpd/httpd.keytab\n" ], "previous_source": "\nServices\n\nA IPA service represents a service that runs on a host. The IPA service\nrecord can store a Kerberos principal, an SSL certificate, or both.\n\nAn IPA service can be managed directly from a machine, provided that\nmachine has been given the correct permission. This is true even for\nmachines other than the one the service is associated with. For example,\nrequesting an SSL certificate using the host service principal credentials\nof the host. To manage a service using host credentials you need to\nkinit as the host:\n\n # kinit -kt /etc/krb5.keytab host/ipa.example.com@EXAMPLE.COM\n\nAdding an IPA service allows the associated service to request an SSL\ncertificate or keytab, but this is performed as a separate step; they\nare not produced as a result of adding the service.\n\nOnly the public aspect of a certificate is stored in a service record;\nthe private key is not stored.\n\nEXAMPLES:\n\n Add a new IPA service:\n ipa service-add HTTP/web.example.com\n\n Allow a host to manage an IPA service certificate:\n ipa service-add-host --hosts=web.example.com HTTP/web.example.com\n ipa role-add-member --hosts=web.example.com certadmin\n\n Override a default list of supported PAC types for the service:\n ipa service-mod HTTP/web.example.com --pac-type=MS-PAC\n\n A typical use case where overriding the PAC type is needed is NFS.\n Currently the related code in the Linux kernel can only handle Kerberos\n tickets up to a maximal size. Since the PAC data can become quite large it\n is recommended to set --pac-type=NONE for NFS services.\n\n Delete an IPA service:\n ipa service-del HTTP/web.example.com\n\n Find all IPA services associated with a host:\n ipa service-find web.example.com\n\n Find all HTTP services:\n ipa service-find HTTP\n\n Disable the service Kerberos key and SSL certificate:\n ipa service-disable HTTP/web.example.com\n\n Request a certificate for an IPA service:\n ipa cert-request --principal=HTTP/web.example.com example.csr\n", "target": [ "\nServicios\n\nUn servicio IPA representa un servicio que corre en un host. El registro del servicio \nIPA puede almacenar un principal Kerberos, un certificado SSL o ambos.\n\nUn servicio IPA puede ser manejado directamente desde la maquina, siempre que\nla maquina haya recibido el permiso correcto. Esto es cierto aún en maquinas\ndistintas a las que el servicio está asociado. Por ejemplo, solicitar un certificado\nSSL utilizando las credenciales principales del servicio de host del anfitrión. Para\nadministrar un servicio utilizando las credenciales de host usted debe kinit como\nhost:\n\n # kinit -kt /etc/krb5.keytab host/ipa.example.com@EXAMPLE.COM\nAgregar un servicio IPA permite que el servicio asociado solicite un certificado SSL\no tabla de claves, pero esto se realiza como un paso separado; no se produce\ncomo resultado de agregar el servicio.\n\nSolo se almacena en el registro del servicio el aspecto público del certificado; la\nclave privada no se almacena.\n\nEJEMPLOS:\n\n Añadir un nuevo servicio IPA:\n ipa service-add HTTP/web.example.com\n\n Permitir a un host gestionar un certificado de servicio IPA:\n ipa service-add-host --hosts=web.example.com HTTP/web.example.com\n ipa role-add-member --hosts=web.example.com certadmin\n\n Anular la lista predeterminada de tipos de PAC soportados para el servicio:\n ipa service-mod HTTP/web.example.com --pac-type=MS-PAC\n\nUn caso de uso típico donde es necesario anular el tipo PAC es Nfs. Actualmente\nel código relacionado en el kernel Linux puede solo manejar tickets Kerberos hasta\nun tamaño máximo. Como los datos PAC pueden ser bastante largos se\nrecomienda establecer –pac-type=NONE para servicios NFS.\n\n Borrar un servicio IPA:\n ipa service-del HTTP/web.example.com\n\n Encontrar todos los servicios IPA asociados con un host:\n ipa service-find web.example.com\n\n Encontrar todos los servicios HTTP:\n ipa service-find HTTP\n\n Deshabilitar la clave de servicio Kerberos y el certificado SSL:\n ipa service-disable HTTP/web.example.com\n\n Pedir un certificado para un servicio IPA:\n ipa cert-request --principal=HTTP/web.example.com example.csr\n" ], "id_hash": -8256542117714809751, "content_hash": -8256542117714809751, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4233, "has_suggestion": true, "has_comment": false, "has_failing_check": true, "num_words": 309, "source_unit": "https://translate.fedoraproject.org/api/units/2727946/?format=api", "priority": 100, "id": 4705684, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=0d6adeb0608eac69", "url": "https://translate.fedoraproject.org/api/units/4705684/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.391371Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "\nSession Support for IPA\nJohn Dennis <jdennis@redhat.com>\n\nGoals\n=====\n\nProvide per-user session data caching which persists between\nrequests. Desired features are:\n\n* Integrates cleanly with minimum impact on existing infrastructure.\n\n* Provides maximum security balanced against real-world performance\n demands.\n\n* Sessions must be able to be revoked (flushed).\n\n* Should be flexible and easy to use for developers.\n\n* Should leverage existing technology and code to the maximum extent\n possible to avoid re-invention, excessive implementation time and to\n benefit from robustness in field proven components commonly shared\n in the open source community.\n\n* Must support multiple independent processes which share session\n data.\n\n* System must function correctly if session data is available or not.\n\n* Must be high performance.\n\n* Should not be tied to specific web servers or browsers. Should\n integrate with our chosen WSGI model.\n\nIssues\n======\n\nCookies\n-------\n\nMost session implementations are based on the use of cookies. Cookies\nhave some inherent problems.\n\n* User has the option to disable cookies.\n\n* User stored cookie data is not secure. Can be mitigated by setting\n flags indicating the cookie is only to be used with SSL secured HTTP\n connections to specific web resources and setting the cookie to\n expire at session termination. Most modern browsers enforce these.\n\nWhere to store session data?\n----------------------------\n\nSession data may be stored on either on the client or on the\nserver. Storing session data on the client addresses the problem of\nsession data availability when requests are serviced by independent web\nservers because the session data travels with the request. However\nthere are data size limitations. Storing session data on the client\nalso exposes sensitive data but this can be mitigated by encrypting\nthe session data such that only the server can decrypt it.\n\nThe more conventional approach is to bind session data to a unique\nname, the session ID. The session ID is transmitted to the client and\nthe session data is paired with the session ID on the server in a\nassociative data store. The session data is retrieved by the server\nusing the session ID when the receiving the request. This eliminates\nexposing sensitive session data on the client along with limitations\non data size. It however introduces the issue of session data\navailability when requests are serviced by more than one server\nprocess.\n\nMulti-process session data availability\n---------------------------------------\n\nApache (and other web servers) fork child processes to handle requests\nin parallel. Also web servers may be deployed in a farm where requests\nare load balanced in round robin fashion across different nodes. In\nboth cases session data cannot be stored in the memory of a server\nprocess because it is not available to other processes, either sibling\nchildren of a master server process or server processes on distinct\nnodes.\n\nTypically this is addressed by storing session data in a SQL\ndatabase. When a request is received by a server process containing a\nsession ID in it's cookie data the session ID is used to perform a SQL\nquery and the resulting data is then attached to the request as it\nproceeds through the request processing pipeline. This of course\nintroduces coherency issues.\n\nFor IPA the introduction of a SQL database dependency is undesired and\nshould be avoided.\n\nSession data may also be shared by independent processes by storing\nthe session data in files.\n\nAn alternative solution which has gained considerable popularity\nrecently is the use of a fast memory based caching server. Data is\nstored in a single process memory and may be queried and set via a\nlight weight protocol using standard socket mechanisms, memcached is\none example. A typical use is to optimize SQL queries by storing a SQL\nresult in shared memory cache avoiding the more expensive SQL\noperation. But the memory cache has distinct advantages in non-SQL\nsituations as well.\n\nPossible implementations for use by IPA\n=======================================\n\nApache Sessions\n---------------\n\nApache has 2.3 has implemented session support via these modules:\n\n mod_session\n Overarching session support based on cookies.\n\n See: http://httpd.apache.org/docs/2.3/mod/mod_session.html\n\n mod_session_cookie\n Stores session data in the client.\n\n See: http://httpd.apache.org/docs/2.3/mod/mod_session_cookie.html\n\n mod_session_crypto\n Encrypts session data for security. Encryption key is shared\n configuration parameter visible to all Apache processes and is\n stored in a configuration file.\n\n See: http://httpd.apache.org/docs/2.3/mod/mod_session_crypto.html\n\n mod_session_dbd\n Stores session data in a SQL database permitting multiple\n processes to access and share the same session data.\n\n See: http://httpd.apache.org/docs/2.3/mod/mod_session_dbd.html\n\nIssues with Apache sessions\n~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nAlthough Apache has implemented generic session support and Apache is\nour web server of preference it nonetheless introduces issues for IPA.\n\n * Session support is only available in httpd >= 2.3 which at the\n time of this writing is currently only available as a Beta release\n from upstream. We currently only ship httpd 2.2, the same is true\n for other distributions.\n\n * We could package and ship the sessions modules as a temporary\n package in httpd 2.2 environments. But this has the following\n consequences:\n\n - The code has to be backported. the module API has changed\n slightly between httpd 2.2 and 2.3. The backporting is not\n terribly difficult and a proof of concept has been\n implemented.\n\n - We would then be on the hook to package and maintain a special\n case Apache package. This is maintenance burden as well as a\n distribution packaging burden. Both of which would be best\n avoided if possible.\n\n * The design of the Apache session modules is such that they can\n only be manipulated by other Apache modules. The ability of\n consumers of the session data to control the session data is\n simplistic, constrained and static during the period the request\n is processed. Request handlers which are not native Apache modules\n (e.g. IPA via WSGI) can only examine the session data\n via request headers and reset it in response headers.\n\n * Shared session data is available exclusively via SQL.\n\nHowever using the 2.3 Apache session modules would give us robust\nsession support implemented in C based on standardized Apache\ninterfaces which are widely used.\n\nPython Web Frameworks\n---------------------\n\nVirtually every Python web framework supports cookie based sessions,\ne.g. Django, Twisted, Zope, Turbogears etc. Early on in IPA we decided\nto avoid the use of these frameworks. Trying to pull in just one part\nof these frameworks just to get session support would be problematic\nbecause the code does not function outside it's framework.\n\nIPA implemented sessions\n------------------------\n\nOriginally it was believed the path of least effort was to utilize\nexisting session support, most likely what would be provided by\nApache. However there are enough basic modular components available in\nnative Python and other standard packages it should be possible to\nprovide session support meeting the aforementioned goals with a modest\nimplementation effort. Because we're leveraging existing components\nthe implementation difficulties are subsumed by other components which\nhave already been field proven and have community support. This is a\nsmart strategy.\n\nProposed Solution\n=================\n\nOur interface to the web server is via WSGI which invokes a callback\nper request passing us an environmental context for the request. For\nthis discussion we'll name the WSGI callback \"application()\", a\nconventional name in WSGI parlance.\n\nShared session data will be handled by memcached. We will create one\ninstance of memcached on each server node dedicated to IPA\nexclusively. Communication with memcached will be via a UNIX socket\nlocated in the file system under /var/run/ipa_memcached. It will be\nprotected by file permissions and optionally SELinux policy.\n\nIn application() we examine the request cookies and if there is an IPA\nsession cookie with a session ID we retrieve the session data from our\nmemcached instance.\n\nThe session data will be a Python dict. IPA components will read or\nwrite their session information by using a pre-agreed upon name\n(e.g. key) in the dict. This is a very flexible system and consistent\nwith how we pass data in most parts of IPA.\n\nIf the session data is not available an empty session data dict will\nbe created.\n\nHow does this session data travel with the request in the IPA\npipeline? In IPA we use the HTTP request/response to implement RPC. In\napplication() we convert the request into a procedure call passing it\narguments derived from the HTTP request. The passed parameters are\nspecific to the RPC method being invoked. The context the RPC call is\nexecuting in is not passed as an RPC parameter.\n\nHow would the contextual information such as session data be bound to\nthe request and hence the RPC call?\n\nIn IPA when a RPC invocation is being prepared from a request we\nrecognize this will only ever be processed serially by one Python\nthread. A thread local dict called \"context\" is allocated for each\nthread. The context dict is cleared in between requests (e.g. RPC method\ninvocations). The per-thread context dict is populated during the\nlifetime of the request and is used as a global data structure unique to\nthe request that various IPA component can read from and write to with\nthe assurance the data is unique to the current request and/or method\ncall.\n\nThe session data dict will be written into the context dict under the\nsession key before the RPC method begins execution. Thus session data\ncan be read and written by any IPA component by accessing\n``context.session``.\n\nWhen the RPC method finishes execution the session data bound to the\nrequest/method is retrieved from the context and written back to the\nmemcached instance. The session ID is set in the response sent back to\nthe client in the ``Set-Cookie`` header along with the flags\ncontrolling it's usage.\n\nIssues and details\n------------------\n\nIPA code cannot depend on session data being present, however it\nshould always update session data with the hope it will be available\nin the future. Session data may not be available because:\n\n * This is the first request from the user and no session data has\n been created yet.\n\n * The user may have cookies disabled.\n\n * The session data may have been flushed. memcached operates with\n a fixed memory allocation and will flush entries on a LRU basis,\n like with any cache there is no guarantee of persistence.\n\n Also we may have have deliberately expired or deleted session\n data, see below.\n\nCookie manipulation is done via the standard Python Cookie module.\n\nSession cookies will be set to only persist as long as the browser has\nthe session open. They will be tagged so the browser only returns\nthe session ID on SSL secured HTTP requests. They will not be visible\nto Javascript in the browser.\n\nSession ID's will be created by using 48 bits of random data and\nconverted to 12 hexadecimal digits. Newly generated session ID's will\nbe checked for prior existence to handle the unlikely case the random\nnumber repeats.\n\nmemcached will have significantly higher performance than a SQL or file\nbased storage solution. Communication is effectively though a pipe\n(UNIX socket) using a very simple protocol and the data is held\nentirely in process memory. memcached also scales easily, it is easy\nto add more memcached processes and distribute the load across them.\nAt this point in time we don't anticipate the need for this.\n\nA very nice feature of the Python memcached module is that when a data\nitem is written to the cache it is done with standard Python pickling\n(pickling is a standard Python mechanism to marshal and unmarshal\nPython objects). We adopt the convention the object written to cache\nwill be a dict to meet our internal data handling conventions. The\npickling code will recursively handle nested objects in the dict. Thus\nwe gain a lot of flexibility using standard Python data structures to\nstore and retrieve our session data without having to author and debug\ncode to marshal and unmarshal the data if some other storage mechanism\nhad been used. This is a significant implementation win. Of course\nsome common sense limitations need to observed when deciding on what\nis written to the session cache keeping in mind the data is shared\nbetween processes and it should not be excessively large (a\nconfigurable option)\n\nWe can set an expiration on memcached entries. We may elect to do that\nto force session data to be refreshed periodically. For example we may\nwish the client to present fresh credentials on a periodic basis even\nif the cached credentials are otherwise within their validity period.\n\nWe can explicitly delete session data if for some reason we believe it\nis stale, invalid or compromised.\n\nmemcached also gives us certain facilities to prevent race conditions\nbetween different processes utilizing the cache. For example you can\ncheck of the entry has been modified since you last read it or use CAS\n(Check And Set) semantics. What has to be protected in terms of cache\ncoherency will likely have to be determined as the session support is\nutilized and different data items are added to the cache. This is very\nmuch data and context specific. Fortunately memcached operations are\natomic.\n\nControlling the memcached process\n---------------------------------\n\nWe need a mechanism to start the memcached process and secure it so\nthat only IPA components can access it.\n\nAlthough memcached ships with both an initscript and systemd unit\nfiles those are for generic instances. We want a memcached instance\ndedicated exclusively to IPA usage. To accomplish this we would install\na systemd unit file or an SysV initscript to control the IPA specific\nmemcached service. ipactl would be extended to know about this\nadditional service. systemd's cgroup facility would give us additional\nmechanisms to integrate the IPA memcached service within a larger IPA\nprocess group.\n\nProtecting the memcached data would be done via file permissions (and\noptionally SELinux policy) on the UNIX domain socket. Although recent\nimplementations of memcached support authentication via SASL this\nintroduces a performance and complexity burden not warranted when\ncached is dedicated to our exclusive use and access controlled by OS\nmechanisms.\n\nConventionally daemons are protected by assigning a system uid and/or\ngid to the daemon. A daemon launched by root will drop it's privileges\nby assuming the effective uid:gid assigned to it. File system access\nis controlled by the OS via the effective identity and SELinux policy\ncan be crafted based on the identity. Thus the memcached UNIX socket\nwould be protected by having it owned by a specific system user and/or\nmembership in a restricted system group (discounting for the moment\nSELinux).\n\nUnfortunately we currently do not have an IPA system uid whose\nidentity our processes operate under nor do we have an IPA system\ngroup. IPA does manage a collection of related processes (daemons) and\nhistorically each has been assigned their own uid. When these\nunrelated processes communicate they mutually authenticate via other\nmechanisms. We do not have much of a history of using shared file\nsystem objects across identities. When file objects are created they\nare typically assigned the identity of daemon needing to access the\nobject and are not accessed by other daemons, or they carry root\nidentity.\n\nWhen our WSGI application runs in Apache it is run as a WSGI\ndaemon. This means when Apache starts up it forks off WSGI processes\nfor us and we are independent of other Apache processes. When WSGI is\nrun in this mode there is the ability to set the uid:gid of the WSGI\nprocess hosting us, however we currently do not take advantage of this\noption. WSGI can be run in other modes as well, only in daemon mode\ncan the uid:gid be independently set from the rest of Apache. All\nprocesses started by Apache can be set to a common uid:gid specified\nin the global Apache configuration, by default it's\napache:apache. Thus when our IPA code executes it is running as\napache:apache.\n\nTo protect our memcached UNIX socket we can do one of two things:\n\n1. Assign it's uid:gid as apache:apache. This would limit access to\n our cache only to processes running under httpd. It's somewhat\n restricted but far from ideal. Any code running in the web server\n could potentially access our cache. It's difficult to control what the\n web server runs and admins may not understand the consequences of\n configuring httpd to serve other things besides IPA.\n\n2. Create an IPA specific uid:gid, for example ipa:ipa. We then configure\n our WSGI application to run as the ipa:ipa user and group. We also\n configure our memcached instance to run as the ipa:ipa user and\n group. In this configuration we are now fully protected, only our WSGI\n code can read & write to our memcached UNIX socket.\n\nHowever there may be unforeseen issues by converting our code to run as\nsomething other than apache:apache. This would require some\ninvestigation and testing.\n\nIPA is dependent on other system daemons, specifically Directory\nServer (ds) and Certificate Server (cs). Currently we configure ds to\nrun under the dirsrv:dirsrv user and group, an identity of our\ncreation. We allow cs to default to it's pkiuser:pkiuser user and\ngroup. Should these other cooperating daemons also run under the\ncommon ipa:ipa user and group identities? At first blush there would\nseem to be an advantage to coalescing all process identities under a\ncommon IPA user and group identity. However these other processes do\nnot depend on user and group permissions when working with external\nagents, processes, etc. Rather they are designed to be stand-alone\nnetwork services which authenticate their clients via other\nmechanisms. They do depend on user and group permission to manage\ntheir own file system objects. If somehow the ipa user and/or group\nwere compromised or malicious code somehow executed under the ipa\nidentity there would be an advantage in having the cooperating\nprocesses cordoned off under their own identities providing one extra\nlayer of protection. (Note, these cooperating daemons may not even be\nco-located on the same node in which case the issue is moot)\n\nThe UNIX socket behavior (ldapi) with Directory Server is as follows:\n\n * The socket ownership is: root:root\n\n * The socket permissions are: 0666\n\n * When connecting via ldapi you must authenticate as you would\n normally with a TCP socket, except ...\n\n * If autobind is enabled and the uid:gid is available via\n SO_PEERCRED and the uid:gid can be found in the set of users known\n to the Directory Server then that connection will be bound as that\n user.\n\n * Otherwise an anonymous bind will occur.\n\nmemcached UNIX socket behavior is as follows:\n\n * memcached can be invoked with a user argument, no group may be\n specified. The effective uid is the uid of the user argument and\n the effective gid is the primary group of the user, let's call\n this euid:egid\n\n * The socket ownership is: euid:egid\n\n * The socket permissions are 0700 by default, but this can be\n modified by the -a mask command line arg which sets the umask\n (defaults to 0700).\n\nOverview of authentication in IPA\n=================================\n\nThis describes how we currently authenticate and how we plan to\nimprove authentication performance. First some definitions.\n\nThere are 4 major players:\n\n 1. client\n 2. mod_auth_kerb (in Apache process)\n 3. wsgi handler (in IPA wsgi python process)\n 4. ds (directory server)\n\nThere are several resources:\n\n 1. /ipa/ui (unprotected, web UI static resources)\n 2. /ipa/xml (protected, xmlrpc RPC used by command line clients)\n 3. /ipa/json (protected, json RPC used by javascript in web UI)\n 4. ds (protected, wsgi acts as proxy, our LDAP server)\n\nCurrent Model\n-------------\n\nThis describes how things work in our current system for the web UI.\n\n 1. Client requests /ipa/ui, this is unprotected, is static and\n contains no sensitive information. Apache replies with html and\n javascript. The javascript requests /ipa/json.\n\n 2. Client sends post to /ipa/json.\n\n 3. mod_auth_kerb is configured to protect /ipa/json, replies 401\n authenticate negotiate.\n\n 4. Client resends with credentials\n\n 5. mod_auth_kerb validates credentials\n\n a. if invalid replies 403 access denied (stops here)\n\n b. if valid creates temporary ccache, adds KRB5CCNAME to request\n headers\n\n 6. Request passed to wsgi handler\n\n a. validates request, KRB5CCNAME must be present, referrer, etc.\n\n b. ccache saved and used to bind to ds\n\n c. routes to specified RPC handler.\n\n 7. wsgi handler replies to client\n\nProposed new session based optimization\n---------------------------------------\n\nThe round trip negotiate and credential validation in steps 3,4,5 is\nexpensive. This can be avoided if we can cache the client\ncredentials. With client sessions we can store the client credentials\nin the session bound to the client.\n\nA few notes about the session implementation.\n\n * based on session cookies, cookies must be enabled\n\n * session cookie is secure, only passed on secure connections, only\n passed to our URL resource, never visible to client javascript\n etc.\n\n * session cookie has a session id which is used by wsgi handler to\n retrieve client session data from shared multi-process cache.\n\nChanges to Apache's resource protection\n---------------------------------------\n\n * /ipa/json is no longer protected by mod_auth_kerb. This is\n necessary to avoid the negotiate expense in steps 3,4,5\n above. Instead the /ipa/json resource will be protected in our wsgi\n handler via the session cookie.\n\n * A new protected URI is introduced, /ipa/login. This resource\n does no serve any data, it is used exclusively for authentication.\n\nThe new sequence is:\n\n 1. Client requests /ipa/ui, this is unprotected. Apache replies with\n html and javascript. The javascript requests /ipa/json.\n\n 2. Client sends post to /ipa/json, which is unprotected.\n\n 3. wsgi handler obtains session data from session cookie.\n\n a. if ccache is present in session data and is valid\n\n - request is further validated\n\n - ccache is established for bind to ds\n\n - request is routed to RPC handler\n\n - wsgi handler eventually replies to client\n\n b. if ccache is not present or not valid processing continues ...\n\n 4. wsgi handler replies with 401 Unauthorized\n\n 5. client sends request to /ipa/login to obtain session credentials\n\n 6. mod_auth_kerb replies 401 negotiate on /ipa/login\n\n 7. client sends credentials to /ipa/login\n\n 8. mod_auth_kerb validates credentials\n\n a. if valid\n\n - mod_auth_kerb permits access to /ipa/login. wsgi handler is\n invoked and does the following:\n\n * establishes session for client\n\n * retrieves the ccache from KRB5CCNAME and stores it\n\n a. if invalid\n\n - mod_auth_kerb sends 403 access denied (processing stops)\n\n 9. client now posts the same data again to /ipa/json including\n session cookie. Processing repeats starting at step 2 and since\n the session data now contains a valid ccache step 3a executes, a\n successful reply is sent to client.\n\nCommand line client using xmlrpc\n--------------------------------\n\nThe above describes the web UI utilizing the json RPC mechanism. The\nIPA command line tools utilize a xmlrpc RPC mechanism on the same\nHTTP server. Access to the xmlrpc is via the /ipa/xml URI. The json\nand xmlrpc API's are the same, they differ only on how their procedure\ncalls are marshalled and unmarshalled.\n\nUnder the new scheme /ipa/xml will continue to be Kerberos protected\nat all times. Apache's mod_auth_kerb will continue to require the\nclient provides valid Kerberos credentials.\n\nWhen the WSGI handler routes to /ipa/xml the Kerberos credentials will\nbe extracted from the KRB5CCNAME environment variable as provided by\nmod_auth_kerb. Everything else remains the same.\n" ], "previous_source": "", "target": [ "" ], "id_hash": 5266842103080256542, "content_hash": 5266842103080256542, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 0, "fuzzy": false, "translated": false, "approved": false, "position": 4239, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 3811, "source_unit": "https://translate.fedoraproject.org/api/units/2727951/?format=api", "priority": 100, "id": 4705687, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=c91794fce22b841e", "url": "https://translate.fedoraproject.org/api/units/4705687/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.496775Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "\nSudo Commands\n\nCommands used as building blocks for sudo\n\nEXAMPLES:\n\n Create a new command\n ipa sudocmd-add --desc='For reading log files' /usr/bin/less\n\n Remove a command\n ipa sudocmd-del /usr/bin/less\n" ], "previous_source": "\nSudo Commands\n\nCommands used as building blocks for sudo\n\nEXAMPLES:\n\n Create a new command\n ipa sudocmd-add --desc='For reading log files' /usr/bin/less\n\n Remove a command\n ipa sudocmd-del /usr/bin/less\n\n", "target": [ "\nComandos de Sudo\n\nComandos usados como partes integrantes de sudo\n\nEJEMPLOS:\n\n Crear un comando nuevo\n ipa sudocmd-add --desc='For reading log files' /usr/bin/less\n\n Eliminar un comando\n ipa sudocmd-del /usr/bin/less\n\n" ], "id_hash": -2108216860654702479, "content_hash": -2108216860654702479, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4240, "has_suggestion": true, "has_comment": false, "has_failing_check": true, "num_words": 27, "source_unit": "https://translate.fedoraproject.org/api/units/2722426/?format=api", "priority": 100, "id": 4705688, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=62be1bef5f2ff071", "url": "https://translate.fedoraproject.org/api/units/4705688/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.529003Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Results should contain primary key attribute only (\"command\")" ], "previous_source": "Results should contain primary key attribute only (\"name\")", "target": [ "Los resultados deberían contener solo la clave del atributo primario (\"name\")" ], "id_hash": 6714461155387009463, "content_hash": 6714461155387009463, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4241, "has_suggestion": true, "has_comment": false, "has_failing_check": false, "num_words": 8, "source_unit": "https://translate.fedoraproject.org/api/units/2725221/?format=api", "priority": 100, "id": 4705690, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=dd2e8ed8990069b7", "url": "https://translate.fedoraproject.org/api/units/4705690/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.609852Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "\nGroups of Sudo Commands\n\nManage groups of Sudo Commands.\n\nEXAMPLES:\n\n Add a new Sudo Command Group:\n ipa sudocmdgroup-add --desc='administrators commands' admincmds\n\n Remove a Sudo Command Group:\n ipa sudocmdgroup-del admincmds\n\n Manage Sudo Command Group membership, commands:\n ipa sudocmdgroup-add-member --sudocmds=/usr/bin/less --sudocmds=/usr/bin/vim admincmds\n\n Manage Sudo Command Group membership, commands:\n ipa group-remove-member --sudocmds=/usr/bin/less admincmds\n\n Show a Sudo Command Group:\n ipa group-show localadmins\n" ], "previous_source": "\nGroups of Sudo Commands\n\nManage groups of Sudo Commands.\n\nEXAMPLES:\n\n Add a new Sudo Command Group:\n ipa sudocmdgroup-add --desc='administrators commands' admincmds\n\n Remove a Sudo Command Group:\n ipa sudocmdgroup-del admincmds\n\n Manage Sudo Command Group membership, commands:\n ipa sudocmdgroup-add-member --sudocmds=/usr/bin/less,/usr/bin/vim admincmds\n\n Manage Sudo Command Group membership, commands:\n ipa group-remove-member --sudocmds=/usr/bin/less admincmds\n\n Show a Sudo Command Group:\n ipa group-show localadmins\n", "target": [ "\nGrupos de Comandos Sudo\n\nGestionar grupos de Comandos Sudo.\n\nEJEMPLOS:\n\n Añadir un nuevo Grupo de Comandos Sudo:\n ipa sudocmdgroup-add --desc='administrators commands' admincmds\n\n Borrar un Grupo de Comando Sudo:\n ipa sudocmdgroup-del admincmds\n\n Gestionar pertenencia a Grupo de Comando Sudo, comandos:\n ipa sudocmdgroup-add-member --sudocmds=/usr/bin/less,/usr/bin/vim admincmds\n\n Gestionar pertenencia a Grupo de Comando Sudo, comandos:\n ipa group-remove-member --sudocmds=/usr/bin/less admincmds\n\n Mostrat un Grupo de Comando Sudo:\n ipa group-show localadmins\n" ], "id_hash": 2306682720644878361, "content_hash": 2306682720644878361, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4242, "has_suggestion": true, "has_comment": false, "has_failing_check": false, "num_words": 58, "source_unit": "https://translate.fedoraproject.org/api/units/2722343/?format=api", "priority": 100, "id": 4705692, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=a002fbb68d91d019", "url": "https://translate.fedoraproject.org/api/units/4705692/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.633016Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "sudo commands to add" ], "previous_source": "sudo commands", "target": [ "comandos sudo" ], "id_hash": 4932130607412240256, "content_hash": 4932130607412240256, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4245, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 4, "source_unit": "https://translate.fedoraproject.org/api/units/2726456/?format=api", "priority": 100, "id": 4705694, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=c47272a7e8a35f80", "url": "https://translate.fedoraproject.org/api/units/4705694/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.674664Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "sudo commands to remove" ], "previous_source": "sudo command group", "target": [ "grupo de comando sudo" ], "id_hash": -7531900108295097098, "content_hash": -7531900108295097098, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4247, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 4, "source_unit": "https://translate.fedoraproject.org/api/units/2726458/?format=api", "priority": 100, "id": 4705695, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=177950c1d95834f6", "url": "https://translate.fedoraproject.org/api/units/4705695/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.703356Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "\nSudo Rules\n\nSudo (su \"do\") allows a system administrator to delegate authority to\ngive certain users (or groups of users) the ability to run some (or all)\ncommands as root or another user while providing an audit trail of the\ncommands and their arguments.\n\nFreeIPA provides a means to configure the various aspects of Sudo:\n Users: The user(s)/group(s) allowed to invoke Sudo.\n Hosts: The host(s)/hostgroup(s) which the user is allowed to to invoke Sudo.\n Allow Command: The specific command(s) permitted to be run via Sudo.\n Deny Command: The specific command(s) prohibited to be run via Sudo.\n RunAsUser: The user(s) or group(s) of users whose rights Sudo will be invoked with.\n RunAsGroup: The group(s) whose gid rights Sudo will be invoked with.\n Options: The various Sudoers Options that can modify Sudo's behavior.\n\nAn order can be added to a sudorule to control the order in which they\nare evaluated (if the client supports it). This order is an integer and\nmust be unique.\n\nFreeIPA provides a designated binddn to use with Sudo located at:\nuid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n\nTo enable the binddn run the following command to set the password:\nLDAPTLS_CACERT=/etc/ipa/ca.crt /usr/bin/ldappasswd -S -W -h ipa.example.com -ZZ -D \"cn=Directory Manager\" uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n\nEXAMPLES:\n\n Create a new rule:\n ipa sudorule-add readfiles\n\n Add sudo command object and add it as allowed command in the rule:\n ipa sudocmd-add /usr/bin/less\n ipa sudorule-add-allow-command readfiles --sudocmds /usr/bin/less\n\n Add a host to the rule:\n ipa sudorule-add-host readfiles --hosts server.example.com\n\n Add a user to the rule:\n ipa sudorule-add-user readfiles --users jsmith\n\n Add a special Sudo rule for default Sudo server configuration:\n ipa sudorule-add defaults\n\n Set a default Sudo option:\n ipa sudorule-add-option defaults --sudooption '!authenticate'\n" ], "previous_source": "\nSudo Rules\n\nSudo (su \"do\") allows a system administrator to delegate authority to\ngive certain users (or groups of users) the ability to run some (or all)\ncommands as root or another user while providing an audit trail of the\ncommands and their arguments.\n\nFreeIPA provides a means to configure the various aspects of Sudo:\n Users: The user(s)/group(s) allowed to invoke Sudo.\n Hosts: The host(s)/hostgroup(s) which the user is allowed to to invoke Sudo.\n Allow Command: The specific command(s) permitted to be run via Sudo.\n Deny Command: The specific command(s) prohibited to be run via Sudo.\n RunAsUser: The user(s) or group(s) of users whose rights Sudo will be invoked with.\n RunAsGroup: The group(s) whose gid rights Sudo will be invoked with.\n Options: The various Sudoers Options that can modify Sudo's behavior.\n\nAn order can be added to a sudorule to control the order in which they\nare evaluated (if the client supports it). This order is an integer and\nmust be unique.\n\nFreeIPA provides a designated binddn to use with Sudo located at:\nuid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n\nTo enable the binddn run the following command to set the password:\nLDAPTLS_CACERT=/etc/ipa/ca.crt /usr/bin/ldappasswd -S -W -h ipa.example.com -ZZ -D \"cn=Directory Manager\" uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n\nFor more information, see the FreeIPA Documentation to Sudo.\n", "target": [ "\nReglas Sudo\n\nSudo (su \"do\") permite a un administrador de sistema delegar autoridad a ciertos\nusuarios dados(o grupos de usuarios) para tener la posibilidad de ejecutar algunos (o\n todos) los comandos como root u otro usuario mientras suministra pistas de auditoria de\n los comandos y sus argumentos.\n\nFreeIPA proporciona un medio para configurar diversos aspectos de Sudo:\n Users: Los usuario(s)/grupos(s) que tienen permitido llamar a Sudo.\n Hosts: Loshost(s)/grupo(s) de host a los que el usuario permite llamar a Sudo.\n Allow Command: El comando(s) específico que tiene permitido ejecutarse por medio de Sudo.\n Deny Command: El comando(s) específico que tiene prohibido ejecutarse por medio de Sudo.\n RunAsUser: El usuario(s) o grupo(s) de usuarios con cuyos derechos será invocado Sudo.\n RunAsGroup: El grupo(s) con cuyos derechos gid será invocado Sudo.\n Options: Las diversas opciones Sudoers que pueden modificar el comportamiento de Sudo.\n\nSu puede aadir un orden a una regla sudo para controlar el orden en el que será evaluada\n(si el cliente lo soporta). Este orden es un entero y debe ser único.\n\nFreeIPA suministra un binddn designado para usar con Sudo situado en :\nuid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n\nPara habilitar el binddn ejecute el siguiente comando para fijar la contraseña:\nLDAPTLS_CACERT=/etc/ipa/ca.crt /usr/bin/ldappasswd -S -W -h ipa.example.com -ZZ -D \"cn=Directory Manager\" uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n\nPara más información, vea la Documentación FreeIPA para Sudo.\n" ], "id_hash": 5243186759813810045, "content_hash": 5243186759813810045, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4248, "has_suggestion": false, "has_comment": false, "has_failing_check": true, "num_words": 271, "source_unit": "https://translate.fedoraproject.org/api/units/2727970/?format=api", "priority": 100, "id": 4705697, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=c8c38a9415bbc77d", "url": "https://translate.fedoraproject.org/api/units/4705697/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.739946Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "sudo command groups to add" ], "previous_source": "sudo command groups", "target": [ "grupos de comando sudo" ], "id_hash": 361520951049126446, "content_hash": 361520951049126446, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4250, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 5, "source_unit": "https://translate.fedoraproject.org/api/units/2732817/?format=api", "priority": 100, "id": 4705699, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=85046163ba25022e", "url": "https://translate.fedoraproject.org/api/units/4705699/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.800176Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "sudo command groups to remove" ], "previous_source": "sudo command groups", "target": [ "grupos de comando sudo" ], "id_hash": -2423262727846421812, "content_hash": -2423262727846421812, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4252, "has_suggestion": false, "has_comment": false, "has_failing_check": false, "num_words": 5, "source_unit": "https://translate.fedoraproject.org/api/units/2732819/?format=api", "priority": 100, "id": 4705701, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=5e5ed76355451acc", "url": "https://translate.fedoraproject.org/api/units/4705701/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.846808Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Indirect Member of group" ], "previous_source": "Indirect Member groups", "target": [ "Grupos de miembros indirectos" ], "id_hash": 2236119472719673544, "content_hash": 2236119472719673544, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4254, "has_suggestion": true, "has_comment": false, "has_failing_check": false, "num_words": 4, "source_unit": "https://translate.fedoraproject.org/api/units/2730055/?format=api", "priority": 100, "id": 4705703, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=9f084ad01eca38c8", "url": "https://translate.fedoraproject.org/api/units/4705703/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.893807Z", "last_updated": "2023-06-16T11:46:33.795393Z" }, { "translation": "https://translate.fedoraproject.org/api/translations/freeipa/ipa-4-8/es/?format=api", "source": [ "Results should contain primary key attribute only (\"login\")" ], "previous_source": "Results should contain primary key attribute only (\"name\")", "target": [ "Los resultados deberían contener solo la clave del atributo primario (\"name\")" ], "id_hash": -3911853193970606650, "content_hash": -3911853193970606650, "location": "", "context": "", "note": "", "flags": "", "labels": [], "state": 10, "fuzzy": true, "translated": false, "approved": false, "position": 4255, "has_suggestion": true, "has_comment": false, "has_failing_check": false, "num_words": 8, "source_unit": "https://translate.fedoraproject.org/api/units/2731374/?format=api", "priority": 100, "id": 4705705, "web_url": "https://translate.fedoraproject.org/translate/freeipa/ipa-4-8/es/?checksum=49b64e3ef7e79dc6", "url": "https://translate.fedoraproject.org/api/units/4705705/?format=api", "explanation": "", "extra_flags": "", "pending": false, "timestamp": "2020-08-04T08:18:11.929020Z", "last_updated": "2023-06-16T11:46:33.795393Z" } ] }