??? 123123123123 .....................................................................................................................................??? 123123123123 .....................................................................................................................................0,;;;;;;< <.<?< V<c<~<<<<<<<"='2=lZ==R>>@?5?/@3@K@&`@ @@7@@A2)A\AZyAFA1BMB$^B,B%BaB>8C3wC*CC!C D ,DMDjDBD)D)D*EIE#\E3E%E3E%F 4FUFmFFFF#F%FG:G+LGxGG#GGGH,HKHdH#~HHHHHI!(IJIeI2II2I%IJJ(CKlKKK&KwK!^LLM!M.@M!oM%MMM0MJN]N&}N%NNPN$2O(WOOOO5O,P45P.jP2PAP,QE;Q3QQ(Q#Q4RTR+qRR R RR"S5+S aS6lS$S*S,S T>T'XT,T-T%T'U>)U hU,U&UUU! V+VJFV"V)V!V-W(.WWWpW!WWW WW W#WX0X GXRX)aXXXXRXU"YAxYVYAZ)SZ<}ZBZGZFE[.[F[8\;;\Zw\]\E0]:v]>];]-,^7Z^^^^"^_ _%:_`_ t__F__4_4 `U`V1a;a;a!b0"b SbtbbTb'c!)cKc!jcc2c4cd--d3[d ddddd d e6eOege|ee eeef/fOf%jffffff*g:/g%jg*g$g5g0h+Gh#shhhBh>i4Di9yivi*j#Jj:njj.j'jk#k>kSk mk zkIk&kfk4`lFl;l=m-Vmm-m,m5m%n!5nWn&sn)nn=n)o'1o Yogooo-oo op,p@p7[ppp(p!pq&1qXqoq qq%qqqr'rrr0 s+>s(jsAs2st=tVtAot?t6t(u5:u=pu>uKuQ9vMvWvM1www wMwxx0x+Ix(ux xxxx x2y*Myxyy-yy'y0z*Fzqz7zz'z{%{=C{5{1{{-|".|Q|p|| |*|/|$#}H}c}u}}}H}7~M~l~(}~~~"~~ 3Pi(-) * FTk/$ց77+c т%E^$ũ7&87_.&ք9$Ns$:˅^ce_Ɇ$).NT}!҇#̈# )373k(+ȉ!)$I#n9I̊2KZwʋ!/:jˌ()@uj2A<UPL=0Jn<=E4;z=N9C^}\ܑ59^o(Β2<AP~KϓaX/a1Õߕ.6!ޖ"=#La3"A-GCuB'8$)]-/@&pm; A!b>g##!˜5$"Z2}! ҝ>8Xg!*Aў! 5Vs! "џ)Gcq73+@_2%31H0z/2ۢ'R658&#C'W(H̤*D@E˥8"i9z8D826kA;=@@~AK>M3TDZ-v?C5(^By'* .582n99ۭ/HObh+$$+$Jo ϯ$4MdxŰڰ"6!N7p82-E`xŲ!ղ" '6IZuӵ%,]RME62.i͸!޸./^z'Dй9.O~'!ۺT:L*$׻* ?Ys?#ȼ'(=M$i4Dý'"0S iv''! +->l*Ͽ7Po!+%B\0u''oux*8Kaizzv0"..CKr!T0$-(>$g!0:$B?/%3<On ' - !;!],"%7+]:!(-A"WzJ"$;&`" /? O Yc@a9[^8(-QV965$O-t-6jSrJ=,O'|$,)<[uD0/*`XK== -?!mU2Ji"!$6 *W $0J`v$ :[ z+*')!Qs'!! )1<4n9*r{#+'%AWj} 6#W'g3*5'$L*\-)!$=\-c%  .Nh ('!=_w07)"C;f-2604g.7::MDJFP_F $82k'$ ;X5q"!-,+Z355N00$$%Ji /Po>2' #2Vg$v8#6(#4L(+ De8:$8Ol};,?U.q!. 3'2Z6m$1jLso+!$?$"G  ?O'_'!!%C ^<<)8Tq! /E`x# g.$00C=a/;) /5.e1/0.'LVG.Hc~0,@;3oF>H%2 #=351(g,)99<!v*#'}/R., [ w  . q J %a '    #  3/ c   1 +    !, 7N        9 T n   R ''7C_3.5)O&y15$9-<g9&+1'Bj z 7%50:k;6!rO+.,?$l)832DFw7<63(j?7 (!,J0w-9&,Sr$'00E\rv' "="Z} " 6Qh|! ,A3`;5!8Ri % Jjt fTqkEY+aMXf|i?e/!`2vV SFm`zhhg.&R=> Qq#KF)3#4qb)(i G67PX_c&o8;WRy[DN:L@Gt+\ ;hl%uU)|(~@a$C IsW(xB0k' ]>-7gt8=A/d04 A 2c4= 0[].oyV\ sIauAOW$?1~T!C^M?9 2J/:8;g#GVlm6w[Z%n^:QLyYE xPTjk9B~D%cEp>5<`X3n v H}{F,e*1U7zrzZr@ Z_dS-|Y<**-\SJ.B{6mp1K_ uH$pij5w&3HfxMP"Qbe^"RvOd I,L!,n}"rlONCosb{'5U']}N9<+DKw ;;2 Attribute: %1$s %s is not present in cache. - gecos: %s - group id: %d - home directory: %s - no env - - no mapped users found - - shell: %s - user id: %d - user name: %s %1$-25s %2$#.4x %1$-25s Unknown domain %1$-25s Unreachable service %1$s must be run as root %s: Unable to read value [%d]: %s , your cached password will expire at: A comma-separated list of groups, members of which should be excluded from recording, only when scope=all. A comma-separated list of groups, members of which should have session recording enabled. Matches group names as returned by NSS. I.e. after the possible space replacement, case changes, etc.A comma-separated list of users to be excluded from recording, only when scope=allA comma-separated list of users which should have session recording enabled. Matches user names as returned by NSS. I.e. after the possible space replacement, case changes, etc.A list of extra attributes to download along with the user entryA mapping from user names to Kerberos principal namesA specific order of the domains to be looked upAccess control providerAction not provided Active Directory backup server addressActive Directory client hostnameActive Directory domainActive Directory primary group attribute for ID-mappingActive Directory server addressActive servers: Additional timeout to wait for a card if requestedAddress of backup IPA serverAfter changing the OTP password, you need to log out and back in order to acquire a ticketAll spaces in group or user names will be replaced with this characterAllow certificate based/Smartcard authentication.Allow core dumpsAllow passkey device authentication.Allow to generate ssh-keys from certificatesAllowed services for using smartcardsAllows to retain local users as members of an LDAP group for servers that use the RFC2307 schema.Always query all the caches before querying the Data ProvidersAn error occurred, but no description can be found.An open file descriptor for the debug logsAnalyze logged dataArchive SSSD log files in tarballArchiving log files into %s... Attribute %1$s already indexed. Attribute %1$s not indexed. Attribute (-a) not provided Attribute indicating that server side password policies are activeAttribute listing authorized PAM servicesAttribute listing authorized server hostsAttribute listing authorized server rhostsAttribute to indexAttribute with the name of the viewAttribute with the reference to the original objectAuthenticate at %1$s and press ENTER.Authenticate with PIN %1$s at %2$s and press ENTER.Authenticated with cached credentialsAuthentication is denied until: Authentication providerAuthentication timeoutAutofs providerAutomatic full refresh periodAutomatic smart refresh periodAutomounter map entry key attributeAutomounter map entry value attributeAutomounter map name attributeBackup local dataBackup local data and remove cached contentBase DN for IP hosts lookupsBase DN for IP networks lookupsBase DN for automounter map lookupsBase DN for group lookupsBase DN for netgroup lookupsBase DN for service lookupsBase DN for sudo rules lookupsBase DN for user lookupsBecome a daemon (default)Cache credentials for offline loginCache entry creation dateCache entry expiration timeCache entry last update timeCached in InfoPipeCannot get stat of SSSD socket.Certificate does not match rule. Certificate matches rule. Certificate related tools:Change or print information about SSSD debug levelCheck PAC flagsCheck mapping and matching rule with a certificateComma separated list of allowed usersComma separated list of groups that are allowed to log in. This applies only to groups within this SSSD domain. Local groups are not evaluated.Comma separated list of groups that are explicitly denied access. This applies only to groups within this SSSD domain. Local groups are not evaluated.Comma separated list of prohibited usersCommand '%s' failed with [%d] Command to start serviceConfiguration files tools:Control enumeration of trusted domainsControls if SSSD should monitor the state of resolv.conf to identify when it needs to update its internal DNS resolver.Could not open available domains Could not open domain %1$s. If the domain is a subdomain (trusted domain), use fully qualified name instead of --domain/-d parameter. Couldn't invalidate %1$s Couldn't invalidate %1$s %2$s Create clean cache files and import local dataCreating backup of local data... Creating cache index for domain %1$s Current Password: DN for ppolicy queriesDNS service name for LDAP password change serverDefault logon right (or permit/deny) to use for unmapped PAM service namesDefault subdomain homedir valueDelete log files instead of truncatingDeleting cache index for domain %1$s Deleting log files... Directory on the filesystem where SSSD should store Kerberos replay cache files.Directory to store credential cachesDisable Active Directory range retrievalDisable netlink interfaceDisable the LDAP paging controlDiscovered %s servers: Display a warning N days before the password expires.Display users/groups in fully-qualified formDo not filter domain local groups from other domainsDomain of the information provider (mandatory)Domain to add to names without a domain component.Don't forget to also update the indexes on the remote providers. Don't include group members in group lookupsERROR: Tevent chain ID support missing, log analyzer is unsupported. Enable DNS sites - location based service discoveryEnable credential validationEnable debugging in the libfido2 libraryEnable enumerating all users/groupsEnable or disable core dumps for all SSSD processes.Enable or disable the domainEnable or disable the implicit files domainEnable/disable debug backtraceEnabled Active Directory domainsEnables FASTEnables enterprise principalsEnables principal canonicalizationEnables using of subdomains realms for authenticationEnter PIN:Entry cache background update timeout length (seconds)Entry cache timeout length (seconds)Enumeration cache timeout length (seconds)Error during certificate matching [%d][%s]. Error looking up public keys Error setting the locale Error while executing external command Error while executing external command '%s' Error while reading configuration directory. Error: Unable to get object [%d]: %s FAST options ('never', 'try', 'demand')Failed to add mapping and matching rules with error [%d][%s]. Failed to decode base64 string. Failed to generate mapping filter [%d][%s]. Failed to load configuration from %s. Failed to open %s Failed to run validatorsFailed to setup certmap context. File %1$s does not exist. File ownership and permissions check failed. Expected root:root and 0600. File that contains CA certificatesFile that contains the client certificateFile that contains the client keyFiles negative cache timeout length (seconds)Filter PAM responses sent to the pam_sssFilter for group lookupsFilter for user lookupsFirst Factor (Current Password): First Factor: Follow LDAP referralsFull NameGECOS attributeGID attributeGenerate access report for a domainGroup UUID attributeGroup member attributeGroup nameGroup passwordGroups that SSSD should explicitly ignoreHome directory attributeHost identity providerHost not specified Hostnames and/or fully qualified domain names of this machine to filter sudo rulesHow long (minutes) to deny login after offline_failed_login_attempts has been reachedHow long can cached credentials be used for cached authenticationHow long should SSSD talk to single DNS server before trying next server (miliseconds)How long should keep trying to resolve single DNS query (seconds)How long the PAC data is considered validHow long to allow cached logins between online logins (days)How long to keep cached entries after last successful login (days)How long to retain a connection to the LDAP server before disconnectingHow long to wait for replies from DNS when resolving servers (seconds)How long will be in-memory cache records validHow many days before password expiration a warning should be displayedHow many failed logins attempts are allowed when offlineHow many maximum entries to fetch during a wildcard requestHow many seconds to keep a host in the known_hosts file after its host keys were requestedHow many seconds to keep a host ssh key after refresh. IE how long to cache the host key for.How many seconds to keep identity information cached for PAM requestsHow many seconds will pam_sss wait for p11_child to finishHow many seconds will pam_sss wait for passkey_child to finishHow often should expired entries be refreshed in backgroundHow often should subdomains list be refreshedHow often to periodically update the client's DNS entryHow to dereference aliasesIP host entryUSN attributeIP host name attributeIP host number (address) attributeIP network entryUSN attributeIP network name attributeIP network number (address) attributeIPA client hostnameIPA domainIPA server addressIPv4 or IPv6 addresses or network of this machine to filter sudo rulesIdentity providerIdle time before automatic disconnection of a clientIdle time before automatic shutdown of the responderIf 2-Factor-Authentication (2FA) is used and credentials should be saved this value determines the minimal length the first authentication factor (long term password) must have to be saved as SHA512 hash into the cache.If a shell stored in central directory is allowed but not available, use this fallbackIf set to false, host argument given by PAM will be ignoredIf true, SSSD will switch back to lower-wins ordering logicIgnore unreadable LDAP referencesInclude microseconds in timestamps in debug logsInclude timestamps in debug logsIndex operation failed: %1$s Indexes for domain %1$s: Indicates what is the syntax of the config file. SSSD 0.6.0 and later use version 2.InfoPipe User lookup with [%s] failed. Information about cached content:Information about cached groupInformation about cached netgroupInformation about cached userInforms that the responder has been dbus-activatedInforms that the responder has been socket-activatedInitgroups expiration timeInsert your passkey device, then press ENTER.Invalid input, please provide either '%s' or '%s'. Invalid port Invalid result.Invalidate all SSH hostsInvalidate all autofs mapsInvalidate all cached entriesInvalidate all cached sudo rulesInvalidate all groupsInvalidate all netgroupsInvalidate all servicesInvalidate all usersInvalidate cached objectsInvalidate particular SSH hostInvalidate particular autofs mapInvalidate particular groupInvalidate particular netgroupInvalidate particular serviceInvalidate particular sudo ruleInvalidate particular userIssues identified by validators: %zu Kerberos backup server addressKerberos realmKerberos realm to useKerberos server addressKerberos service keytabLDAP filter to determine access privilegesLength of time between attempts to reconnect while offlineLength of time between cache cleanupsLength of time between enumeration updatesLength of time to attempt connectionLength of time to attempt synchronous LDAP operationsLength of time to wait for a enumeration requestLength of time to wait for a search requestLifetime of TGT for LDAP connectionLifetime of the TGTList available domainsList of PAM services that are allowed to authenticate with GSSAPI.List of UIDs or user names allowed to access the PAC responderList of domains accessible even for untrusted users.List of options that should be inherited into a subdomainList of pairs : that must be enforced for PAM access with GSSAPI authenticationList of possible ciphers suitesList of trusted uids or user's nameList of user attributes the InfoPipe is allowed to publishLocal data tools:Location of the keytab to validate credentialsLocation of the user's credential cacheLog files tools:Lower bound for ID-mappingManage cache indexesMapping filter: %s Mapping ruleMatching ruleMaximum age in days before the machine account password should be renewedMaximum nesting level SSSD will followMaximum number of rules that can be refreshed at once. If this is exceeded, full refresh is performed.Maximum period deviation between enumeration updatesMaximum period deviation when refreshing expired entries in backgroundMaximum period deviation when refreshing the subdomain listMaximum period deviation when updating the client's DNS entryMaximum time deviation between cache cleanupsMaximum user IDMessage printed when user account is expired.Message printed when user account is locked.Messages generated during configuration merging: %zu Minimum user IDMode used to change user passwordModification time attributeModification time attribute for groupsModification time attribute for netgroupsNameName of attribute that is used as object class for sudo rulesName of the default domain for ID-mappingNegative cache timeout length (seconds)Netgroup nameNetgroup triple attributeNetgroups members attributeNew Password: No cache object matched the specified search No servers discovered. None so far. Not enough memory Number of IDs for each slice when ID-mappingNumber of secondary slicesNumber of times to attempt connection to Data ProvidersObject class for IP hostsObject class for IP networksObject class for automounter map entriesObject class for automounter mapsObject class for sudo rulesObjectclass for group override objectsObjectclass for groupsObjectclass for netgroupsObjectclass for override objectsObjectclass for servicesObjectclass for user override objectsObjectclass for usersObjectclass for view containersOfflineOne of the following strings specifying the scope of session recording: none - No users are recorded. some - Users/groups specified by users and groups options are recorded. all - All users are recorded.OnlineOnline status: %s Only invalidate entries from a particular domainOperation mode for GPO-based access controlOption -g is incompatible with -D or -i Option -i|--interactive is not allowed together with -D|--daemon Option for tuning the machine account renewal taskOut of memory! Override GID value from the identity provider with this valueOverride existing backupOverride homedir value from the identity provider with this valueOverride shell value from the identity provider with this valueOverride the DNS server used to perform the DNS updatePAM Environment: PAM action [auth|acct|setc|chau|open|clos], default: PAM service names for which GPO-based access is always deniedPAM service names for which GPO-based access is always grantedPAM service names that map to the GPO (Deny)BatchLogonRight policy settingsPAM service names that map to the GPO (Deny)InteractiveLogonRight policy settingsPAM service names that map to the GPO (Deny)NetworkLogonRight policy settingsPAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight policy settingsPAM service names that map to the GPO (Deny)ServiceLogonRight policy settingsPAM service, default: PAM stack to usePIN lockedPKCS#11 URI to restrict the selection of devices for Smartcard authenticationPasskey related tools:Password change failed. Password change providerPassword expired. Change your password now.Password reset by root is not supported.Password: Passwords do not matchPath of group file sources.Path of passwd file sources.Path to CA certificate directoryPath to certificate database with PKCS#11 modules.Path to storage of trusted CA certificatesPerform cache upgradePerform passkey registrationPerform static analysis of SSSD configurationPermission denied. Please (re)insert (different) SmartcardPlease select at least one object to invalidate Policy to evaluate the password expirationPrimary GID attributePrint information about a user and check authenticationPrint information about domainPrint information about the certificatePrint the host ssh public keysPrint version number and exitPrintf-compatible format for displaying fully-qualified namesPrivileged socket has wrong ownership or permissions.Public socket has wrong ownership or permissions.Reenter new Password: Refresh the configuration database, then exitRegex to parse username and domainRemove existing SSSD log filesRemoving cache files... Renewable lifetime of the TGTRequested lifetime of the ticketRequested renewable lifetime of the ticketRequests canonicalization of the principal nameRequire TLS certificate verificationRequire TLS for ID lookupsResolver providerRestart SSSD after data importRestore local data from backupRestoring local data... Restrict or prefer a specific address family when performing DNS lookupsRun PAC responder automatically for AD and IPA providerRun interactive (not a daemon)SELinux providerSID of the default domain for ID-mappingSSH public key attributeSSSD Domains to startSSSD InfoPipe user lookup result: SSSD Services to startSSSD Status:SSSD backup of local data already exists, override?SSSD is already running SSSD is not run by root.SSSD is not running. SSSD monitors the state of resolv.conf to identify when it needs to update its internal DNS resolver. By default, we will attempt to use inotify for this, and will fall back to polling resolv.conf every five seconds if inotify cannot be used.SSSD must not be running. Stop SSSD now?SSSD needs to be restarted. Restart SSSD now?SSSD needs to be running. Start SSSD now?SSSD nss user lookup result: SSSD socket does not exist.SUDO providerScope of group lookupsScope of user lookupsSearch base for Desktop Profile related objectsSearch base for HBAC related objectsSearch base for SUBID rangesSearch base for object containing info about IPA domainSearch base for objects containing info about ID rangesSearch base for view containersSearch by SIDSearch by group IDSearch by user IDSecond Factor (optional): Second Factor: Selects the principal to use for FASTServer message: Server where the change password service is running if not on the KDCService name attributeService name for DNS service lookupsService port attributeService protocol attributeSession management providerSet libldap debug levelSet lower boundary for allowed IDs from the LDAP serverSet the verbosity of the debug loggingSet upper boundary for allowed IDs from the LDAP serverShell attributeShell to use if the provider does not list oneShould filtered users appear in groupsShow debug informationShow domain list including primary or trusted domain typeShow information about active serverShow list of discovered serversShow online statusShow users mapped to the certificateSimilar to --genconf, but only refreshes the given sectionSize (in megabytes) of the data table allocated inside fast in-memory cache for group requestsSize (in megabytes) of the data table allocated inside fast in-memory cache for initgroups requestsSize (in megabytes) of the data table allocated inside fast in-memory cache for passwd requestsSmart and full refresh random offsetSpecifies the server principal to use for FASTSpecifies time in seconds for which the list of subdomains will be considered valid.Specify a non-default config fileSpecify a non-default snippet dir (The default is to look in the same place where the main config file is located. For example if the config is set to "/my/path/sssd.conf", the snippet dir "/my/path/conf.d" is used)Specify base64 encoded certificate.Specify debug level you want to setSpecify domain name.Specify name.Specify the maximal SSF for LDAP sasl authorizationSpecify the minimal SSF for LDAP sasl authorizationSpecify the sasl authorization id to useSpecify the sasl authorization realm to useSpecify the sasl mechanism to useSpecify user name.Start SSSD if it is not runningStart SSSD when the cache is removedStop SSSD before removing the cacheStore password if offline for later online authenticationSubstitute empty homedir value from the identity provider with this valueSudo rule command attributeSudo rule host attributeSudo rule nameSudo rule notafter attributeSudo rule notbefore attributeSudo rule option attributeSudo rule order attributeSudo rule runas attributeSudo rule runasgroup attributeSudo rule runasuser attributeSudo rule user attributeSystem is offline, password change not possibleTarget a specific domainTarget the AUTOFS serviceTarget the IFP serviceTarget the NSS serviceTarget the PAC serviceTarget the PAM serviceTarget the SSH serviceTarget the SSSD serviceTarget the SUDO serviceTevent chain ID used for logging purposesThe LDAP attribute that contains DN of HBAC rule which can be used for matching instead of memberUser and memberHost.The LDAP attribute that contains FQDN of the host.The LDAP attribute that contains NIS domain name of the netgroup.The LDAP attribute that contains SELinux user string itself.The LDAP attribute that contains all hosts / hostgroups this rule match against.The LDAP attribute that contains all users / groups this rule match against.The LDAP attribute that contains host category such as 'all'.The LDAP attribute that contains the UUID/GUID of an LDAP netgroup object.The LDAP attribute that contains the host's SSH public keys.The LDAP attribute that contains the name of SELinux usermap.The LDAP attribute that contains the names of the netgroup's members.The LDAP attribute that contains unique ID of the user map.The LDAP attribute that contains user category such as 'all'.The LDAP attribute that contains whether or not is user map enabled for usage.The LDAP attribute that corresponds to the netgroup name.The LDAP attribute that lists FQDNs of hosts and host groups that are members of the netgroup.The LDAP attribute that lists hosts and host groups that are direct members of the netgroup.The LDAP attribute that lists netgroup's memberships.The LDAP attribute that lists system users and groups that are direct members of the netgroup.The LDAP group external member attributeThe SSSD domain to useThe Schema Type in use on the LDAP server, rfc2307The TTL to apply to the client's DNS entry after updating itThe amount of time between lookups of the GPO policy files against the AD serverThe amount of time between lookups of the HBAC rules against the IPA serverThe amount of time in minutes between lookups of Desktop Profiles rules against the IPA server when the last request did not find any ruleThe amount of time in seconds between lookups of the Desktop Profile rules against the IPA serverThe amount of time in seconds between lookups of the SELinux maps against the IPA serverThe authentication token of the default bind DNThe automounter location this IPA client is usingThe debug level to run withThe default base DNThe default bind DNThe domain part of service discovery DNS queryThe entry cache can be set to automatically update entries in the background if they are requested beyond a percentage of the entry_cache_timeout value for the domain.The group ID to run the server asThe group to create FAST ccache asThe interface whose IP should be used for dynamic DNS updatesThe list of shells that will be vetoed, and replaced with the fallback shellThe list of shells users are allowed to log in withThe name of the NSS library to useThe name of the NSS library to use for hosts and networks lookupsThe name of the automount master map in LDAP.The number of file descriptors that may be opened by this responderThe number of members that must be missing to trigger a full derefThe number of preforked proxy children.The number of records to retrieve in a single LDAP queryThe object class of a host entry in LDAP.The object class of a netgroup entry in LDAP.The option denotes that the SSSD is running on IPA server and should perform lookups of users and groups from trusted domains differently.The path to the proxy command must be absolute The port to use to connect to the hostThe provider which should handle fetching of subdomains. This value should be always the same as id_provider.The type of the authentication token of the default bind DNThe user ID to run the server asThe user to create FAST ccache asThe user to drop privileges toThe value of the password field the NSS provider should returnThe value of this option will be used in the expansion of the override_homedir option if the template contains the format string %H.There is no configuration. This domain has no active servers. Time between two checks for renewalTreat usernames as case sensitiveTruncating log files... Tune certificate verificationTune certificate verification for PAM authentication.Tune passkey verification behaviorTune sssd to honor or ignore netlink state changesType of the group and other flagsUID attributeURI of a backup LDAP server where password changes are allowedURI of an LDAP server where password changes are allowedUUID attributeUnable to archive log files Unable to connect to system bus! Unable to create backup directory [%d]: %sUnable to create backup of local data, can not remove the cache. Unable to export group overrides Unable to export user overrides Unable to get online status Unable to get server list Unable to import group overrides Unable to import user overrides Unable to parse command arguments Unable to parse name %s. Unable to read user input Unable to remove cache files Unable to remove log files Unable to truncate log files Unexpected argument(s) provided, options that invalidate a single object only accept a single provided argument. Unexpected error while looking for an error descriptionUnexpected format of the server credential message.Unknown action: %1$s Valid actions are "%2$s", "%3$s and "%4$s" Upper bound for ID-mappingUse ID-mapping of objectSID instead of pre-set IDsUse Kerberos auth for LDAP connectionUse LDAPS port for LDAP and Global Catalog requestsUse anonymous PKINIT to request FAST armor ticketUse anonymous PKINIT to request FAST credentialsUse autorid-compatible algorithm for ID-mappingUse custom version of krb5_get_init_creds_passwordUse only the upper case for realm namesUse the following matching rules to filter the certificates for ssh-key generationUse the given string as search base for host objects.Use the given string as search base for trusted domains.Used configuration snippet files: %zu User name lookup with [%s] failed. User not specified User principal attribute (for Kerberos)Username attributeUsers that SSSD should explicitly ignoreValidate the PACVarious tags stored by the realmd configuration service for this domain.Watchdog timeout before restarting serviceWhat kind of authentication should be used to perform the DNS updateWhat kind of messages are displayed to the user during authenticationWhen SSSD switches to offline mode the amount of time before it tries to go back online will increase based upon the time spent disconnected. This value is in seconds and calculated by the following: offline_timeout + random_offset.When shall the PAM responder force an initgroups requestWhere to drop krb5 config snippetsWhether the LDAP library should perform a reverse lookup to canonicalize the host name during a SASL bindWhether the domain is usable by the OS or by applicationsWhether the nsupdate utility should default to using TCPWhether the provider should explicitly update the PTR record as wellWhether to automatically create private groups for usersWhether to automatically update the client's DNS entryWhether to automatically update the client's DNS entry in FreeIPAWhether to create kdcinfo filesWhether to evaluate the time-based attributes in sudo rulesWhether to filter rules by hostname, IP addresses and networkWhether to hash host names and addresses in the known_hosts fileWhether to include rules that contains netgroup in host attributeWhether to include rules that contains regular expression in host attributeWhether to look up canonical group name from cache if possibleWhether to match authenticated UPN with target userWhether to update the ldap_user_shadow_last_change attribute after a password changeWhether to update the machine account password in the Samba databaseWhether to use Token-GroupsWhether to use the Global Catalog for lookupsWhich PAM services are permitted to contact application domainsWhich attributes shall be used to evaluate if an account is expiredWhich rules should be used to evaluate access controlYour password has expired.Your password has expired. You have %1$d grace login(s) remaining.Your password will expire in %1$d %2$s.a particular site to be used by the clientaccountExpires attribute of ADattributeattribute containing the X509 certificate of the userattribute containing the email address of the userattribute containing the passkey mapping data of the userattribute listing allowed authentication types for a userdlopen failed with [%s]. dlsym failed with [%s]. domainentryUSN attributeerrorkrbLastPwdChange attributekrbPasswordExpiration attributelastUSN attributeldap_backup_uri, The URI of the LDAP serverldap_uri, The URI of the LDAP serverloginAllowedTimeMap attribute of NDSloginDisabled attribute of NDSloginExpirationTime attribute of NDSmalloc failed. memberOf attributenonot connectednsAccountLock attributeobjectSID attributepam_acct_mgmt: %s pam_authenticate for user [%s]: %s pam_chauthtok: %s pam_close_session: %s pam_get_item failed: %s pam_open_session: %s pam_setcred: [%s] pam_start failed: %s set_debug_file_from_fd failed. shadowExpire attributeshadowFlag attributeshadowInactive attributeshadowLastChange attributeshadowMax attributeshadowMin attributeshadowWarning attributesss_getpwnam_r failed with [%d]. sss_ssh_knownhostsproxy: Could not resolve hostname %s sss_ssh_knownhostsproxy: connect to host %s port %d: %s sss_ssh_knownhostsproxy: unable to proxy data: %s talloc_asprintf failed. testing pam_acct_mgmt testing pam_authenticate testing pam_chauthtok testing pam_close_session testing pam_open_session testing pam_setcred unknown action user: %s action: %s service: %s userAccountControl attribute of ADyesProject-Id-Version: PACKAGE VERSION Report-Msgid-Bugs-To: sssd-devel@lists.fedorahosted.org PO-Revision-Date: 2023-07-24 17:20+0000 Last-Translator: Funda Wang Language-Team: Chinese (Simplified) Language: zh_CN MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Plural-Forms: nplurals=1; plural=0; X-Generator: Weblate 4.18.2 属性: %1$s %s 没有存在于缓存中。 - gecos: %s - 组 id: %d - 家目录 : %s -没有环境- - 未找到映射用户 - - shell: %s - 用户 id: %d - 用户名 : %s %1$-25s %2$#.4x %1$-25s 未知域类型 %1$-25s 无法访问的服务 %1$s 必须以 root 运行 %s: 无法读取值 [%d]: %s ，您缓存的密码将过期于： 用逗号分隔的组列表，其中的成员应不记录中排除，仅在 scope=all 时。 以逗号分隔的组列表，其成员应已启用会话记录。匹配NSS 返回的组名。在可能的空格替换、大小写改变等之后。要从记录中排除的用逗号分开的用户列表，仅当 scope=all 时以逗号分隔的用户列表，这些用户应该启用会话记录。匹配 NSS 返回的用户名。在可能的空格替换、大小写更改等之后。要与用户条目一起下载的其他属性的列表从用户名到 Kerberos 主体名称的映射要查询的域的特定顺序访问控制提供者未提供操作 没动目录备份服务器地址活动目录客户端主机名活动目录域用于 ID 映射的活动目录的主组属性没动目录服务器地址活动服务器： 等待卡的额外超时，如果请求IPA 备份服务器地址更改 OTP 密码后，您需要注销并重新登录以获得票证组或用户名中的所有空格都将替换为该字符允许基于证书/智能卡的身份验证。允许内核转储允许使用通行密钥设备认证。允许从证书中生成 ssh-keys允许服务使用智能卡允许保留本地用户作为使用 RFC2307 模式的服务器的 LDAP 组成员。在查询 Data Providers 之前，始终查询所有缓存发生错误，但找不到描述信息。调试日志的打开文件描述符分析日志记录的数据以 tarball 形式归档 SSSD 日志文件将日志文件归档到 %s ... 属性 %1$s 已索引。 属性 %1$s 未索引。 未提供属性(-a) 用来指示服务器端密码策略处于活动状态的属性列出授权的 PAM 服务的属性列出授权的服务器主机的属性列出授权的服务器 rhost 的属性属性到索引具有视图名称的属性带有到原始对象参考的属性在 %1$s 处进行身份验证，然后按 ENTER 。在 %2$s 处使用 PIN %1$s 进行身份验证，然后按 ENTER 。通过缓存的凭据进行身份验证身份验证被拒绝，直到： 身份验证提供者验证超时Autofs 提供者自动完整刷新周期自动智能刷新周期自动挂载器映射条目键的属性自动挂载器映射条目值的属性自动挂载器映射名称属性备份本地数据备份本地数据，并删除缓存的内容IP 主机查询的基础 DNIP 网络查询的基础 DN自动挂载程序映射查找的基本 DN组查找的基本 DNnetgroup 查找的基本 DN服务查找的基本 DNsudo 规则查找的基本DN用户查找的基本 DN成为守护进程（默认）为脱机登录缓存凭据缓存条目创建日期缓存条目过期的时间缓存条目最新更新的时间在 InfoPipe 中缓存无法获取 SSSD socket 的统计数据。证书与规则不匹配。 证书与规则匹配。 认证相关的工具：更改或打印有关 SSSD 调试级别的信息检查 PAC 标志使用证书检查映射并匹配规则以逗号分隔的允许的用户列表以逗号分隔的允许登录的组的列表。这只适用于此 SSSD 域内的组。本地组不被评估。以逗号分隔的明确拒绝访问的组的列表。这只适用于此 SSSD 域内的组。本地组不被评估。以逗号分隔的不允许的用户列表命令 '%s' 失败代码 [%d] 启动服务命令配置文件工具：信任域的控制枚举控制 SSSD 是否应监控 resolv.conf 的状态，以确定何时需要更新其内部 DNS 解析器。无法打开可用域 无法打开域 %1$s 。如果域是子域（受信任的域），请使用完全限定名而不是 --domain/-d 参数。 无法使 %1$s 无效 无法使 %1$s %2$s 无效 创建干净的缓存文件并导入本地数据正在创建本地数据备份... 为域 %1$s 创建缓存索引 当前密码： ppolicy 查询的 DNLDAP 密码更改服务器的 DNS 服务名称用于未映射的 PAM 服务名称的默认登录权（或允许/拒绝）默认子域 homedir 值删除日志文件而不是截断删除域 %1$s 的缓存索引 删除日志文件... SSSD 应该在其中存储 Kerberos 重放缓存文件的文件系统上的目录。存储凭证缓存的目录禁用 Active Directory 范围检索禁用 netlink 接口禁用 LDAP 分页控制发现的 %s 服务器： 在密码过期前 N 天显示一个警告。以完全限定的形式显示用户/组不要从其它域过滤域本地组信息提供者的域（强制）要添加到名称中的域，没有域组件。不要忘记还要更新对远程提供程序的索引。 在组查询中不包括的组成员ERROR：缺少 Tevent 链 ID 支持，不支持日志分析器。 启用 DNS 站点 - 基于位置的服务发现启用凭证验证在 libfido2 库中启用调试功能启用枚举所有用户/组为所有 SSSD 进程启用或禁用内核转储。启用或禁用域启用或禁用隐式文件域启用/禁用 debug backtrace启用活动目录域启用 FAST启用企业主体启用主体规范化允许使用子域域进行身份验证输入 PIN：条目缓存后台更新超时时间（秒）输入缓存超时时间（秒）枚举缓存超时时间（秒）证书匹配 [%d][%s] 过程中的错误。 查找公钥时出错 地区设置错误 执行外部命令时出错 执行外部命令 '%s' 时出错 读取配置目录时出错。 错误：无法获得对象 [%d]: %s FAST 选项（'never'、'try'、'demand'）添加映射和匹配规则失败，错误为 [%d][%s]。 解码 base64 字符串失败。 生成映射过滤器 [%d][%s]失败。 从 %s 加载配置失败。 打开失败： %s 运行验证器失败设置 certmap 上下文失败。 文件 %1$s 不存在。 文件所有权和权限检查失败。预期的是 root:root 和 0600。 包含 CA 证书的文件包含客户端 CA 证书的文件包含客户端密钥的文件文件负缓存超时时间（秒）过滤发送到 pam_sss 的 PAM 响应组查询的过滤器用户查找过滤第一因素（当前密码）： 第一因素： 遵循 LDAP 引用全称GECOS 属性GID 属性为域生成访问报告组 UUID 属性组成员属性组名称组密码SSSD 应该明确忽略的组家目录属性主机身份提供者未指定主机 本机的主机名和/或限定域名，用于过滤 sudo 规则当达到 offline_failed_login_attempts 之后多长时间要拒绝登录（以分钟为单位）可以使用缓存凭证用于缓存身份验证的时间在尝试下一个服务器之前，SSSD 应该与一个 DNS 服务器联系多久（毫秒）尝试解析单个 DNS 查询需要多长时间（秒）PAC 数据被视为有效的时间长度在线登录间隔多长时间内允许使用缓存的登录（以天为单位）上次成功登录后保留缓存条目的时间（天）断开连接前与 LDAP 服务器保持连接的时间解析服务器时等待 DNS 回复的时间（秒）内存缓存记录有效期的长度在密码过期前几天应显示警告信息离线时允许多少次失败的登录尝试在通配符请求期间要提取多少个最大条目当请求了它的主机密钥后，将主机保留在 known_hosts 文件中的时间（以秒为单位）刷新后主机 ssh 密钥要保留多少秒。IE 缓存主机密钥多长时间。为 PAM 请求保留多长时间的身份信息缓存（以秒为单位）pam_sss 等待 p11_child 完成的时间（以秒为单位）pam_sss 等待 passkey_child 完成的时间过期条目应在后台刷新的频率子域列表应该多久刷新一次定期更新客户端的 DNS 条目的频率如何取消引用别名IP 主机 entryUSN 属性IP 主机名属性IP 主机号（地址）属性IP 网络 entryUSN 属性IP 网络名称属性I P网号（地址）属性IPA 客户端主机名IPA 域IPA 服务器地址IPv4 或 IPv6 地址或本机器的网络，用于过滤 sudo 规则身份提供者客户端自动断开连接之前的空闲时间自动关闭响应者之前的空闲时间如果使用 2-Factor-Authentication (2FA)，应该保存凭证，这个值决定了第一个认证因素(（期密码）必须以SHA512 哈希值的形式保存到缓存中的最小长度。如果允许使用存储在中央目录中的 shell 但并不存在，使用这个后备如果设置为 false，PAM 提供的主机参数将被忽略如果为 true，SSSD 将切换回 lower-wins ordering 逻辑忽略不可读的 LDAP 引用在调试日志中的时间戳中包含微秒在调试日志中包含时间戳索引操作失败：%1$s 域 %1$s 的索引： 表示配置文件的语法是什么。SSSD 0.6.0 及以后的版本使用版本 2。使用 [%s] 进行 InfoPipe 用户查找失败。 有关缓存内容的信息：有关缓存组的信息有关缓存的 netgroup 的信息有关缓存用户的信息通知响应者已被 dbus 激活通知响应者已被套接字激活Initgroups 过期时间插入您的通行密钥设备，然后按回车键。无效输入，请提供 '%s' 或 '%s'。 无效端口 结果无效。使所有 SSH 主机无效使所有 autofs 映射无效使所有缓存的条目无效使所有缓存的 sudo 规则无效使所有组无效使所有 netgroup 无效使所有服务无效使所有用户无效无效的缓存对象使特定 SSH 主机无效使特定 autofs 映射无效使特定组无效使特定 netgroup 无效使特定服务无效使特定 sudo 规则无效使特定用户无效验证者发现了问题： %zu Kerberos 备份服务器地址Kerberos 域要使用的 kerberos 域Kerberos 服务器地址Kerberos服务密钥表用于决定访问权限 的 LDAP 过滤器离线时尝试重新连接的时间间隔两次缓存清除之间的时间长度枚举更新之间的时间长度尝试连接的时间长度尝试同步 LDAP 操作的时间长度等待枚举请求的时间长度等待搜索请求的时间长度TGT 的 LDAP 连接生命周期TGT 的寿命列出可用的域允许使用 GSSAPI 验证的 PAM 服务列表。允许访问 PAC 响应者的 UID 或用户名列表即使不受信任的用户也可以访问的域列表。应该被继承到子域中的选项列表: 对列表，它们必须强制使用 GSSAPI 身份验证进行 PAM 访问可能的加密套件列表受信任的 uid 或用户名列表允许 InfoPipe 发布的用户属性列表本地数据工具：用于验证凭据的密钥表的位置用户凭证缓存的位置日志文件工具：ID 映射的下限管理缓存索引映射过滤器： %s 映射规则匹配规则机器账户密码需要续订的最长期限（天）将遵循的最大嵌套级别 SSSD一次可以刷新的最大规则数。如果超出此范围，则执行完全刷新。枚举更新之间的最长周期偏差在后台刷新过期条目时的最大周期偏差刷新子域列表时的最大周期偏差更新客户端的 DNS 条目时的最大周期偏差缓存清理之间的最长时间偏差最大用户 ID当用户账户过期时显示的消息。当用户账户被锁住时显示的消息。配置合并期间生成的消息： %zu 最小用户 ID用来修改用户密码的模式修改时间属性组的修改时间属性netgroup 的修改时间属性名称用作 sudo 规则的对象类的属性名称用于 ID 映射的默认域的名称负缓存超时时间（秒）Netgroup 名Netgroup triple 属性Netgroups 成员属性新密码： 没有符合指定搜索条件的缓存对象 没有发现服务器。 到目前为止没有。 内存不足 ID 映射时每个片的 ID 数次要切片数试图连接到 Data Providers 的次数IP 主机的对象类IP 网络的对象类自动挂载器映射条目的对象类自动挂载器映射的对象类sudo 规则的对象类组覆盖对象的对象类组的对象类netgroup 的对象类覆盖对象的对象类服务的对象类用户覆盖对象的对象类用户的对象类查看容器的对象类离线使用以下字符串之一指定会话记录范围： none - 不记录用户。 some - 记录由用户和组选项指定的用户和组。 all - 记录所有用户。在线在线状态： %s 使来自特定域的项无效基于 GPO 的访问控制的操作模式选项 -g 与 -D 或 -i 不兼容 选项 -i|--interactive 不能和 -D|--daemon 一起使用 用于调整机器账户续订任务的选项无可用的内存！ 使用此值覆盖来自身份提供者的 GID 值覆盖现有的备份使用此值覆盖来自身份提供者的 homedir 值使用此值覆盖来自身份提供者的 shell 值覆盖用于执行 DNS 更新的 DNS 服务器PAM 环境： PAM 操作 [auth|acct|setc|chau|open|clos]，默认： 基于 GPO 的访问始终会被拒绝的 PAM 服务名称基于 GPO 的访问始终会被授予的 PAM 服务名称映射到 GPO (Deny)BatchLogonRight 策略设置的 PAM 服务名称映射到 GPO (Deny)InteractiveLogonRight 策略设置的 PAM 服务名称映射到 GPO (Deny)NetworkLogonRight 策略设置的 PAM 服务名称映射到 GPO (Deny)RemoteInteractiveLogonRight 策略设置的 PAM 服务名称映射到 GPO (Deny)ServiceLogonRight 策略设置的 PAM 服务名称PAM 服务，默认： 使用的 PAM 堆栈PIN 已锁定PKCS#11 URI，用于限制智能卡认证设备的选择与 Passkey 相关的工具：更改密码失败。 密码改变提供者密码已过期。立即更改密码。不支持通过 root 重置密码。密码： 密码不匹配group 文件源的路径。passwd 文件源的路径。CA 证书目录的路径带有 PKCS＃11 模块的证书数据库的路径。到可信 CA 证书存储的路径执行缓存升级执行通行密钥登记执行 SSSD 配置的静态分析权限被拒绝。 请（重新）插入（不同的）智能卡请选择至少一个对象以使其无效 评估密码有效期的策略主 GID 属性打印有关用户的信息，并检查身份验证打印有关域的信息打印有关证书的信息打印主机 ssh 公钥显示版本号并退出兼容 Printf 的格式用于显示完全限定名称特权套接字有错误的所有权或权限。公共套接字有错误的所有权或权限。重新输入新密码： 刷新配置数据库，然后退出正则表达式解析用户名和域删除现有 SSSD 日志文件删除缓存文件... TGT 的可更新寿命要求的票证寿命要求的可续约票证寿命要求规范化主体名称调整 TLS 证书验证需要 TLS 进行 ID 查找解析器提供者数据导入后重新启动 SSSD从备份中恢复本地数据恢复本地数据... 执行 DNS 查找时限制或首选使用特定的地址系列为 AD 和 IPA 提供商自动运行 PAC 响应器交互式运行（不是守护程序）SELinux 提供者用于 ID 映射的默认域的 SIDSSH 公钥属性SSSD 域启动SSSD InfoPipe 用户查找结果： SSSD 服务启动SSSD 状态：SSSD 本地数据备份已经存在，可以覆盖吗？SSSD 已运行 SSSD 没有由 root 运行。SSSD 未运行。 SSSD 监视 resolv.conf 的状态，以确定何时需要更新其内部的 DNS 解析器。默认情况下，我们会尝试使用 inotify 进行。如果不能使用 inotify，则会回到每五秒轮询一次 resolv.conf 的状态。SSSD 不能运行。现在停止 SSSD？需要重新运行 SSSD。现在重新运行 SSSD？需要运行 SSSD。现在启动 SSSD？SSSD nss 用户查找结果： SSSD socket 不存在。SUDO 提供者组查询的范围用户查找范围Desktop Profile 相关对象的搜索基础HBAC 相关对象的搜索基础搜索 SUBID 范围的基础搜索包含有关 IPA 域信息的对象的搜索基础搜索包含有关 ID 范围信息的对象的搜索基础查看容器的搜索基础使用 SID 搜索使用组 ID 搜索使用用户 ID 搜索第二因素（可选）： 第二因素： 选择用于 FAST 的主体服务器消息： 如果不在 KDC 上，运行更改密码服务的服务器服务名属性DNS 服务查找的服务名称服务端口属性服务协议属性会话管理提供者设置 libldap debug 级别设置 LDAP 服务器允许的 ID 的下边界设定调试日志的详细程度设置 LDAP 服务器允许的 ID 的上边界Shell 属性如果提供程序未列出，则使用这个 shell出现在组中的应将过滤的用户显示调试信息显示域列表，包括主要或受信任的域类型显示有关活动服务器的信息显示发现的服务器列表显示在线状态显示映射到证书的用户类似于 --genconf，但只刷新指定的部分为组请求在快速内存缓存（in-memory cache）中分配的数据表的大小（以 MB 为单位）为 initgroups 请求在快速内存缓存（in-memory cache）中分配的数据表的大小（以 MB 为单位）为 passwd 请求在快速内存缓存（in-memory cache）中分配的数据表的大小（以 MB 为单位）智能和完整刷新随机偏移指定用于 FAST 的服务器主体指定子域列表被视为有效的时间，以秒为单位。指定一个非默认的配置文件指定非默认 snippet dir（默认为在主配置文件所在的相同位置查找）。例如，如果配置被设置为 "/my/path/sssd.conf", snippet dir 为 "/my/path/conf.d" ）指定 base64 编码的证书。指定要设置的调试级别指定域名。指定名称。为 LDAP sasl 授权指定最大的 SSF为 LDAP sasl 授权指定最小的 SSF指定要使用的 sasl 授权 ID指定要使用的 sasl 授权域指定要使用的 sasl 机制指定用户名。如果未运行，启动 SSSD删除缓存后启动 SSSD在删除缓存之前停止 SSSD离线时存储密码，以便以后进行在线身份验证使用此值替换来自身份提供者的空的 homedir 值sudo 规则命令属性sudo 规则主机属性sudo 规则名sudo 规则 notafter 属性sudo 规则 notbefore 属性sudo 规则选项属性sudo 规则顺序属性sudo 规则 runas 属性sudo 规则 runasgroup 属性sudo 规则 runasuser 属性sudo 规则用户属性系统离线，无法更改密码以特定域为目标以 AUTOFS 服务为目标以 IFP 服务为目标以 NSS 服务为目标以 PAC 服务为目标以 PAM 服务为目标以 SSH 服务为目标以 SSSD 服务为目标以 SUDO 服务为目标用于日志记录的 Tevent 链 ID包含 HBAC 规则的 DN 的 LDAP 属性，可以用来代替 memberUser 和 memberHost 进行匹配。包含主机 FQDN 的 LDAP 属性。包含 netgroup 的 NIS 域名的 LDAP 属性。包含 SELinux 用户字符串的 LDAP 属性。包含此规则所匹配的所有主机/主机组的 LDAP 属性。包含该规则所匹配的所有用户/组的 LDAP 属性。包含主机类别的 LDAP 属性，如'all'。包含 LDAP netgroup 对象的 UUID/GUID 的 LDAP 属性。包含主机 SSH 公钥的 LDAP 属性。包含 SELinux usermap 名称的 LDAP 属性。包含 netgroup 成员名称的 LDAP 属性。包含用户映射的唯一 ID 的 LDAP 属性。包含用户类别的 LDAP 属性，如'all'。包含是否启用用户映射的 LDAP 属性。与 netgroup 名称相对应的 LDAP 属性。列出属于 netgroup 成员的主机和主机组的 FQDN 的 LDAP 属性。LDAP属性，列出作为 netgroup 直接成员的主机和主机组。列出 netgroup 成员资格的 LDAP 属性。LDAP 属性，列出作为 netgroup 直接成员的系统用户和组。LDAP 组外部成员属性要使用的 SSSD 域LDAP 服务器上使用的 Schema Type，rfc2307更新后应用于客户端 DNS 条目的TTL针对 IPA 服务器查找 GPO 策略文件之间的时间间隔针对 IPA 服务器查找 HBAC 规则之间的时间间隔当最后一个请求未找到任何规则时，针对 IPA 服务器的Desktop Profiles 规则查找之间的时间间隔（以分钟为单位）针对 IPA 服务器查找 Desktop Profile 规则之间的时间间隔针对 IPA 服务器查找 SELinux 映射之间的时间间隔默认绑定 DN 的身份验证令牌此 IPA 客户端使用的自动挂载器的位置要运行的调试级别默认基本 DN默认绑定 DN服务发现 DNS 查询的域部分条目缓存可以设置为在后台自动更新条目，如果被请求的时间超过域名的 entry_cache_timeout 值的一个百分比。运行服务器的组 ID组创建 FAST 缓存为应该用于动态 DNS 更新的接口的 IP 地址将被否决并替换为后备 shell 的 shell 列表允许进行登陆的 shell 用户列表使用的 NSS 库的名称用于查询主机和网络的 NSS 库名称LDAP 中自动挂载主映射的名称。可能会被该响应者打开的文件描述符的数量触发完全取消引用请最少需要缺少的成员数预分支代理子代的数量。单个 LDAP 查询中要检索的记录数LDAP 中主机条目的对象类。LDAP 中 netgroup 条目的对象类。该选项表示 SSSD 在 IPA 服务器上运行，应该以不同的方式执行来自受信任域的用户和组的查找。到 proxy 命令的路径必须是绝对路径 用于连接主机的端口应该处理子域获取的提供者，这个值应始终和 id_provider 相同。默认绑定 DN 的身份验证令牌的类型运行服务器的用户 ID用户创建 FAST 缓存为放弃特权的用户NSS 提供程序应返回的密码字段的值如果模板中包含格式字符串%H，那么这个选项的值将被用于 override_homedir 选项的扩展。没有任何配置。 这个域没有活跃的服务器。 两次更新检查之间的间隔时间用户名区分大小写截断日志文件... 调整证书验证对 PAM 验证调整证书验证。调整密码验证行为调整 sssd 来接受或忽略 netlink 状态更改组的类型和其他标志UID 属性允许更改密码的备份 LDAP 服务器的 URI允许更改密码的 LDAP 服务器的 URIUUID 属性无法归档日志文件 无法连接到系统总线! 无法创建备份目录 [%d]: %s无法创建本地数据备份，无法删除缓存。 无法导出组覆盖 无法导出用户覆盖 无法获得在线状态 无法获取服务器列表 无法导入组覆盖 无法导入用户覆盖 无法解析命令参数 无法解析名称 %s 。 无法读取用户输入 无法删除缓存文件 无法删除日志文件 无法截断日志文件 提供了意外的参数，使单个对象无效的选项仅接受单个参数。 查找错误说明时出现意外错误服务器凭证消息的格式异常。未知操作：%1$s 有效的操作为 "%2$s"、"%3$s 和 "%4$s" ID 映射的上限使用 objectSID 的 ID 映射而不是预设的 ID使用 Kerberos 身份验证进行 LDAP 连接将 LDAPS 端口用于 LDAP 和 Global Catalog 请求使用匿名 PKINIT 请求 FAST armor 票使用匿名 PKINIT 请求 FAST 凭证使用与 autorid 兼容的算法进行 ID 映射使用自定义版本的 krb5_get_init_creds_password对于域名称仅使用大写字母使用以下匹配规则来过滤生成 ssh-key 的证书使用给定的字符串作为主机对象的搜索基础。使用给定的字符串作为可信域的搜索基础。所使用的配置摘要文件： %zu 使用 [%s] 进行用户名查找失败。 未指定用户 用户主体属性（用于 Kerberos）用户名属性SSSD 应该明确忽略的用户验证 PACrealmd 配置服务为这个域存储的各种标签。重新启动服务前 Watchdog 超时在执行 DNS 更新时应该使用哪种身份验证在身份验证期间向用户显示什么信息当 SSSD 切换到脱机模式时，它尝试重新上线前的时间会根据断开连接的时间而增加。这个值以秒为单位，并使用以下公式计算：offline_timeout + random_offset。什么时候 PAM 响应者要强制发起 initgroups 请求在哪里放置 krb5 配置片段在 SASL绑定期间，LDAP 库是否应执行反向查找以规范化主机名域是否可以被 OS 或应用程序使用nsupdate 实用程序是否应默认使用 TCP提供者是否应该明确更新 PTR 记录是否自动为用户创建私人组是否自动更新客户端的 DNS 条目是否在 FreeIPA 中自动更新客户端的 DNS 条目是否创建 kdcinfo 文件是否在 sudo 规则中评估基于时间的属性是否按主机名，IP地址和网络过滤规则在 known_hosts 文件中是否对主机名和地址进行哈希处理是否在主机属性中包含带有 netgroup 的规则是否在主机属性中包含带有正则表达式的规则如果可能，是否从缓存中查找规范的组名是否与目标用户匹配认证的 UPN更改密码后是否更新 ldap_user_shadow_last_change 属性是否要更新 Samba 数据库中的机器账户密码是否使用令牌组是否使用 Global Catalog 进行查找允许哪些 PAM 服务联系应用程序域应使用哪些属性来评估账户是否过期应该使用哪些规则来评估访问控制您的密码已经过期。您的密码已过期。您有 %1$d 剩余宽限登陆。您的密码将于 %1$d %2$s 过期。客户要使用的特定站点AD 的 accountExpires 属性属性包含用户的 X509 证书的属性包含用户电子邮件地址的属性包含用户的通行密钥映射数据的属性列出用户允许的身份验证类型的属性dlopen 失败 [%s]。 dlsym 失败 [%s]。 域entryUSN 属性错误krbLastPwdChange 属性krbPasswordExpiration 属性lastUSN 属性ldap_backup_uri，LDAP 服务器的 URIldap_uri，LDAP 服务器的 URINDS 的 loginAllowedTimeMap 属性NDS 的 loginDisabled 属性NDS 的 loginExpirationTime 属性malloc 失败。 memberOf 属性否未连接nsAccountLock 属性objectSID 属性pam_acct_mgmt: %s pam_authenticate 用户 [%s]: %s pam_chauthtok: %s pam_close_session: %s pam_get_item 失败： %s pam_open_session: %s pam_setcred: [%s] pam_start 失败： %s set_debug_file_from_fd 失败。 shadowExpire 属性shadowFlag 属性shadowInactive 属性shadowLastChange 属性shadowMax 属性shadowMin 属性shadowWarning 属性sss_getpwnam_r 失败 [%d]。 sss_ssh_knownhostsproxy：无法解析主机名 %s sss_ssh_knownhostsproxy: 连接至主机 %s 端口 %d : %s sss_ssh_knownhostsproxy：无法到代理数据：%s talloc_asprintf 失败。 测试 pam_acct_mgmt 测试 pam_authenticate 测试 pam_chauthtok 测试 pam_close_session 测试 pam_open_session 测试 pam_setcred 未知操作 用户：%s 操作：%s 服务：%s AD 的 userAccountControl 属性是PRIu64Running under %, must be root 在 % 下运行，必须是 root