Shin VPN yana ƙarewa da entropy? Abin da entropy_avail ke nunawa da gaske
Tsayawa lokacin tashi da jinkirin rami da aka kafa su ne daban-daban kuskure. Karanta matakin, ainihin ma'anar ƙididdiga da layin jira kafin ka zargi rashin tsari.
Ƙarewar rashin tsarin kernel wani bayani ne mai jan hankali ga VPN mai jinkiri, kuma kusan koyaushe ba daidai ba ne ga alamar da mutane ke bayarwa. Mai masaukin da ke jiran fitarwa ba bisa ka'ida ba yana tsayawa a wani lokaci, yawanci a farkon tashi ko yayin sarrafa maɓalli. Ramin da ke haɗawa da sauri sannan yana aikawa a hankali yana bayyana ƙarfin aikawa ne maimakon haka. Raba waɗannan abubuwan lura guda biyu kafin shigar da daemon don gyara lambar da ba ka gama karantawa ba.
Me ya sa tatsuniyar ke rayuwa
Duk matsalolin biyu gaskiya ne kuma suna kama da juna daga nesa. Tsayawar farawa a sabuwar na'urar da aka tashi tana faruwa da gaske, kuma jinkirin rami da aka kafa shima gaskiya ne. Kuskure shi ne ɗauka cewa na biyu na faruwa ne saboda na farko domin cryptography tana bayyana wani wuri a cikin labaran biyu. Babu wani abu a cikin kalmar ɓoyewa da ke nuna cewa kowane byte da aka aika yana cinye sabon byte na hayaniyar muhalli.
Ba haka waɗannan masu ƙirƙira suke aiki ba. Ɗakin karatu na cryptographic yana riƙe da mai ƙirƙira mai iri kuma yana jawo fitarwa daga gare shi, yana sake shuka iri bisa ga manufofinsa, don haka lokacin mai tsada shi ne shuka iri ba daidaitaccen aikawa ba.
Abin da mai ƙirƙira ke yi ga kowane fakiti
A cikin OpenSSL 3 ana gina matsayin mai ƙirƙira na asali daga misalan DRBG waɗanda ke shuka iri da sake shuka bisa ga tsari da yanayi. A cikin OpenVPN 2.6 hanyar bayanan AEAD tana samun nonce daga lambar jeri na fakiti tare da ƙimar ɓoye ta kowane zama, yayin da tsohuwar hanyar CBC ke jawo IV mai kama da na kai ga kowane fakiti. Babu ɗaya daga cikin tsarin da ke goyon bayan ƙa'idar cewa motsa gigabyte yana cinye gigabyte na sabon hayaniyar kernel. Dukansu suna goyon bayan ra'ayin cewa ƙirƙirar maɓalli da musayar hannu su ne wurin da shuka iri ke da muhimmanci.
Ya kamata a ambaci al'amarin CBC domin yana kama da tatsuniyar kuma ba ita ba ce: IV ɗinsa na kowane fakiti yana zuwa daga mai ƙirƙira na ɗakin karatu bisa ga jadawalin sake shuka iri na ɗakin karatu, ba ya taɓa zuwa daga kiran kernel ga kowane fakiti ba. Lokacin da wani ya ambaci kuɗin entropy ga kowane byte, tambaye shi wace sigar ɗakin karatu da wace hanyar lambar suka auna.
Inda jira yake nunawa da gaske
Sanya hatimin lokaci a kewayen matakai maimakon kewayen zama: tashi, tabbatarwa, canjin maɓalli da aikawa. Jira kafin rami ya zama mai amfani wani ƙorafi ne daban da ƙarancin matsakaicin gudu, kuma ɗaya ne kawai daga cikinsu ke nuni ga rashin tsari. A Linux buƙata ta getrandom() al'ada na iya toshewa har sai an fara tushen rashin tsarin kernel, shi ya sa sigar wannan matsala ta lokacin tashi take gaskiya a na'urorin da aka ƙirƙira da allunan da aka saka waɗanda ba su da yawa don ciyar da tafki da wuri.
| Mataki | Abin da za a gudanar | Karatu da ke nufin jira | Karatu da ke nufin ƙarfin aikawa |
|---|---|---|---|
| Tashi, kafin kowane rami | systemd-analyze critical-chain | raka'a da ke zama na daƙiƙa kafin rami ya fara | ba ya aiki, babu abin da ake aikawa tukuna |
| Musayar hannu | journalctl -u openvpn-server@server -b | dogon rata kafin jerin farkon ya cika | ba ya aiki, rami bai tashi ba |
| Aikawa da aka kafa | ss -tin kusa da sar -n DEV 1 | tsarin da aka toshe tare da layukan soket marasa komai | layuka cike, sake aikawa da zare ɗaya mai aiki |
Umarni biyu masu arha suna cikin farkon wannan tarin, kuma suna warware tambayoyin sauƙi kafin a buƙaci tebur ɗin. Ƙididdigar da suke karantawa lissafin entropy ne ba ma'aunin faɗin band ba, kuma hoto ɗaya ba zai iya nuna cewa tsari yana toshewa, tsawon lokacin da ya jira ko wace fuskar ɗakin karatunsa ke kira. Samfurin da aka ɗauka bayan dawowa yawanci yana rasa tsayawar gaba ɗaya, don haka riƙe sigar kernel kusa da karatun.
cat /proc/sys/kernel/random/entropy_avail
uname -rDaidaita gyaran da karatun
Idan kernel da gaske yana jira farkon, duba hanyar shuka iri da dandamali ke goyon baya maimakon rami. Ana iya ba na'urar da aka ƙirƙira na'urar rashin tsari da mai masauki ya bayar, kamar virtio-rng, kuma shirye-shiryen hoto yana da muhimmanci domin iri da aka kwafa ba tare da canji ba cikin baƙi da yawa ba farkon mai zaman kansa ba ne. Idan ɗakin karatu ya ba da rahoton gazawar shuka iri bayan tashi, bincika tushensa da aka tsara da halin mai bayarwa maimakon canza saitunan kernel.
ss -tin dst 203.0.113.7
sar -n DEV 1 5Takardun mai ƙirƙira na OpenSSL suna bayyana yadda wannan matsayi ke samun shigarwa da lokacin da sake shuka iri ke faruwa, wanda ya fi tatsuniyar ƙunci da yawa kuma yana aiki ne kawai ga wannan aiwatarwa. Daemon na entropy ba gyaran gudu na duniya ba ne, kuma shigar da shi don ƙididdiga ya tashi yana canza tsammanin tsaro ba tare da nuna jinkiri ba. Ga ƙarfin aikawa, bi hanyar bayanai: zare ɗaya da ya cika, sake aikawa, asara ta waje da zubar da layuka kowanne yana buƙatar gyara daban, kuma girman buffer yana magance buffer ɗin soket tare da nasa shaidar layin.