Zen

Translation

English type: Table
|*Authconfig options* |*Authselect profile feature*
|--enablesmartcard |with-smartcard
|--enablefingerprint |with-fingerprint
|--enableecryptfs |with-ecryptfs
|--enablemkhomedir |with-mkhomedir
|--enablefaillock |with-faillock
|--enablepamaccess |with-pamaccess
|--enablewinbindkrb5 |with-krb5
|--enableshadow |_none_
|--passalgo |_none_
313/3730 · 373

Sign in to save the translation.

English Spanish Actions
DESCRIPTION
DESCRIPCIÓN
This manual page explains the main differences between authconfig, the previous tool to configure system authentication and identity sources, and authselect which replaces it. It also explains what actions need to be done in order to migrate from authconfig to authselect.
En esta página se explican las diferencias más importantes entre authconfig (la herramienta anterior de configuración de fuentes de identidad y autenticación) y authconfig, que reemplaza a la primera. También se explican las acciones a realizar para migrar de una a otra.
MAIN DIFFERENCES
DIFERENCIAS PRINCIPALES
Authselect takes a completely different approach to system configuration than the previous tool authconfig.
Authselect usa un enfoque completamente diferente al de authconfig.
Authconfig tries its best to keep users's manual changes to the files it generates. It generates not only PAM configuration files and nsswitch.conf (to setup authentication modules and identity sources) but it also generates simple configuration files for several services such as LDAP and Kerberos.
Authconfig hace todo lo posible para mantener los cambios que el usuario pueda haber realizado manualmente sobre los archivos que genera. Además de los archivos de configuración de PAM y nsswitch.conf (para los módulos de autenticación y las fuentes de identidad) también genera archivos simples para otros servicios, como LDAP y Kerberos.
Authselect does no such things. It does not generate any configuration files beside PAM and nsswitch.conf and it strictly prohibits any manual changes to generated configuration. It provides a set of files called profiles. Each profile describes how the resulting configuration should look like and it can be slightly modified by enabling or disabling certain optional features. If a need arises for a different profile than what authselect ships, the administrator has an option to create a whole new profile and use it with authselect. See authselect-profiles(5) to learn more about profiles.
Authselect no hace nada de eso. Sólo genera los archivos de configuración de PAM y nsswitch.conf, y prohíbe cambios manuales. Proporciona un conjunto de archivos llamados perfiles. Cada perfil describe cómo debe quedar la configuración final y permite cierta variación mediante la activación de características opcionales. En caso necesario, el administrado puede crear un nuevo perfil y usarlo con authselect. Consulte authselect-profiles(5) para más información sobre los perfiles.
This may seem like a big disadvantage but the truth is the opposite. Authconfig is a very old tool and the applications providing required services have changed rapidly over the years. Typically, there is no longer a need to have multiple authentication modules in PAM and nsswitch.conf, because the vast majority of use-cases is covered by SSSD. Therefore there is no need to add or remove them specifically. There are also better tools to generate configuration for system daemons that can help you automate the process of joining to a remote domain such as `realm`. In addition, the shipped profiles give us comprehensive and deterministic system configuration that can be fully tested and is much less error prone. It is also much easier to distribute such configuration across many systems.
Puede parecer una desventaja, pero es justo lo contrario. Authconfig es una herramienta antigua y las aplicaciones que proporcionan los servicios han cambiado mucho con los años. Normalmente ya no hay necesidad de tener varios módulos de autenticación en PAM y nsswitch.conf, pues SSSD cubre por sí solo la mayoría de casos, así que no hace falta añadirlos o quitarlos individualmente. Y hay herramientas mejores para generar la configuración de servicios que permiten la unión a dominios remotos, como `realm`. Además los perfiles incluidos dan una configuración completa y determinista que se puede probar y es menos propensa a errores. También es más fácil distribuir esa configuración entre varios sistemas.
Probably the most controversial change is that authselect only ships profiles for sssd and winbind providers. Those two providers cover all modern use cases from providing local users and legacy LDAP domain to complex configurations with IPA or Active Directory servers. The profiles no longer contain support for nss-pam-ldapd and users are encouraged to switch to sssd.
Probablemente el cambio más controvertido sea que authselect sólo incluye perfiles para sssd y winbind. Con ellos se cubren todas las necesidades modernas, desde los usuarios locales y dominios LDAP antiguos hasta configuraciones complejas con servidores IPA o Active Directory. Los perfiles ya no son incluyen soporte para nss-pam-ldapd y se recomienda a los usuarios cambiar a sssd.
JOINING REMOTE DOMAINS
UNIÓN A DOMINIOS REMOTOS
You can use either `ipa-client-install` or `realm` to join an IPA domain and `realm` to join an Active Directory domain. These tools will make sure that the correct authselect profile is selected and all daemons and services are properly configured.
Puede usar `ipa-client-install`o `realm` para unirse a un dominio IPA, y `realm` para unirse a un dominio Active Directory. Estas herramientas se asegurarán de que esté seleccionado el perfil authselect correcto y de que todos los servicios y demonios estén bien configurados.
CONVERTING YOUR SCRIPTS
CONVERSIÓN DE GUIONES
If you use `ipa-client-install` or `realm` to join a domain, you can just remove any authconfig call in your scripts. If this is not an option, you need to replace each authconfig call with its equivalent authselect call to select a correct profile with desired features. Then you also need to write configuration file for required services.
Si usa `ipa-client-install` o `realm` para unirse a un dominio, puede eliminar las llamadas a authconfig de sus guiones. Si no cuenta con esta opción tendrá que cambiar cada llamada a authconfig por la equivalente a authselect para elegir un perfil con las características que necesite. Después tendrá que escribir además los archivos de configuración de los respectivos servicios.
Relation of authconfig options to authselect profiles
Transformación de opciones de authconfig en perfiles de authselect
|*Authconfig options* |*Authselect profile*
|--enableldap --enableldapauth |sssd
|--enablesssd --enablesssdauth |sssd
|--enablekrb5 |sssd
|--enablewinbind --enablewinbindauth |winbind
|--enablenis |nis
|*Opciones de authconfig* |*Perfil authselect*
|--enableldap --enableldapauth |sssd
|--enablesssd --enablesssdauth |sssd
|--enablekrb5 |sssd
|--enablewinbind --enablewinbindauth |winbind
|--enablenis |nis
Relation of authconfig options to authselect profile features
Transformación de opciones de authconfig en características de perfiles de authselect
|*Authconfig options* |*Authselect profile feature*
|--enablesmartcard |with-smartcard
|--enablefingerprint |with-fingerprint
|--enableecryptfs |with-ecryptfs
|--enablemkhomedir |with-mkhomedir
|--enablefaillock |with-faillock
|--enablepamaccess |with-pamaccess
|--enablewinbindkrb5 |with-krb5
|--enableshadow |_none_
|--passalgo |_none_
|*Authconfig options* |*Authselect profile feature*
|--enablesmartcard |with-smartcard
|--enablefingerprint |with-fingerprint
|--enableecryptfs |with-ecryptfs
|--enablemkhomedir |with-mkhomedir
|--enablefaillock |with-faillock
|--enablepamaccess |with-pamaccess
|--enablewinbindkrb5 |with-krb5
Authconfig options `--enableshadow` and `--passalgo=sha512` were often used to make sure that passwords are stored in `/etc/shadow` using `sha512` algorithm. *The authselect profiles now use the yescrypt hashing method* and it cannot be changed through an option (only by creating a custom profile). You can just omit these options.
 
Examples
Ejemplos
authconfig --enableldap --enableldapauth --enablefaillock --updateall
authselect select sssd with-faillock
authconfig --enableldap --enableldapauth --enablefaillock --updateall
authselect select sssd with-faillock
authconfig --enablesssd --enablesssdauth --enablesmartcard --smartcardmodule=sssd --updateall
authselect select sssd with-smartcard
authconfig --enablesssd --enablesssdauth --enablesmartcard --smartcardmodule=sssd --updateall
authselect select sssd with-smartcard
authconfig --enableecryptfs --enablepamaccess --updateall
authselect select sssd with-ecryptfs with-pamaccess
authconfig --enableecryptfs --enablepamaccess --updateall
authselect select sssd with-ecryptfs with-pamaccess
authconfig --enablewinbind --enablewinbindauth --winbindjoin=Administrator --updateall
realm join -U Administrator --client-software=winbind WINBINDDOMAIN
authconfig --enablewinbind --enablewinbindauth --winbindjoin=Administrador --updateall
realm join -U Administrador --client-software=winbind DOMINIOWINBIND
CONFIGURATION FILES
ARCHIVOS DE CONFIGURACIÓN
This section contains snippets for minimal configuration of various services.
Esta sección contiene fragmentos para una mínima configuración de varios servicios.
LDAP
LDAP
Even if LDAP is not directly used through `pam_ldap` and `nss_ldap`, it is still useful to configure ldap.conf to configure openldap-libs and indirectly, e.g. LDAP tools such as `ldapsearch`.
Incluso si no se usa LDAP directamente mediante `pam_ldap` y `nss_ldap`, sigue siendo útil configurar ldap.conf para openldap-libs e indirectamente otras herramientas como `ldapsearch`.
{sysconfdir}/openldap/ldap.conf
{sysconfdir}/openldap/ldap.conf
# Set the default base dn
BASE dc=example,dc=com
# El dn base predeterminado
BASE dc=example,dc=com
# Set the default LDAP server
URI ldap://ldap.example.com ldap://ldap-master.example.com:666
# El servidor LDAP predeterminado
URI ldap://ldap.example.com ldap://ldap-master.example.com:666
KERBEROS
KERBEROS
If you use Kerberos, the default Kerberos realm should be configured in order for krb5-libs and therefore tools such as `kinit` to work out of the box.
Si usa Kerberos, debe configurar el entorno predeterminado para que funcionen krb5-libs y por tanto herramientas como `kinit`.
User avatar anonymous

Suggestion added

|*Authconfig options* |*Authselect profile feature*
|--enablesmartcard |with-smartcard
|--enablefingerprint |with-fingerprint
|--enableecryptfs |with-ecryptfs
|--enablemkhomedir |with-mkhomedir
|--enablefaillock |with-faillock
|--enablepamaccess |with-pamaccess
|--enablewinbindkrb5 |with-krb5

Suggested change:

|*Authconfig options* |*Authselect profile feature*
|--enablesmartcard |with-smartcard
|--enablefingerprint |with-fingerprint
|--enableecryptfs |with-ecryptfs
|--enablemkhomedir |with-mkhomedir
|--enablefaillock |with-faillock
|--enablepamaccess |with-pamaccess
|--enablewinbindkrb5 |with-krb5

Failing checks:

Mismatching line breaks 2 years ago

Loading…

User avatar None

Suggestion added
|*Authconfig options* |*Authselect profile feature*
|--enablesmartcard |with-smartcard
|--enablefingerprint |with-fingerprint
|--enableecryptfs |with-ecryptfs
|--enablemkhomedir |with-mkhomedir
|--enablefaillock |with-faillock
|--enablepamaccess |with-pamaccess
|--enablewinbindkrb5 |with-krb5
|--enableshadow |_none_
|--passalgo |_none_
|*Authconfig options* |*Authselect profile feature*
|--enablesmartcard |with-smartcard
|--enablefingerprint |with-fingerprint
|--enableecryptfs |with-ecryptfs
|--enablemkhomedir |with-mkhomedir
|--enablefaillock |with-faillock
|--enablepamaccess |with-pamaccess
|--enablewinbindkrb5 |with-krb5
2 years ago
User avatar None

String updated in the repository
|*Authconfig options* |*Authselect profile feature*
|--enablesmartcard |with-smartcard
|--enablefingerprint |with-fingerprint
|--enableecryptfs |with-ecryptfs
|--enablemkhomedir |with-mkhomedir
|--enablefaillock |with-faillock
|--enablepamaccess |with-pamaccess
|--enablewinbindkrb5 |with-krb5
|--enableshadow |_none_
|--passalgo |_none_
|*Authconfig options* |*Authselect profile feature*
|--enablesmartcard |with-smartcard
|--enablefingerprint |with-fingerprint
|--enableecryptfs |with-ecryptfs
|--enablemkhomedir |with-mkhomedir
|--enablefaillock |with-faillock
|--enablepamaccess |with-pamaccess
|--enablewinbindkrb5 |with-krb5
2 years ago
User avatar None

String updated in the repository
|*Authconfig options* |*Authselect profile feature*
|--enablesmartcard |with-smartcard
|--enablefingerprint |with-fingerprint
|--enableecryptfs |with-ecryptfs
|--enablemkhomedir |with-mkhomedir
|--enablefaillock |with-faillock
|--enablepamaccess |with-pamaccess
|--enablewinbindkrb5 |with-krb5
|--enableshadow |_none_
|--passalgo |_none_
|*Authconfig options* |*Authselect profile feature*
|--enablesmartcard |with-smartcard
|--enablefingerprint |with-fingerprint
|--enableecryptfs |with-ecryptfs
|--enablemkhomedir |with-mkhomedir
|--enablefaillock |with-faillock
|--enablepamaccess |with-pamaccess
|--enablewinbindkrb5 |with-krb5
2 years ago
User avatar None

Source string changed
|*Authconfig options* |*Authselect profile feature*
|--enablesmartcard |with-smartcard
|--enablefingerprint |with-fingerprint
|--enableecryptfs |with-ecryptfs
|--enablemkhomedir |with-mkhomedir
|--enablefaillock |with-faillock
|--enablepamaccess |with-pamaccess
|--enablewinbindkrb5 |with-krb5
|--enableshadow |_none_
|--passalgo |_none_
2 years ago
Browse all string changes

Things to check

Suggestions

There is 1 suggestion for this string.

View

Mismatching line breaks

Number of new lines in translation does not match source

Reset

Glossary

English Spanish
No related strings found in the glossary.

10257091 String information

Source string description
type: Table
Flags
c-format, no-wrap
Source string location
src/man/authselect-migration.7.adoc:90
String age
2 years ago
Last updated
a year ago
Source string age
2 years ago
Translation file
src/man/po/authselect-migration.7.adoc.es.po, string 19