I-RAND_bytes yehlulekile ku-OpenVPN: iphutha lelabhulali noma inodi engekho

RAND_bytes() failed isitatimende mayelana ne-primitive eyodwa yasendaweni, hhayi mayelana ne-akhawunti, ukhiye owabiwe ngaphambili noma imbobo yokuxhumana ekude. Izingozi ezimbili ezihluke kakhulu zikhiqiza umugqa ofanayo futhi zishiya ubufakazi obuhlukile. Enye i-backend ye-cryptographic eyenqaba ukukhipha amabhayithi; enye inqubo engafinyeleli emthonjeni we-entropy eyakhelwe wona ikhodi yayo. Ukuzihlukanisa kudinga ukufundwa okukodwa komugqa wamaphutha kanye nokubheka okukodwa kombono wohlelo lwamafayela lwenqubo ebanjiwe, futhi lokho kuhlola kufanele kwenzeke ngaphambi kokuba kudalwe noma yini ngaphansi kwe-/dev.

Ini elihlukaniswa yinani lokubuyisa

Isivumelwano esibhaliwe sihlukanisa imiphumela emithathu, hhayi emibili: 1 yempumelelo, -1 lapho indlela ye-RAND elayishiwe ingayisekeli isicelo, kanye no-0 kwezinye izingozi, incazelo ishiywe emugqeni wamaphutha. Incwadi ye-RAND_bytes yengeza iphuzu okulula ukulishaya indiva: isijeneretha esizenzakalelayo sithola imbewu kusistimu yokusebenza emapulatifomu asekelwayo, futhi lapho lokho kufakwa kwembewu kuhluleka ihlala isesimweni sephutha esikhundleni sokubuyisa amabhayithi angabikezelwa.

Yinye kuphela yalezo zinombolo echaza indawo ezungezile. -1 iyindaba yokwakhiwa, yomhlinzeki noma yesici, ngoba ikhodi icele into umsetho osebenzayo ongayinikezi. U-0 onezikhalazo mayelana nokufakwa kwembewu uyindaba yendawo ezungezile, ngoba isijeneretha asikwazanga ukuthola i-entropy ngokuphelele. Inombolo iyodwa ayikaze isho ukuthi iyiphi, futhi igama lomsebenzi nalo alisho.

Lapho inodi yedivayisi efihliwe iyimbangela yangempela

Isevisi ekhawulelwe ibona isihlahla esihlukile kunegobolondo olotayipha kulo. Amajele e-chroot, izithombe zeziqukathi namafayela e-unit aqinisiwe ngokuvamile aletha i-/dev enamaphuzu ambalwa kuneyakwabungaza. Uma umsetho ohlulekayo uvula i-/dev/urandom ngegama lomzila, lowo mehluko wanele ukwephula ukuqalisa ngenkathi umbungazi ngokwakhe ebonakala ephile ngokuphelele. Idivayisi ekhona ngaphandle kwejele alifakazi lutho mayelana nalokho inqubo ebanjiwe evunyelwe ukukuvula.

Nokho akuzona zonke izinhlangano ezingahleliwe ezidinga umzila. Ucingo lwesistimu lwe-Linux i-getrandom alwamukeli igama lefayela futhi alwamukeli isichazeli sefayela, futhi ikhasi lalo lencwadi libonisa ukuthi le mpawu iwusizo khona kanye lapho i-chroot ifihla khona imizila yamadivayisi.

Ngakho-ke incazelo yenodi engekho iwumbono mayelana negatsha elilodwa lekhodi, hhayi umthetho mayelana nezinombolo ezingahleliwe ngokuvamile. Isebenza lapho ubufakazi busho umzila, futhi iwukuqagela lapho ubufakazi busho okunye.

Qala ngokufunda umugqa wamaphutha, bese ubona umbono wenqubo

Indlela eshesha kakhulu yokuxazulula umbuzo ukufunda lokho umtapo wolwazi osukukubhalile, bese ubheka ngqo umbono ongaphakathi kwejele. Qala nge-ukwakhiwa kwe-OpenSSL isevisi eyilayishe ngempela, ngoba izitaki zomhlinzeki ziyahluka phakathi kwezinguqulo ezinkulu naphakathi kokusatshalaliswa. Bese ubuza i-systemd ukuthi iyiphi inqubo esebenzayo nokuthi imiphi imikhawulo esebenza kuyo. Kuphela lapho womabili amaqiniso esemebenjini khona-ke kunengqondo ukufaka uhlu lwamaphuzu inqubo leyo ewabonayo.

openssl version -a
systemctl show openvpn-server@lab -p MainPID -p PrivateDevices -p DevicePolicy
pid=$(systemctl show -p MainPID --value openvpn-server@lab)
sudo ls -l /proc/"$pid"/root/dev/urandom /proc/"$pid"/root/dev/random

Yenza lokho kufunda kwinqubo efanayo, hhayi egobolondweni elivulekile ngengozi. Ukuqhathanisa i-/dev yombungazi nombono wenqubo engahlobene nakho yikho okwenza ukuncika okungalungile kulungiswe kabili.

Faka ukuncika kuphela lapho ukwazi ukukusho ngegama

Lapho ubufakazi busho umzila ngempela, ukulungiswa kuncane: yenza lowo mzila owodwa utholakale ngaphakathi kwejele futhi ushiye konke okunye. I-bind mount yenodi eyodwa ngokuvamile yanele, futhi i-mknod nezinombolo ezijwayelekile ze-major ne-minor zenodi inikeza umphumela ofanayo kokufakwa lapho i-mount ingelona ikhetho. Ukwandisa i-sandbox, ukunikeza ukufinyelela kuyo yonke idivayisi yezinhlamvu noma ukucisha i-PrivateDevices kushintsha ukulungiswa okuqondiwe ngokuhlehla kwezokuphepha okungapheli.

I-daemon ye-entropy ayithathi isikhundla salokho kulungiswa. Amaphakethe afana ne-haveged ashintsha indlela iphuli le-kernel eliphakelwa ngayo; awakwazi ukwakha umzila inqubo ebanjiwe evunyelwe ukuwuvula. Ukufaka eyodwa kungase kwenza igrafu yezempilo ibukeke ingcono ngenkathi ucingo lokuvula lusahluleka. Gcina lezi zinkinga ezimbili zihlukene, ngaphandle kwalokho ukwehluleka okulandelayo kuzophinde kuthiwe kusesigabeni esingalungile.

Qinisekisa isijeneretha kanye nomhubhe ngokwahlukana

Ukuqalisa kabusha ukuhlola kuphela okusebenzisa futhi ukuhlelwa okufanayo, ifayela le-unit elifanayo nokuhlukaniswa okufanayo okudale ukwehluleka. Kuyisebenzise, bese ufunda imibhalo emisha yejenali esikhundleni sesampula esivela ekuqalisweni kwangaphambili.

sudo systemctl restart openvpn-server@lab
sudo journalctl -u openvpn-server@lab --since -5min --no-pager | grep -iE 'rand|entropy|Initialization Sequence'

Funa izinto ezimbili ezihlukene kuleso siphumo: umyalezo mayelana nomthombo ongahleliwe unyamalala, futhi umhubhe ufinyelela ingqophamlando yawo ejwayelekile yokuqalisa. Isijeneretha esisebenza futhi sisusa ukwehluleka kwendawo eyodwa futhi asisho lutho mayelana nobuwena besiphakamiso, imininingwane yokufinyelela noma umzila. Hlola lokho ngokuhlelwa komthengi okufanayo okwahluleka ngaphambili, ukuze umphumela uqhathaniseke hhayi nje ube ngcono.