LimitNPROC ne-TasksMax: yini eliyikala iyunithi ye-OpenVPN

Ukuqala okungaphumelelanga kwe-OpenVPN kuvame ukufika njengesikhalazo ngezinsiza kanye nesiphakamiso esihle sokukhulisa umkhawulo, futhi leso siphakamiso sisebenza kuphela cishe engxenyeni yezimo. Ngemuva kwalokho kwehluleka kukhona izibali ezimbili ezingahlobene. Esinye ingumkhawulo we-kernel enanini lemisebenzi ephethwe i-ID yomsebenzisi yangempela, futhi uyazuzwa uma inqubo isetshenziswa. Esinye isabelomali se-cgroup esisetshenziswa umphathi wesevisi kuyunithi nakho konke eyikhiqizayo. Ukufunda inani elisebenzayo lalokho ngakunye, kuyunithi esebenza ngempela, kubiza okuncane kunokuqagela.

Izibali ezimbili, imibuzo emibili

LimitNPROC yi-RLIMIT_NPROC ngaphansi kwegama le-systemd, futhi iyunithi yayo yokubala i-ID yomsebenzisi yangempela. Zonke izinqubo eziphethwe yilowo msebenzisi zibalwa kusamba esisodwa, kuhlanganise nomsebenzi oqalwe ezinye iyunithi, iseshini yokungena noma umsebenzi wesihleli. Ngakho-ke lo mkhawulo awuyona indawo yokugcina yesevisi ngayinye ngisho noma ubekwe ngaphakathi kweyunithi yesevisi, futhi isevisi ekhiqiza umsizi kuklayenti ngayinye iqhudelana nakho konke okunye okusebenza ngaphansi kwalelo akhawunti. Umsebenzi we-cron omatasa ngaphansi komsebenzisi ofanayo ungadudula iyunithi ye-VPN idlule umugqa engakaze iwudlule yodwa.

TasksMax unomunye umnikazi: isilawuli se-pids kwi-cgroup yeyunithi, esibala imisebenzi hhayi izinqubo. Izintambo ziyimisebenzi, ngakho-ke i-daemon ebonakala inomsonto owodwa kodwa ineqoqo labasebenzi ingasebenzisa isabelomali esibonakala ngokubheka kokuqala sikhulu kakhulu kunenani lezinqubo zayo. EffectiveTasksMax ibika ukuthi uhlelo lwe-cgroup luvumela ngempela ini ngemuva kokuba izingxenye zomzali zishilo okwazo.

Kungani ukuhlukile kwe-root kushintsha impendulo

I-kernel ayisebenzisi i-RLIMIT_NPROC kunqubo ephethe i-CAP_SYS_RESOURCE noma i-CAP_SYS_ADMIN, yingakho iyunithi esebenza njenge-root ngaphandle kokushiya amalungelo ingavinjwa ngalolo hlelo. Lokhu kuhlukile okukodwa kuchaza izeluleko eziphikisanayo abantu abazishintshanayo: ukukhulisa i-LimitNPROC kulungisa ukusetshenziswa okushiye amalungelo futhi akwenzi lutho nhlobo kulokho okwahlala kunamalungelo. Hlola i-User= nokuthi i-daemon iyashintsha yini ubunikazi ngemuva kokuqala ngaphambi kokunikeza udumo noma icala kulolo hlelo. Iyunithi enamalungelo eba ishintshela kukhawunti engenamalungelo ibuyela ngaphansi komkhawulo ngaso leso sikhathi sokushintsha, okwenza ukulandelana kwesikhathi kokwehluleka nakho kufanele kufundwe.

Isigaba sokwehluleka sikunciphisa nakakhulu. Ukwenqatshwa ngesikhathi sokulungiselela ukusetshenziswa, iphutha lokukhiqiza elibikwa yi-daemon ngokwayo, nokwakhiwa komsebenzi okwenqatshiwe ngaphakathi kwe-cgroup kuletha imigqa ehlukene ye-journal, futhi munye kuphela wabo ophendulwa ngesabelomali esikhudlwana.

Funda amanani asebenzayo, hhayi awase-shell

I-ulimit -u yeshell esebenzisanayo ichaza leso shell. Ayichazi ukuthi umphathi wesevisi wadlulisela ini ku-daemon, futhi ayisho lutho mayelana nokubalwa kwe-cgroup. Buza iyunithi esikhundleni salokho, usebenzisa igama lesibonelo elikhona kusihindi hhayi isibonelo esivela kumhlahlandlela.

systemctl show [email protected] -p User -p LimitNPROC -p TasksCurrent -p TasksMax -p EffectiveTasksMax
cat /proc/$(systemctl show -p MainPID --value [email protected])/limits | grep -i processes

Ngaphakathi kwesitsha impendulo idinga ukufundwa okunye okubili, ngoba inani langaphakathi le-infinity lichaza kuphela umbono wesivakashi. Cela umnikazi wesihindi umkhawulo we-pids wesitsha ngokwaso, futhi uqinisekise ukuthi umphathi wesevisi wangaphakathi angayidlulisela yini leyo silawuli. Iyunithi efakwe ngaphakathi ayikwazi ukugcina isabelomali isihindi sayo esingayinikezanga.

Linganisa ubukhulu bokulungisa futhi ukufakazele ngaphansi komthwalo

Khetha inombolo emthwalweni womsebenzi hhayi emibhalweni yephutha. Bala izinqubo i-daemon eziqalayo kuklayenti ngayinye exhunyiwe noma ocwaningweni ngalunye lomsizi, phindaphinda ngokuhlanganyela okulindelekile ukuthi ukusetshenziswa kukuthwale, engeza isikhala semihlangano yokuphatha, bese uqhathanisa leyo nombolo namanani amabili asebenzayo. Ukubhala kabusha kwe-drop-in yasendaweni kugcina ushintsho lufundeka futhi kusinda ekuthuthukisweni kwamaphakethe, kanti ukuhlela ifayela leyunithi elithunyelwe kufihla ushintsho kuze kube yilapho ukubuyekezwa okulandelayo kuyishintsha. Bhala izibalo eduze kokubhala kabusha, ngoba umuntu olandelayo ozokwandisa noma ehlise uzodinga izicatshangelwa, hhayi inombolo yokugcina.

Izinguquko zesabelomali zisetshenziswa ngesikhathi sokusetshenziswa, ngakho-ke ukulayisha kabusha kukodwa akushintshi usayizi wezinqubo esezivele zisebenza. Qala kabusha iyunithi ngomjikelezo wayo ojwayelekile wokuphila, wamukele ukuphazamiseka kweseshini, bese ufunda izibali futhi esibonelweni esisha.

sudo systemctl daemon-reload
sudo systemctl restart [email protected]
systemctl show [email protected] -p TasksCurrent -p EffectiveTasksMax
sudo journalctl -u [email protected] -b --no-pager | tail -n 20

Okufakazela ukulungisa iyunithi eqalwe kabusha enenani lemisebenzi elingaphansi kwezindawo zokugcina zombili ngesikhathi ithwele umthwalo ohlosiwe, kanye ne-journal engasabiki ngokuphela kwemisebenzi noma kokukhiqiza esigabeni esifanayo. Gcina izinombolo zangaphambi nangemuva kanye noshintsho, ukuze uphenyo olulandelayo luqale ekulinganiseni hhayi eselulekweni esifanayo. Uma inombolo isafinyelela esicongweni, izibalo zazingalungile hhayi umkhawulo owawuncane ngengozi, futhi lowo mehluko kufanele waziwe ngaphambi kokuqala kabusha okulandelayo.