{"id":55510,"date":"2020-01-22T00:00:00","date_gmt":"2020-01-21T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/linux-udalenie-pula-blokirovok-dev-random"},"modified":"2020-02-18T14:03:38","modified_gmt":"2020-02-18T11:03:38","slug":"linux-udalenie-pula-blokirovok-dev-random","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/linux-udalenie-pula-blokirovok-dev-random","title":{"rendered":"Linux: odstran\u011bn\u00ed bloka\u010dn\u00edho poolu \/dev\/random","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Jak je zn\u00e1mo, \/dev\/random, kryptograficky bezpe\u010dn\u00fd gener\u00e1tor pseudon\u00e1hodn\u00fdch \u010d\u00edsel (CSPRNG), m\u00e1 jeden nep\u0159\u00edjemn\u00fd probl\u00e9m \u2013 blokace. V tomto \u010dl\u00e1nku se popisuje, jak lze tento probl\u00e9m vy\u0159e\u0161it. <\/p>\n

B\u011bhem posledn\u00edch n\u011bkolika m\u011bs\u00edc\u016f byly prost\u0159edky pro generov\u00e1n\u00ed n\u00e1hodn\u00fdch \u010d\u00edsel v j\u00e1d\u0159e lehce p\u0159epracov\u00e1ny, ale probl\u00e9my v tomto subsyst\u00e9mu se \u0159e\u0161\u00ed del\u0161\u00ed dobu. \u010dasov\u00fd r\u00e1mec.<\/a><\/noindex>Nejnov\u011bj\u0161\u00ed zm\u011bny<\/a><\/noindex> byly provedeny s c\u00edlem zabr\u00e1nit dlouh\u00e9 blokaci syst\u00e9mov\u00e9ho vol\u00e1n\u00ed getrandom() p\u0159i spou\u0161t\u011bn\u00ed syst\u00e9mu, ale d\u016fvodem bylo chov\u00e1n\u00ed blokovac\u00edho n\u00e1hodn\u00e9ho poolu. Ned\u00e1vn\u00fd patch by m\u011bl tento pool odstranit, a o\u010dek\u00e1valo se, \u017ee se dostane do hlavn\u00edho j\u00e1dra. <\/p>\n

Andy Lutomirski publikoval t\u0159et\u00ed verzi patche koncem prosince. \u00dapravy p\u0159in\u00e1\u0161ej\u00ed \"dv\u011b hlavn\u00ed zm\u011bny v semantice n\u00e1hodn\u00fdch API Linuxu\".<\/i>Patch p\u0159id\u00e1v\u00e1 nov\u00fd p\u0159\u00edznak GRND_INSECURE k syst\u00e9mov\u00e9mu vol\u00e1n\u00ed getrandom() (i kdy\u017e se Lutomirski odvol\u00e1v\u00e1 na getentropy(), kter\u00e1 je implementov\u00e1na v glibc pomoc\u00ed getrandom() se stanoven\u00fdmi p\u0159\u00edznaky); tento p\u0159\u00edznak zp\u016fsob\u00ed, \u017ee vol\u00e1n\u00ed v\u017edy vr\u00e1t\u00ed po\u017eadovan\u00e9 mno\u017estv\u00ed dat, ale bez z\u00e1ruky, \u017ee jsou tato data n\u00e1hodn\u00e1. J\u00e1dro se zkr\u00e1tka bude sna\u017eit poskytnout nejlep\u0161\u00ed n\u00e1hodn\u00e1 data, kter\u00e1 m\u00e1 k dispozici v dan\u00e9m okam\u017eiku. \"Pravd\u011bpodobn\u011b nejlep\u0161\u00ed, co lze ud\u011blat, je nazvat to 'INSECURE'<\/i> (nebezpe\u010dn\u00e9), aby se zabr\u00e1nilo pou\u017e\u00edv\u00e1n\u00ed tohoto API pro v\u011bci, kter\u00e9 vy\u017eaduj\u00ed bezpe\u010dnost.\"<\/a><\/noindex><\/p>\n

Patche tak\u00e9 odstra\u0148uj\u00ed blokuj\u00edc\u00ed pool. V sou\u010dasnosti j\u00e1dro podporuje dva pooly n\u00e1hodn\u00fdch dat, z nich\u017e jeden odpov\u00edd\u00e1 \/dev\/random a druh\u00fd \/dev\/urandom, jak je pops\u00e1no v t\u00e9to \u010dl\u00e1nku<\/a><\/noindex> zpr\u00e1v\u011b z roku 2015. Blokuj\u00edc\u00ed pool je pool pro \/dev\/random; \u010dten\u00ed z tohoto za\u0159\u00edzen\u00ed bude blokov\u00e1no (m\u011bl by to \u0159\u00edkat jeho n\u00e1zev), dokud nebude shrom\u00e1\u017ed\u011bna \"dostate\u010dn\u00e1\" entropie z syst\u00e9mu pro uspokojen\u00ed po\u017eadavku. Dal\u0161\u00ed \u010dten\u00ed z tohoto souboru jsou tak\u00e9 blokov\u00e1na, pokud v poolu nen\u00ed dostatek entropie. <\/p>\n

Odstran\u011bn\u00ed bloka\u010dn\u00edho poolu znamen\u00e1, \u017ee \u010dten\u00ed z \/dev\/random se chov\u00e1 jako getrandom() s hodnotou flags rovnou nule (a p\u0159ev\u00e1d\u00ed p\u0159\u00edznak GRND_RANDOM na noop). Po inicializaci kryptografick\u00e9ho gener\u00e1toru n\u00e1hodn\u00fdch \u010d\u00edsel (CRNG) nebude \u010dten\u00ed z \/dev\/random a vol\u00e1n\u00ed getrandom(…,0) blokovat a vr\u00e1t\u00ed po\u017eadovan\u00e9 mno\u017estv\u00ed n\u00e1hodn\u00fdch dat.<\/p>\n

Lutomirski \u0159\u00edk\u00e1: \u201eMysl\u00edm, \u017ee blokovac\u00ed baz\u00e9n Linuxu se stal zastaral\u00fdm. CRNG Linuxu generuje v\u00fdstupy, kter\u00e9 jsou dostate\u010dn\u011b dobr\u00e9 na to, aby je bylo mo\u017en\u00e9 pou\u017e\u00edt i pro generaci kl\u00ed\u010d\u016f. Blokovac\u00ed baz\u00e9n ji\u017e nen\u00ed siln\u011bj\u0161\u00ed v \u017e\u00e1dn\u00e9m hmatateln\u00e9m ohledu a na jeho udr\u017eov\u00e1n\u00ed je pot\u0159eba spousta infrastruktury pochybn\u00e9 hodnoty.\u201c <\/i><\/p>\n

Zm\u011bny byly provedeny s c\u00edlem zajistit, aby st\u00e1vaj\u00edc\u00ed programy skute\u010dn\u011b neutrp\u011bly, a ve skute\u010dnosti dojde ke sn\u00ed\u017een\u00ed probl\u00e9m\u016f s dlouh\u00fdm \u010dek\u00e1n\u00edm na takov\u00e9 v\u011bci, jako je generov\u00e1n\u00ed kl\u00ed\u010d\u016f GnuPG.<\/p>\n

\u201eTyto s\u00e9rie by nem\u011bly naru\u0161it \u017e\u00e1dn\u00e9 st\u00e1vaj\u00edc\u00ed programy. \/dev\/urandom z\u016fst\u00e1v\u00e1 nezm\u011bn\u011bno. \/dev\/random je st\u00e1le blokov\u00e1no ihned po startu, ale je blokov\u00e1no m\u00e9n\u011b ne\u017e d\u0159\u00edve. getentropy() s existuj\u00edc\u00edmi parametry vr\u00e1t\u00ed v\u00fdsledek, kter\u00fd bude pro praktick\u00e9 \u00fa\u010dely tak vhodn\u00fd jako d\u0159\u00edve.\u201c<\/i> <\/p>\n

Lutomirski poznamenal, \u017ee st\u00e1le z\u016fst\u00e1v\u00e1 otev\u0159en\u00e1 ot\u00e1zka, zda by j\u00e1dro m\u011blo poskytovat takzvan\u00e1 \u201eskute\u010dn\u00e1 n\u00e1hodn\u00e1 \u010d\u00edsla\u201c, co\u017e do ur\u010dit\u00e9 m\u00edry m\u011bla d\u011blat blokuj\u00edc\u00ed j\u00e1dra. Vid\u00ed pro to pouze jeden d\u016fvod: \u201edodr\u017eov\u00e1n\u00ed st\u00e1tn\u00edch standard\u016f\u201c. Lutomirski navrhl, \u017ee pokud by j\u00e1dro m\u011blo to zajistit, m\u011blo by to b\u00fdt provedeno prost\u0159ednictv\u00edm zcela jin\u00e9ho rozhran\u00ed nebo by m\u011blo b\u00fdt p\u0159esunuto do u\u017eivatelsk\u00e9ho prostoru, co\u017e by mu umo\u017enilo extrahovat surov\u00e9 vzorky ud\u00e1lost\u00ed, kter\u00e9 mohou b\u00fdt pou\u017eity k vytvo\u0159en\u00ed takov\u00e9ho blokovac\u00edho baz\u00e9nu. <\/p>\n

Stephan M\u00fcller navrhl, \u017ee jeho sada z\u00e1plat<\/a><\/noindex> Gener\u00e1tor n\u00e1hodn\u00fdch \u010d\u00edsel Linux (LRNG) (v sou\u010dasnosti je k dispozici verze 26) m\u016f\u017ee b\u00fdt zp\u016fsobem, jak poskytovat prav\u00e1 n\u00e1hodn\u00e1 \u010d\u00edsla pro aplikace, kter\u00e9 je pot\u0159ebuj\u00ed. LRNG \"pln\u011b vyhovuje po\u017eadavk\u016fm 'Doporu\u010den\u00ed pro zdroje entropie pou\u017e\u00edvan\u00e9 k generov\u00e1n\u00ed n\u00e1hodn\u00fdch bit\u016f' SP800-90B\", co\u017e z n\u011bj \u010din\u00ed \u0159e\u0161en\u00ed probl\u00e9m\u016f st\u00e1tn\u00edch standard\u016f.
\nMatthew Garrett nam\u00edtal proti term\u00ednu \"prav\u00e9 n\u00e1hodn\u00e9 \u00fadaje\", upozor\u0148uj\u00edc\u00ed, \u017ee vybran\u00e1 za\u0159\u00edzen\u00ed mohou b\u00fdt v z\u00e1sad\u011b modelov\u00e1na dostate\u010dn\u011b p\u0159esn\u011b, aby byla p\u0159edv\u00eddateln\u00e1: \"nevyb\u00edr\u00e1me kvantov\u00e9 ud\u00e1losti\".<\/p>\n

M\u00fcller odpov\u011bd\u011bl, \u017ee tento term\u00edn poch\u00e1z\u00ed z n\u011bmeck\u00e9ho standardu AIS 31, kter\u00fd popisuje gener\u00e1tor n\u00e1hodn\u00fdch \u010d\u00edsel, jen\u017e vyd\u00e1v\u00e1 v\u00fdsledek \"stejnou rychlost\u00ed, jakou z\u00e1kladn\u00ed zdroj \u0161umu produkuje entropii\". <\/p>\n

Krom\u011b nesrovnalost\u00ed v terminologii p\u0159\u00edtomnost bloka\u010dn\u00edho poolu, jak je navr\u017eeno v patchech LRNG, jednodu\u0161e povede k r\u016fzn\u00fdm probl\u00e9m\u016fm, alespo\u0148 pokud bude dostupn\u00fd bez privilegi\u00ed. <\/p>\n

Jak \u0159ekl Lutomirsk\u00fd: \"To ne\u0159e\u0161\u00ed probl\u00e9m. Pokud dva r\u016fzn\u00ed u\u017eivatel\u00e9 spust\u00ed hloup\u00e9 programy, jako je gnupg, prost\u011b se vy\u010derpaj\u00ed navz\u00e1jem. Vid\u00edm, \u017ee v sou\u010dasnosti existuj\u00ed dva hlavn\u00ed probl\u00e9my s \/dev\/random: je n\u00e1chyln\u00fd k DoS (tj. vy\u010derp\u00e1n\u00ed zdroj\u016f, \u0161kodliv\u00e9mu vlivu nebo n\u011b\u010demu podobn\u00e9mu) a proto\u017ee pro jeho pou\u017eit\u00ed nejsou pot\u0159eba \u017e\u00e1dn\u00e1 privilegovan\u00e1 pr\u00e1va, tak\u00e9 n\u00e1chyln\u00fd k zneu\u017eit\u00edm. Gnupg je \u0161patn\u011b, je to \u00fapln\u00fd kolaps. Pokud p\u0159id\u00e1me nov\u00e9 nepriviligovan\u00e9 rozhran\u00ed, kter\u00e9 budou pou\u017e\u00edvat gnupg a podobn\u00e9 programy, op\u011bt prohrajeme.\"<\/i> <\/p>\n

M\u00fcller poznamenal, \u017ee p\u0159id\u00e1n\u00ed getrandom() nyn\u00ed umo\u017en\u00ed GnuPG pou\u017e\u00edt toto rozhran\u00ed, proto\u017ee zajist\u00ed pot\u0159ebnou z\u00e1ruku, \u017ee pool byl inicializov\u00e1n. Na z\u00e1klad\u011b diskus\u00ed s v\u00fdvoj\u00e1\u0159em GnuPG Wernerem Kochem se M\u00fcller domn\u00edv\u00e1, \u017ee z\u00e1ruka je jedin\u00fdm d\u016fvodem, pro\u010d GnuPG v sou\u010dasnosti \u010dte p\u0159\u00edmo z \/dev\/random. Ale pokud existuje nepriviligovan\u00e9 rozhran\u00ed, kter\u00e9 je n\u00e1chyln\u00e9 k odm\u00edtnut\u00ed slu\u017eby (jak je tomu dnes s \/dev\/random), pak podle Lutomirsk\u00e9ho bude nespr\u00e1vn\u011b pou\u017e\u00edv\u00e1no n\u011bkter\u00fdmi aplikacemi. <\/p>\n

Teodor Cao (Theodore Yue Tak Ts’o), v\u00fdvoj\u00e1\u0159 subsyst\u00e9mu n\u00e1hodn\u00fdch \u010d\u00edsel Linux, se z\u0159ejm\u011b zm\u011bnil ve sv\u00e9m n\u00e1zoru na pot\u0159ebu blokuj\u00edc\u00edho poolu. \u0158ekl, \u017ee odstran\u011bn\u00ed tohoto poolu \u00fa\u010dinn\u011b zbav\u00ed my\u0161lenky, \u017ee Linux m\u00e1 skute\u010dn\u00fd gener\u00e1tor n\u00e1hodn\u00fdch \u010d\u00edsel (TRNG): \u201eto nen\u00ed nesmysl, proto\u017ee to je p\u0159esn\u011b to, co v\u017edy d\u011blali *BSD\".<\/i><\/p>\n

Znepokojuje ho tak\u00e9 to, \u017ee poskytov\u00e1n\u00ed mechanismu TRNG by bylo pouze n\u00e1vnadou pro v\u00fdvoj\u00e1\u0159e aplikac\u00ed, a domn\u00edv\u00e1 se, \u017ee skute\u010dn\u011b, vzhledem k r\u016fzn\u00fdm typ\u016fm hardwaru podporovan\u00e9ho Linuxem, nen\u00ed mo\u017en\u00e9 zaru\u010dit TRNG v j\u00e1d\u0159e. Tuto problematiku nevy\u0159e\u0161\u00ed ani mo\u017enost pr\u00e1ce s hardwarem pouze na z\u00e1klad\u011b root privilegii: \u201eV\u00fdvoj\u00e1\u0159i aplikac\u00ed uv\u00e1d\u011bj\u00ed, \u017ee jejich aplikace by m\u011bla b\u00fdt z bezpe\u010dnostn\u00edch d\u016fvod\u016f nastavena jako root, proto\u017ee pouze tak m\u016f\u017eete z\u00edskat p\u0159\u00edstup k \u201eopravdu dobr\u00fdm\u201c n\u00e1hodn\u00fdm \u010d\u00edsl\u016fm\".<\/i><\/p>\n

M\u00fcller se zeptal, zda Cao neodstoupil od realizace blokuj\u00edc\u00edho poolu, kter\u00fd s\u00e1m d\u00e1vno navrhl. Cao odpov\u011bd\u011bl, \u017ee pl\u00e1nuje vz\u00edt patch od Lutomirsk\u00e9ho a aktivn\u011b se ohrazuje proti p\u0159id\u00e1n\u00ed blokuj\u00edc\u00edho rozhran\u00ed zp\u011bt do j\u00e1dra. <\/p>\n

\u201eJ\u00e1dro nem\u016f\u017ee poskytnout \u017e\u00e1dn\u00e9 z\u00e1ruky ohledn\u011b toho, zda byl noise source spr\u00e1vn\u011b charakterizov\u00e1n. Jedin\u00e9, co m\u016f\u017ee v\u00fdvoj\u00e1\u0159 GPG nebo OpenSSL z\u00edskat, je matn\u00fd pocit, \u017ee TRUERANDOM je \u201elep\u0161\u00ed\u201c, a proto\u017ee cht\u011bj\u00ed v\u011bt\u0161\u00ed bezpe\u010dnost, nepochybn\u011b se ho pokus\u00ed pou\u017e\u00edt. V ur\u010dit\u00e9m okam\u017eiku bude zablokov\u00e1n, a kdy\u017e n\u011bjak\u00fd jin\u00fd chytr\u00fd u\u017eivatel (mo\u017en\u00e1 odborn\u00edk na vyd\u00e1n\u00ed distribuce) jej vlo\u017e\u00ed do init skriptu a syst\u00e9my p\u0159estanou fungovat, u\u017eivatel\u016fm nezbude nic jin\u00e9ho, ne\u017e si st\u011b\u017eovat samotn\u00e9mu Linusu Torvaldsovi.\u201c<\/i> <\/p>\n

Cao tak\u00e9 podporuje, aby kryptografov\u00e9 a ti, kdo skute\u010dn\u011b pot\u0159ebuj\u00ed TRNG, m\u011bli mo\u017enost sb\u00edrat svoji vlastn\u00ed entropii v u\u017eivatelsk\u00e9m prostoru a pou\u017e\u00edvat ji podle sv\u00e9ho uv\u00e1\u017een\u00ed. \u0158\u00edk\u00e1, \u017ee sb\u011br entropie nen\u00ed proces, kter\u00fd m\u016f\u017ee j\u00e1dro prov\u00e1d\u011bt na ve\u0161ker\u00e9m podporovan\u00e9m hardwaru, nav\u00edc samo j\u00e1dro nem\u016f\u017ee vyhodnotit mno\u017estv\u00ed entropie poskytovan\u00e9 r\u016fzn\u00fdmi zdroji. <\/p>\n

\u201eJ\u00e1dro by nem\u011blo m\u00edchat r\u016fzn\u00e9 zdroje \u0161umu dohromady a rozhodn\u011b by se nem\u011blo pokou\u0161et tvrdit, kolik bit\u016f entropie z\u00edsk\u00e1v\u00e1, kdy\u017e se pokou\u0161\u00ed hr\u00e1t n\u011bjakou 'trhnutou entropickou hru' na jednoduch\u00e9, a\u017e nehezk\u00e9 architektu\u0159e CPU pro u\u017eivatelsk\u00e9 p\u0159\u00edpady IOT\/Embedded, kdy\u017e je v\u0161e nesynchronizov\u00e1no s jedn\u00edm master-gener\u00e1torem, a kdy\u017e neexistuje \u017e\u00e1dn\u00fd p\u0159\u00edkaz CPU pro p\u0159e\u0159azen\u00ed nebo p\u0159ejmenov\u00e1n\u00ed registru atd.\u201c<\/p>\n

\u201eM\u016f\u017eeme mluvit o poskytov\u00e1n\u00ed n\u00e1stroj\u016f, kter\u00e9 se pokou\u0161ej\u00ed prov\u00e1d\u011bt tyto v\u00fdpo\u010dty, ale takov\u00e9 v\u011bci by m\u011bly b\u00fdt prov\u00e1d\u011bny na hardwaru ka\u017ed\u00e9ho u\u017eivatele, co\u017e je pro v\u011bt\u0161inu u\u017eivatel\u016f distribuce zkr\u00e1tka neprakti\u010dn\u00e9. Pokud je to v\u0161ak ur\u010deno pouze pro kryptografy, a\u0165 je to provedeno v jejich u\u017eivatelsk\u00e9m prostoru. A nenechme se zjednodu\u0161ovat GPG, OpenSSL atd., aby v\u0161ichni \u0159\u00edkali: 'chceme 'skute\u010dnou n\u00e1hodnost' a nechceme m\u00e9n\u011b'. M\u016f\u017eeme mluvit o tom, jak poskytujeme rozhran\u00ed kryptograf\u016fm, aby mohli z\u00edskat pot\u0159ebn\u00e9 informace d\u00edky p\u0159\u00edstupu k prim\u00e1rn\u00edm zdroj\u016fm \u0161umu, odd\u011blen\u00fdm a pojmenovan\u00fdm, a mo\u017en\u00e1, \u017ee n\u011bjak\u00fdm zp\u016fsobem se zdroj \u0161umu bude moci autentizovat v knihovn\u011b nebo aplikaci u\u017eivatelsk\u00e9ho prostoru.\u201c<\/i><\/p>\n

Prob\u011bhla mal\u00e1 diskuse o tom, jak by takov\u00e9 rozhran\u00ed mohlo vypadat, nebo\u0165 nap\u0159\u00edklad n\u011bkter\u00e9 ud\u00e1losti mohou m\u00edt d\u016fsledky z hlediska bezpe\u010dnosti. Cao poznamenal, \u017ee k\u00f3dy pro skenov\u00e1n\u00ed kl\u00e1vesnice (tj. stisknut\u00ed kl\u00e1ves) se m\u00edchaj\u00ed do poolu jako sou\u010d\u00e1st shroma\u017e\u010fov\u00e1n\u00ed entropie: \u201eP\u0159esunout to do u\u017eivatelsk\u00e9ho prostoru, i p\u0159es privilegovan\u00fd syst\u00e9mov\u00fd vol\u00e1n\u00ed, by bylo minim\u00e1ln\u011b nerozv\u00e1\u017en\u00e9\u201c. Je velmi pravd\u011bpodobn\u00e9, \u017ee i jin\u00e9 \u010dasov\u00e1n\u00ed ud\u00e1lost\u00ed mohou vytvo\u0159it jak\u00fdsi \u00fanik informac\u00ed p\u0159es bo\u010dn\u00ed kan\u00e1ly. <\/p>\n

Tak vznik\u00e1 pocit, \u017ee dlouhodob\u00fd probl\u00e9m subsyst\u00e9mu n\u00e1hodn\u00fdch \u010d\u00edsel Linuxu sm\u011b\u0159uje k \u0159e\u0161en\u00ed. Zm\u011bny, kter\u00e9 subsyst\u00e9m n\u00e1hodn\u00fdch \u010d\u00edsel v posledn\u00ed dob\u011b prod\u011blal, ve skute\u010dnosti vedly pouze k probl\u00e9m\u016fm DoS b\u011bhem jeho pou\u017e\u00edv\u00e1n\u00ed. Nyn\u00ed se v\u0161ak objevily \u00fa\u010dinn\u00e9 zp\u016fsoby, jak z\u00edskat nejlep\u0161\u00ed n\u00e1hodn\u00e1 \u010d\u00edsla, kter\u00e1 j\u00e1dro m\u016f\u017ee poskytnout. Pokud je TRNG i nad\u00e1le \u017e\u00e1douc\u00ed pro Linux, bude nutn\u00e9 tento nedostatek v budoucnu odstranit, ale pravd\u011bpodobn\u011b se to nebude d\u00edt uvnit\u0159 samotn\u00e9ho j\u00e1dra. <\/p>\n

Mal\u00e1 reklama \ud83d\ude42<\/h3>\n

\nD\u011bkujeme, \u017ee s n\u00e1mi z\u016fst\u00e1v\u00e1te. L\u00edb\u00ed se v\u00e1m na\u0161e \u010dl\u00e1nky? Chcete vid\u011bt v\u00edce zaj\u00edmav\u00fdch materi\u00e1l\u016f? Podpo\u0159te n\u00e1s objedn\u00e1vkou nebo doporu\u010den\u00edm zn\u00e1m\u00fdm, cloudov\u00e9 VPS pro v\u00fdvoj\u00e1\u0159e od 4,99 $<\/a><\/noindex>, unik\u00e1tn\u00ed alternativa entry-level server\u016f, kterou jsme pro v\u00e1s vymysleli:<\/b> V\u0161echny pravdy o VPS (KVM) E5-2697 v3 (6 jader) 10GB DDR4 480GB SSD 1Gbps od 19 $ nebo jak spr\u00e1vn\u011b rozd\u011blit server?<\/a><\/noindex> (k dispozici varianty s RAID1 a RAID10, a\u017e 24 jader a a\u017e 40GB DDR4).<\/p>\n

Dell R730xd je dvakr\u00e1t levn\u011bj\u0161\u00ed v datov\u00e9m centru Equinix Tier IV v Amsterdamu?<\/b> Jen u n\u00e1s 2 x Intel TetraDeca-Core Xeon 2x E5-2697v3 2.6GHz 14C 64GB DDR4 4x960GB SSD 1Gbps 100 TB od 199 $<\/a><\/noindex> v Nizozemsku! Dell R420 \u2014 2x E5-2430 2.2GHz 6C 128GB DDR3 2x960GB SSD 1Gbps 100TB \u2014 od 99 $!<\/b><\/b> \u010ct\u011bte o tom Jak postavit infrastrukturu podnikov\u00e9 t\u0159\u00eddy s pou\u017eit\u00edm server\u016f Dell R730xd E5-2650 v4 v hodnot\u011b 9000 eur za pakatel?<\/a><\/noindex>
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u0430\u043a \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, \u0443 \/dev\/random, \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438 \u0441\u0442\u043e\u0439\u043a\u043e\u0433\u043e \u0433\u0435\u043d\u0435\u0440\u0430\u0442\u043e\u0440\u0430 \u043f\u0441\u0435\u0432\u0434\u043e\u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0445 \u0447\u0438\u0441\u0435\u043b (CSPRNG), \u0438\u043c\u0435\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0430 \u043d\u0435\u043f\u0440\u0438\u044f\u0442\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u2013 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438. \u0412 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f, \u043a\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043c\u043e\u0436\u043d\u043e \u0435\u0435 \u0440\u0435\u0448\u0438\u0442\u044c. \u0417\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0445 \u0447\u0438\u0441\u0435\u043b \u0432 \u044f\u0434\u0440\u0435 \u0431\u044b\u043b\u0438 \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u044b, \u043d\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 \u044d\u0442\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0440\u0435\u0448\u0430\u043b\u0438\u0441\u044c \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u0431\u043e\u043b\u0435\u0435 \u0448\u0438\u0440\u043e\u043a\u0438\u0445 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0440\u0430\u043c\u043e\u043a. \u0421\u0430\u043c\u044b\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0431\u044b\u043b\u0438 \u0441\u0434\u0435\u043b\u0430\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-55510","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Linux: odstran\u011bn\u00ed z\u00e1mkov\u00e9ho baz\u00e9nu \/dev\/random | ProHoster","description":"Jak je zn\u00e1mo, \/dev\/random, kryptograficky bezpe\u010dn\u00fd gener\u00e1tor pseudon\u00e1hodn\u00fdch \u010d\u00edsel (CSPRNG), m\u00e1 jeden nep\u0159\u00edjemn\u00fd probl\u00e9m \u2013 blokace. V tomto \u010dl\u00e1nku se popisuje, jak lze tento probl\u00e9m vy\u0159e\u0161it.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/linux-udalenie-pula-blokirovok-dev-random","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Linux: \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043f\u0443\u043b\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043e\u043a \/dev\/random | ProHoster","og:description":"\u041a\u0430\u043a \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, \u0443 \/dev\/random, \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438 \u0441\u0442\u043e\u0439\u043a\u043e\u0433\u043e \u0433\u0435\u043d\u0435\u0440\u0430\u0442\u043e\u0440\u0430 \u043f\u0441\u0435\u0432\u0434\u043e\u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0445 \u0447\u0438\u0441\u0435\u043b (CSPRNG), \u0438\u043c\u0435\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0430 \u043d\u0435\u043f\u0440\u0438\u044f\u0442\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u2013 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438. \u0412 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f, \u043a\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043c\u043e\u0436\u043d\u043e \u0435\u0435 \u0440\u0435\u0448\u0438\u0442\u044c.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/linux-udalenie-pula-blokirovok-dev-random","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-21T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55510","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:43:30","updated":"2022-10-02 22:01:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/55510","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=55510"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/55510\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=55510"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=55510"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=55510"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}