Re: Review of new English templates for miniupnpd
Yangfl <[email protected]> Sat, 8 Mar 2025 02:11:22 +0800
| Newsgroups | gmane.linux.debian.internationalization.english |
|---|---|
| Message-ID | <CAAXyoMNDDLJ1qLQra0HD4gyPp3Q44gzhPK6LDEn2BNC1C6kGSA@mail.gmail.com> |
--000000000000916438062fc48d96 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Justin B Rye <[email protected]> =E4=BA=8E 2025=E5=B9=B43=E6=9C=888= =E6=97=A5=E5=91=A8=E5=85=AD 01:43=E5=86=99=E9=81=93=EF=BC=9A > Yangfl wrote: > > Template: miniupnpd/start_daemon > > Type: boolean > > Default: false > > _Description: Start the MiniUPnP daemon automatically? > > Choose this option if the MiniUPnP daemon should start automatically, > > now and at boot time. > > . > > Be aware, the default settings for this package are only suitable for = a > fresh, > > unmodified system. If the firewall is already configured (by you or > other > > software), choose 'No' now, edit /etc/miniupnpd/miniupnpd.conf **AND** > > /etc/miniupnpd/*.sh scripts accordingly, and enable the daemon later > with > > `service miniupnpd enable`. > > This one's tricky. "By you or other software" implies that the reader > is also software; but it would be meaningless to talk about a firewall > being set up "either manually or using software" since all firewalls > are created via software. > > Meanwhile it's possible that a firewall has already been configured in > a way that causes no problems for miniUPnPd (it might for instance be a > logging-only nftables setup). Shouldn't it be saying something more > explicit about what the firewall might be doing that would cause a > problem? That would make it something like > > Be aware that the default settings for this package are only suitable > for > a system where the ports required are accessible. If a firewall has > been set up blocking them, you should reject this option now, edit > /etc/miniupnpd/miniupnpd.conf and the scripts in /etc/miniupnpd/*.sh > appropriately, and enable the daemon later with "service miniupnpd > enable". > > (I've no idea what the relevant ports are, so I hope your users can > think of some better search engine queries than I could.) > I should clarify that, upnpd daemon does nothing than maintaining a list of allow/deny rules. Whether to use these rules, where these rules are placed, and what to do if no rules are match against the traffic is up to external configures, ie /etc scripts. As always, these scripts expect a very specific layout of firewall chains, if users have custom firewall rules/chains, things will break down. > . > > Be extremely careful if you don't have physical access to the machine, > as you > > may be blocked by the firewall immediately. > > Because I might be using UPnP port redirection for my SSH connection? > Except that I haven't started the miniUPnP daemon yet, so how does > that work? > For some reasons the default action for unmatched traffic is drop. > . > > If in doubt, choose 'no'. > > DevRef's section on Debconf templates at > > https://www.debian.org/doc/manuals/developers-reference/best-pkging-pract= ices.html#general-recommendations-for-authors-and-translators > says to avoid assuming that the debconf UI uses specific features like > the words "yes" or "no" - instead it's something like > > If in doubt, reject this option. > > So that would be: > > Template: miniupnpd/start_daemon > Type: boolean > Default: false > _Description: Start the MiniUPnP daemon automatically? > Choose this option if the MiniUPnP daemon should start automatically, > now and at boot time. > . > Be aware that the default settings for this package are only suitable f= or > a system where the ports required are accessible. If a firewall has > been set up blocking them, you should reject this option now, edit > /etc/miniupnpd/miniupnpd.conf and the scripts in /etc/miniupnpd/*.sh > appropriately, and enable the daemon later with "service miniupnpd > enable". > . > Be extremely careful if you don't have physical access to the machine, > as you > may be blocked by the firewall immediately. > . > If in doubt, reject this option. > > -- > JBR with qualifications in linguistics, experience as a Debian > sysadmin, and probably no clue about this particular package > --000000000000916438062fc48d96 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"auto"><div><br><br><div class=3D"gmail_quote"><div dir=3D"ltr" = class=3D"gmail_attr">Justin B Rye <<a href=3D"mailto:justin.byam.rye@gma= il.com" rel=3D"noreferrer noreferrer noreferrer" target=3D"_blank">justin.b= [email protected]</a>> =E4=BA=8E 2025=E5=B9=B43=E6=9C=888=E6=97=A5=E5=91= =A8=E5=85=AD 01:43=E5=86=99=E9=81=93=EF=BC=9A<br></div><blockquote class=3D= "gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding= -left:1ex">Yangfl wrote:<br> > Template: miniupnpd/start_daemon<br> > Type: boolean<br> > Default: false<br> > _Description: Start the MiniUPnP daemon automatically?<br> >=C2=A0 Choose this option if the MiniUPnP daemon should start automatic= ally,<br> >=C2=A0 now and at boot time.<br> >=C2=A0 .<br> >=C2=A0 Be aware, the default settings for this package are only suitabl= e for a fresh,<br> >=C2=A0 unmodified system. If the firewall is already configured (by you= or other<br> >=C2=A0 software), choose 'No' now, edit /etc/miniupnpd/miniupnp= d.conf **AND**<br> >=C2=A0 /etc/miniupnpd/*.sh scripts accordingly, and enable the daemon l= ater with<br> >=C2=A0 `service miniupnpd enable`.<br> <br> This one's tricky.=C2=A0 "By you or other software" implies t= hat the reader<br> is also software; but it would be meaningless to talk about a firewall<br> being set up "either manually or using software" since all firewa= lls<br> are created via software.<br> <br> Meanwhile it's possible that a firewall has already been configured in<= br> a way that causes no problems for miniUPnPd (it might for instance be a<br> logging-only nftables setup).=C2=A0 Shouldn't it be saying something mo= re<br> explicit about what the firewall might be doing that would cause a<br> problem?=C2=A0 That would make it something like<br> <br> =C2=A0 =C2=A0Be aware that the default settings for this package are only s= uitable for<br> =C2=A0 =C2=A0a system where the ports required are accessible. If a firewal= l has<br> =C2=A0 =C2=A0been set up blocking them, you should reject this option now, = edit<br> =C2=A0 =C2=A0/etc/miniupnpd/miniupnpd.conf and the scripts in /etc/miniupnp= d/*.sh<br> =C2=A0 =C2=A0appropriately, and enable the daemon later with "service = miniupnpd enable".<br> <br> (I've no idea what the relevant ports are, so I hope your users can<br> think of some better search engine queries than I could.)<br></blockquote><= /div></div><div dir=3D"auto"><br></div><div dir=3D"auto">I should clarify t= hat, upnpd daemon does nothing than maintaining a list of allow/deny rules.= Whether to use these rules, where these rules are placed, and what to do i= f no rules are match against the traffic is up to external configures, ie /= etc scripts. As always, these scripts expect a very specific layout of fire= wall chains, if users have custom firewall rules/chains, things will break = down.</div><div dir=3D"auto"><br></div><div dir=3D"auto"><div class=3D"gmai= l_quote"><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;borde= r-left:1px #ccc solid;padding-left:1ex"> >=C2=A0 =C2=A0.<br> >=C2=A0 Be extremely careful if you don't have physical access to th= e machine, as you<br> >=C2=A0 may be blocked by the firewall immediately.<br> <br> Because I might be using UPnP port redirection for my SSH connection?<br> Except that I haven't started the miniUPnP daemon yet, so how does<br> that work?<br></blockquote></div></div><div dir=3D"auto"><br></div><div dir= =3D"auto">For some reasons the default action for unmatched traffic is drop= .</div><div dir=3D"auto"><br></div><div dir=3D"auto"><div class=3D"gmail_qu= ote"><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-le= ft:1px #ccc solid;padding-left:1ex"> >=C2=A0 .<br> >=C2=A0 If in doubt, choose 'no'.<br> <br> DevRef's section on Debconf templates at<br> <a href=3D"https://www.debian.org/doc/manuals/developers-reference/best-pkg= ing-practices.html#general-recommendations-for-authors-and-translators" rel= =3D"noreferrer noreferrer noreferrer noreferrer noreferrer" target=3D"_blan= k">https://www.debian.org/doc/manuals/developers-reference/best-pkging-prac= tices.html#general-recommendations-for-authors-and-translators</a><br> says to avoid assuming that the debconf UI uses specific features like<br> the words "yes" or "no" - instead it's something li= ke<br> <br> =C2=A0 =C2=A0If in doubt, reject this option.<br> <br> So that would be:<br> <br> =C2=A0Template: miniupnpd/start_daemon<br> =C2=A0Type: boolean<br> =C2=A0Default: false<br> =C2=A0_Description: Start the MiniUPnP daemon automatically?<br> =C2=A0 Choose this option if the MiniUPnP daemon should start automatically= ,<br> =C2=A0 now and at boot time.<br> =C2=A0 .<br> =C2=A0 Be aware that the default settings for this package are only suitabl= e for<br> =C2=A0 a system where the ports required are accessible. If a firewall has<= br> =C2=A0 been set up blocking them, you should reject this option now, edit<b= r> =C2=A0 /etc/miniupnpd/miniupnpd.conf and the scripts in /etc/miniupnpd/*.sh= <br> =C2=A0 appropriately, and enable the daemon later with "service miniup= npd enable".<br> =C2=A0 .<br> =C2=A0 Be extremely careful if you don't have physical access to the ma= chine, as you<br> =C2=A0 may be blocked by the firewall immediately.<br> =C2=A0 .<br> =C2=A0 If in doubt, reject this option.<br> <br> -- <br> JBR=C2=A0 =C2=A0 =C2=A0with qualifications in linguistics, experience as a = Debian<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 sysadmin, and probably no clue about this parti= cular package<br> </blockquote></div></div></div> --000000000000916438062fc48d96--