Ukushintshwa kwe-FIPS Kernel kuthatha amamojula e-Wi-Fi ne-VPN

Vula i-fips-updates, uqalise kabusha, futhi umshini ubuya ungenaso isixhumi esibonakalayo esingenantambo kuyilapho iklayenti le-VPN lenqaba ukuqala ngoba imojula yalo ye-kernel ayikho. Akukho okwasuswa ngomqondo ojwayelekile wamaphakheji, yingakho ukufaka kabusha iklayenti akushintshi lutho. Umshini usebenza nge-kernel okwakungakaze kwakhiwe izihambisi zayo. Izimpawu ezimbili, imbangela eyodwa, futhi imbangela ibonakala ngomyalo owodwa.

Ukuqalisa kabusha kwashintsha ini ngempela

Izibuyekezo ze-FIPS ku-Ubuntu Pro zifaka uhlobo lwe-kernel oluqinisekisiwe futhi zilwenze ukungena kokusuka okuzenzakalelayo. Lolo hlobo luyi-kernel yangempela: iyasukuma, iyasebenza, futhi iqalisa izinsizakalo obukade unazo. Engenakho yimojula ngayinye eyakhelwe i-kernel ejwayelekile, kuhlanganise isihambisi esingenantambo esakhiwe ngaphandle kwesihlahla kanye nemojula yomhubhe elethwa nge-DKMS. Iqoqo lezihambisi lihamba ne-kernel, hhayi nomphathi wamaphakheji. Ngakho-ke i-hardware isikhona futhi isofthiwe ekhuluma nayo ayikho.

Qhathanisa i-kernel esebenzayo namaphakheji afakiwe ngaphambi kokuvula noma yisiphi isilungiselelo senethiwekhi. Uchungechunge lwenguqulo luthwala uphawu i-kernel ejwayelekile engenalo, futhi leyo nhlanzi eyodwa ichaza zombili izingxenye ezingekho.

Funda nokungena kokusuka, ngoba umshini ungaba ne-kernel eqinisekisiwe efakiwe ngaphandle kokuyisebenzisa. Uma kunjalo indaba yamamojula yehluke ngokuphelele, futhi izimbobo nezihambisi obuzokufaka kabusha zilungile.

Funda isimo samamojula ngaphambi kokulungiselela iklayenti

Imejula engatholakali kanye nemojula ekhona kodwa enqaba ukulayishwa yizinkinga ezimbili ezihlukene ezinamakhambi ahlukene. I-modinfo ibika ukuthi iyiphi onawo, futhi i-lsmod ibika ukuthi yini elayishiwe manje. Yenza kokubili ngaphambi kokuthinta ukulungiselelwa kweklayenti le-VPN, ngoba iphutha leklayenti ngokwalo alivamisile ukwehlukanisa lezi ezimbili.

Ingxenye engenantambo idinga ukuhlukaniswa okufanayo. Isixhumi esingaveli neze sikhomba isihambisi, kuyilapho esikhona kodwa esihlala sivinjwe sikhomba i-rfkill noma umphathi wenethiwekhi. Zombili zibukeka zifana kuhlelo lokusebenza lwedeskithophu futhi azabelani lutho ngaphansi.

Qhuba izivivinyo kumshini uqobo ngesikhathi iphutha lisekhona futhi lingaphindwa. Umphumela onamathiselwe usuka kwenye ingqalabutho awuthathi indawo yalokhu.

uname -r
pro status --all | grep -E 'fips|kernel'
modinfo wireguard 2>&1 | head -3
rfkill list

Uma i-modinfo ingayitholi neze imojula, ukufaka kabusha iphakheji yesikhala somsebenzisi ngeke kusize, ngoba isikhala somsebenzisi kwakungakaze kube yingxenye engekho. Lokho kuqaphela kusindisa ihora lokukhathazeka ngamaphakheji futhi kukhomba ngqo ku-kernel.

Buyela emuva ngokulandelana okukushiyela i-kernel

Uma i-FIPS yavulwa ngephutha, indlela yokubuyisela ebhalisiwe ivimba insizakalo, isusa amaphakheji ayo bese ibuyisela i-kernel ejwayelekile. Ukulandelana akukona kokuhlobisa. Ukususa kuyenqaba ukuqhubeka uma kungatholi enye i-kernel ye-Ubuntu, ngoba ukususa okuwukuphela kwayo kungashiya umshini ongakwazi ukusuka. Lokho kuhlola yiwo umehluko phakathi kokubuyela emuva nokwakha kabusha. Futhi yiso leso sizathu sokuthi ukulandelana kwehluleke uma i-kernel ejwayelekile isivele isusiwe.

Kuyenze ngesikhathi i-kernel ejwayelekile isafakiwe, yamukele isixwayiso mayelana nokususa i-kernel, bese uqalisa kabusha ngemuva kwalokho. Khona-ke qinisekisa ukuthi asikho iphakheji le-FIPS elisele esimweni esifakiwe nokuthi i-kernel esebenzayo yileyo obekuyilindele.

Kwingqalabutho ekude, hlela kuqala ukufinyelela kwekhostholi noma okungaphandle kwebhendi. Ukususa i-kernel nge-SSH kulungile kuze kube yikho ukuqalisa kabusha okungabuyi.

dpkg -l | grep -E 'linux-image|fips'
sudo pro disable fips-updates --purge
sudo apt install --reinstall linux-generic
sudo reboot

Uma ukuqinisekiswa kuyisidingo

Ukubuyela emuva kuyisinyathelo esingalungile uma ukuqinisekiswa kungokwesivumelwano, ngoba umshini uphuma ekulungiselelweni okuchazwa ucwaningo. Uma kunjalo igebe lesihambisi liwumbuzo wokukhetha i-hardware: khetha i-adaptha engenantambo isihambisi sayo esiza ne-kernel eqinisekisiwe, yamukela umshini onekhebula kuphela, noma hambisa umhubhe uye engxenyeni i-kernel eqinisekisiwe eseyisekelayo.

Ukwakha imojula engaphandle kwesihlahla ingene ku-kernel eqinisekisiwe akusona isisombululo esingathathi hlangothi. Kushintsha okwenziwa i-kernel, futhi yikho kanye lokho isici esikuchaza ukuqinisekiswa.

Rekhoda isinqumo nenegama lomnikazi eceleni, ngoba isicelo sokuthi i-Wi-Fi isebenze nje sizobuya ezinyangeni ezimbalwa sinesimo esincane. Inothi elifushane manje livimbela ingxabano efanayo kamuva.

Hlola isitaki ngezingqimba ngemuva koshintsho

Ngemuva kokubuyela emuva noma ushintsho lwe-hardware, qinisekisa kusuka phansi kuye phezulu esikhundleni sokusuka kuklayenti le-VPN kwehla. Isixhumi kufanele sibe khona, isixhumanisi kufanele siphakame, isixazululi kufanele sisebenze, futhi ngemva kwalokho umhubhe ubalulekile. Ingqimba ngayinye yehluleka ngomlayezo wayo, futhi ukuzifunda ngokulandelana kugcina ukuxilongwa kuthembekile.

Isimo se-DNS esisele kusuka ekusukeni kwangaphambili siwumphumela wamanga ojwayelekile, ngakho-ke funda isixazululi ngaphambi kokuphetha ngokuthi umhubhe waphuka.

nmcli device status
ip -brief link
resolvectl status | head -12
systemctl --failed

Uma umhubhe usahluleka uma i-kernel isibuyile, funda isigaba esihlulekayo esikhundleni somugqa wesifinyezo weklayenti. Imejula engakaze ilayishwe, isitifiketi esanqatshwa uhlangothi olulandelayo kanye nobufakazi obanqatshwa iseva kuyizinkinga ezintathu ezihlukene, futhi ukuqalisa kabusha ngeke kuzihlukanisele wena. Bhala igama lesigaba kuthikithi, futhi unjiniyela olandelayo uzoqala lapho wena ugcine khona.