Ingabe i-VPN iphelelwa i-entropy? Yini entropy_avail ekubonisayo ngempela
Ukuma ngesikhathi sokuqala kanye nomhubhe osunguliwe ophuzayo kuyizinto ezimbili ezihlukene. Funda isigaba, incazelo yangempela yesibali kanye nomugqa ngaphambi kokusola ubungqubuzana.
Ukuphela kobungqubuzana be-kernel kuyisichasiselo esikhanga se-VPN ehamba kancane, futhi cishe ngaso sonke isikhathi siyisichasiselo esingalungile salokho abantu abakubikayo. Umhambi olindele umphumela ongahleliwe uyama ngesikhathi esithile, ngokuvamile ekuqaleni kokuqala noma ngesikhathi sokuphatha okhiye. Umhubhe oxhuma ngokushesha bese udlulisa kancane uchaza umthamo wokudlulisa esikhundleni. Hlukanisa lezi zinto ezimbili ozibonile ngaphambi kokufaka i-daemon ukulungisa inombolo ongakaqedi ukuyifunda.
Kungani inganekwane iqhubeka
Zombili izinkinga zingempela futhi zibukeka zifana kude. Ukuma kokuqala kumshini ongabonakali osanda kuqalwa kuyenzeka ngempela, futhi umhubhe osunguliwe ophuzayo nawo uyingempela. Iphutha ukucabanga ukuthi eyesibili ibangelwa eyokuqala ngoba ukubethela kuvela ndawana thize ezindabeni zombili. Akukho okuthi igama ukubethela lisho ukuthi yonke i-byte edlulisiwe isebenzisa i-byte entsha yomsindo wendawo.
Lezi zikhiqizi azisebenzi kanjalo. Umtapo wezincwadi wokubethela ugcina isikhiqizi esinembewu futhi uthatha umphumela kuso, siphinde sihlwanyele ngokomgomo waso, ngakho isikhathi esibizayo wukuhlwanyela, hhayi ukudlulisa okuqhubekayo.
Isikhiqizi senza ini ngephakethe ngalinye
Ku-OpenSSL 3 izinga lesikhiqizi elizenzakalelayo lakhiwa ngezimo ze-DRBG ezihlwanyela futhi ziphinde zihlwanyele ngokuya ngokulungiselelwa kanye nesimo. Ku-OpenVPN 2.6 indlela yedatha ye-AEAD ithola i-nonce yayo enombolweni yokulandelana kwephakethe kanye nenani elicashile lesikhathi ngasinye, kuyilapho indlela endala ye-CBC ithatha i-IV efana nengenakucatshangwa ngephakethe ngalinye. Akukho phethini elisekela umthetho wokuthi ukuhambisa i-gigabyte kusebenzisa i-gigabyte yomsindo omusha we-kernel. Zombili zisekela umbono wokuthi ukukhiqiza okhiye nokuxhawana kuyindawo lapho ukuhlwanyela kubalulekile.
Icala le-CBC kufanele liqanjwe ngoba libukeka njengenganekwane futhi akusiyo: i-IV yalo yephakethe ngalinye ivela kusikhiqizi somtapo ngokohlelo lwalo lokuhlwanyela kabusha, ayikaze ivele ekubizeni kwe-kernel ngephakethe ngalinye. Uma othile ecaphuna izindleko ze-entropy nge-byte, buza ukuthi iyiphi inguqulo yomtapo kanye nakuphi ukulandelana kwekhodi abakulinganisile.
Ukulinda kuvela kuphi ngempela
Beka izitembu zesikhathi ezizungeze izigaba, hhayi isikhathi: ukuqala, ukuqinisekisa, ukushintsha ukhiye nokudlulisa. Ukulinda ngaphambi kokuba umhubhe usebenze kuyisikhalo esihlukile kunenani eliphansi elingaguquki, futhi kukodwa kuphela okuyikhombisa ubungqubuzana. Ku-Linux isicelo getrandom() esivamile singase sivaleke kuze kuqalwe umthombo wokungahleliwe we-kernel, yingakho inguqulo yalesi sikhathi sokuqala yale nkinga iyingempela kumishini engabonakali nasemabhodini ashumekiwe anokuncane kokondla ichibi ekuqaleni.
| Isigaba | Yini okufanele isetshenziswe | Ukufunda okusho ukulinda | Ukufunda okusho umthamo wokudlulisa |
|---|---|---|---|
| Ukuqala, ngaphambi kwanoma yimuphi umhubhe | systemd-analyze critical-chain | iyunithi ehlala imizuzwana ngaphambi kokuba umhubhe uqale | akusebenzi, akukho okudluliswayo okwamanje |
| Ukuxhawana | journalctl -u openvpn-server@server -b | isikhala eside ngaphambi kokuba ukulandelana kokuqala kuqede | akusebenzi, umhubhe awukho phezulu |
| Ukudlulisa okusunguliwe | ss -tin eduze kwe- sar -n DEV 1 | inqubo evalekile enemigqa yamasokhethi engenalutho | imigqa egcwele, ukuthumela kabusha kanye nomucu owodwa omatasa |
Imiyalo emibili eshibhile ingeyokuqala kwaleyo qoqo, futhi ixazulula imibuzo elula ngaphambi kokuba ithebula lidingeke. Isibali abasifundayo siwukubalwa kwe-entropy, hhayi isilinganisi somkhawulokudonsa, futhi isithombe esisodwa asikwazi ukukhombisa ukuthi inqubo ivalekile, ilinde isikhathi esingakanani noma iyiphi indlela umtapo wayo oyibizayo. Isampula ethathwe ngemva kokululama ngokuvamile iyephula ukuvaleka ngokuphelele, ngakho gcina inguqulo ye-kernel eduze kokufunda.
cat /proc/sys/kernel/random/entropy_avail
uname -rHlanganisa ukulungiswa nokufunda
Uma i-kernel ilindele ukuqaliswa ngempela, bheka indlela yokuhlwanyela esekelwa yipulatifomu, hhayi umhubhe. Umshini ongabonakali ungakwazi ukunikwa idivayisi engahleliwe enikezwa umhambi, njenge virtio-rng, futhi ukulungiselelwa kwesithombe kubalulekile ngoba imbewu ekhotshelwe ingashintshiwe ezivakashini eziningi akuwukuqaliswa okuzimele. Uma umtapo ubika ukwehluleka kokuhlwanyela ngemva kokuqala, hlola umthombo wawo omisiwe kanye nokuziphatha komhlinzeki esikhundleni sokushintsha izilungiselelo ze-kernel.
ss -tin dst 203.0.113.7
sar -n DEV 1 5Idokhumenti ye-sikhiqizi se-OpenSSL ichaza ukuthi lesi sigaba sithola kanjani okokufaka nokuthi ukuhlwanyela kabusha kwenzeka nini, okuyisimangalo esincane kakhulu kunenganekwane futhi kusebenza kuphela kulokho kuqaliswa. I-daemon ye-entropy ayisiyo ukulungiswa kwesivinini okujwayelekile, futhi ukuyifaka ukuze isibali sikhuphuke kushintsha umcabango wokuphepha ngaphandle kokukhombisa ukubambezeleka. Ngomthamo wokudlulisa, landela indlela yedatha: umucu owodwa ogcwele, ukuthumela kabusha, ukulahleka kwangaphandle kanye nokuwa komugqa ngakunye kudinga ukulungiswa okuhlukile, futhi usayizi wamabhafa ubhekana nokugcwalisa amasokhethi ngobufakazi bawo bomugqa.