{"id":55510,"date":"2020-01-22T00:00:00","date_gmt":"2020-01-21T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/linux-udalenie-pula-blokirovok-dev-random"},"modified":"2020-02-18T14:03:38","modified_gmt":"2020-02-18T11:03:38","slug":"linux-udalenie-pula-blokirovok-dev-random","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/linux-udalenie-pula-blokirovok-dev-random","title":{"rendered":"Linux: odstr\u00e1nenie poolu uzamknut\u00ed \/dev\/random","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ako je zn\u00e1me, \/dev\/random, kryptograficky bezpe\u010dn\u00fd gener\u00e1tor pseudon\u00e1hodn\u00fdch \u010d\u00edsel (CSPRNG), m\u00e1 jednu nepr\u00edjemn\u00fa vlastnos\u0165 \u2013 blokovanie. V tomto \u010dl\u00e1nku sa hovor\u00ed o tom, ako tento probl\u00e9m vyrie\u0161i\u0165. <\/p>\n

V posledn\u00fdch nieko\u013ek\u00fdch mesiacoch do\u0161lo k men\u0161ej \u00faprave prostriedkov na generovanie n\u00e1hodn\u00fdch \u010d\u00edsel v jadre, av\u0161ak probl\u00e9my v tejto subsyst\u00e9me sa rie\u0161ili po dlh\u0161iu dobu. Samotn\u00fd \u010dasov\u00fd r\u00e1mec<\/a><\/noindex>. Najnov\u0161ie zmien<\/a><\/noindex> boli uroben\u00e9 s cie\u013eom zabr\u00e1ni\u0165 dlhodob\u00e9mu blokovaniu syst\u00e9mov\u00e9ho volania getrandom() pri spusten\u00ed syst\u00e9mu, av\u0161ak podkladov\u00fdm d\u00f4vodom bol sp\u00f4sob blokovania n\u00e1hodn\u00e9ho poolu. Ned\u00e1vny patch by mal tento pool odstr\u00e1ni\u0165, tak\u017ee sa o\u010dak\u00e1va, \u017ee sa dostane do hlavn\u00e9ho jadra. <\/p>\n

Andy Lutomirski zverejnil tretiu verziu patchu koncom decembra. Prin\u00e1\u0161a \u201edve z\u00e1kladn\u00e9 s\u00e9mantick\u00e9 zmeny v n\u00e1hodn\u00fdch API Linuxu\u201c<\/i>. Patch prid\u00e1va nov\u00fd flag GRND_INSECURE k syst\u00e9mov\u00e9mu volaniu getrandom() (hoci Lutomirski sa na\u0148 odvol\u00e1va ako na getentropy(), ktor\u00e9 je implementovan\u00e9 v glibc pomocou getrandom() s pevn\u00fdmi flagmi); tento flag sp\u00f4sob\u00ed, \u017ee volanie v\u017edy vr\u00e1ti po\u017eadovan\u00fd objem d\u00e1t, ale bez z\u00e1ruky, \u017ee tieto d\u00e1ta s\u00fa n\u00e1hodn\u00e9. Jadro sa jednoducho sna\u017e\u00ed poskytn\u00fa\u0165 \u010do najlep\u0161ie n\u00e1hodn\u00e9 d\u00e1ta, ktor\u00e9 m\u00e1 v danom okamihu. \u201eJe pravdepodobne najlep\u0161ie nazva\u0165 to \u201eINSECURE\u201c<\/i> (nebezpe\u010dn\u00fdm), aby sa zabr\u00e1nilo pou\u017e\u00edvaniu tohto API na veci, ktor\u00e9 vy\u017eaduj\u00fa bezpe\u010dnos\u0165.\u201c<\/a><\/noindex><\/p>\n

Patche tie\u017e odstra\u0148uj\u00fa blokuj\u00faci pool. V s\u00fa\u010dasnosti jadro podporuje dva pooly n\u00e1hodn\u00fdch d\u00e1t, z ktor\u00fdch jeden zodpoved\u00e1 \/dev\/random a druh\u00fd \/dev\/urandom, ako je pop\u00edsan\u00e9 v tejto \u010dl\u00e1nku<\/a><\/noindex> spr\u00e1ve z roku 2015. Blokuj\u00faci pool je pool pre \/dev\/random; \u010d\u00edtanie z tohto zariadenia bude blokovan\u00e9 (mysl\u00ed sa jeho n\u00e1zov) dovtedy, k\u00fdm nebude zo syst\u00e9mu zhroma\u017eden\u00e1 \u201edostato\u010dn\u00e1\u201c entropia na splnenie po\u017eiadavky. \u010eal\u0161ie \u010d\u00edtania z tohto s\u00faboru s\u00fa tie\u017e blokovan\u00e9, ak je v poole nedostatok entropy. <\/p>\n

Odstr\u00e1nenie bloka\u010dn\u00e9ho poolu znamen\u00e1, \u017ee \u010d\u00edtanie z \/dev\/random sa spr\u00e1va ako getrandom() s hodnotou flags nastavenou na nulu (a prev\u00e1dza flag GRND_RANDOM na noop). Po inicializ\u00e1cii kryptografick\u00e9ho gener\u00e1tora n\u00e1hodn\u00fdch \u010d\u00edsel (CRNG) \u010d\u00edtanie z \/dev\/random a volania getrandom(…,0) neved\u00fa k zablokovaniu a vr\u00e1tia po\u017eadovan\u00e9 mno\u017estvo n\u00e1hodn\u00fdch d\u00e1t.<\/p>\n

Lutomirsk\u00fd hovor\u00ed: \u201eMysl\u00edm, \u017ee blokovac\u00ed pool Linuxu sa stal pre\u017eitkom. CRNG Linuxu generuje v\u00fdstupy, ktor\u00e9 s\u00fa dostato\u010dne dobr\u00e9 na to, aby sa pou\u017eili aj na generovanie k\u013e\u00fa\u010dov. Blokovac\u00ed pool u\u017e nie je silnej\u0161\u00ed v \u017eiadnom hmatate\u013enom zmysle a na jeho udr\u017eiavanie je potrebn\u00e9 ve\u013ea infra\u0161trukt\u00fary pochybnej hodnoty.\u201c <\/i><\/p>\n

Zmeny boli vykonan\u00e9 s oh\u013eadom na to, aby existuj\u00face programy naozaj neboli postihnut\u00e9, a v skuto\u010dnosti bude probl\u00e9my s dlh\u00fdm \u010dakan\u00edm na tak\u00e9 veci, ako je generovanie k\u013e\u00fa\u010dov GnuPG, menej.<\/p>\n

\u201eTieto s\u00e9rie by nemali naru\u0161i\u0165 \u017eiadne existuj\u00face programy. \/dev\/urandom zost\u00e1va nezmenen\u00e9. \/dev\/random sa st\u00e1le blokuje hne\u010f po spusten\u00ed, ale blokuje sa menej ako predt\u00fdm. getentropy() s existuj\u00facimi flagmi vr\u00e1ti v\u00fdsledok, ktor\u00fd bude pre praktick\u00e9 \u00fa\u010dely rovnako vhodn\u00fd ako predt\u00fdm.\u201c<\/i> <\/p>\n

Lutomirsk\u00fd poznamenal, \u017ee st\u00e1le zost\u00e1va otvorenou ot\u00e1zkou, \u010di by jadro malo poskytova\u0165 takzvan\u00e9 \u201eskuto\u010dn\u00e9 n\u00e1hodn\u00e9 \u010d\u00edsla\u201c, \u010do malo do ur\u010ditej miery robi\u0165 blokuj\u00face jadro. Vid\u00ed pre to iba jeden d\u00f4vod: \u201edodr\u017eiavanie \u0161t\u00e1tnych noriem\u201c. Lutomirsk\u00fd nazna\u010dil, \u017ee ak by to jadro malo zabezpe\u010di\u0165, malo by to by\u0165 uroben\u00e9 prostredn\u00edctvom \u00faplne in\u00e9ho rozhrania alebo by to malo by\u0165 presunut\u00e9 do u\u017e\u00edvate\u013esk\u00e9ho priestoru, ktor\u00fd by mu umo\u017enil extrahova\u0165 surov\u00e9 vzorky udalost\u00ed, ktor\u00e9 by sa mohli pou\u017ei\u0165 na vytvorenie tak\u00e9ho blokovacieho poolu. <\/p>\n

Stephan M\u00fcller navrhol, \u017ee jeho s\u00fabor patche<\/a><\/noindex> Pre gener\u00e1tor n\u00e1hodn\u00fdch \u010d\u00edsel Linux (LRNG) (aktu\u00e1lne vydanie 26) m\u00f4\u017ee by\u0165 sp\u00f4sobom, ako poskytn\u00fa\u0165 prav\u00e9 n\u00e1hodn\u00e9 \u010d\u00edsla pre aplik\u00e1cie, ktor\u00e9 ich potrebuj\u00fa. LRNG \"\u00faplne sp\u013a\u0148a po\u017eiadavky \"Odpor\u00fa\u010dan\u00ed pre zdroje entropie pou\u017e\u00edvan\u00e9 na generovanie n\u00e1hodn\u00fdch bitov\" SP800-90B\", \u010do ho rob\u00ed rie\u0161en\u00edm probl\u00e9mu \u0161t\u00e1tnych \u0161tandardov.
\nMatthew Garrett namietal proti term\u00ednu \"prav\u00e9 n\u00e1hodn\u00e9 \u00fadaje\", poznamen\u00e1vaj\u00fac, \u017ee vyberan\u00e9 zariadenia m\u00f4\u017eu by\u0165 v z\u00e1sade modelovan\u00e9 dostato\u010dne presne, aby sa stali predv\u00eddate\u013en\u00fdmi: \"tu nevyber\u00e1me kvantov\u00e9 udalosti.\"<\/p>\n

M\u00fcller odpovedal, \u017ee tento term\u00edn poch\u00e1dza z nemeck\u00e9ho \u0161tandardu AIS 31, ktor\u00fd popisuje gener\u00e1tor n\u00e1hodn\u00fdch \u010d\u00edsel, ktor\u00fd vyd\u00e1va v\u00fdsledok \"rovnakou r\u00fdchlos\u0165ou, akou z\u00e1kladn\u00fd zdroj \u0161umu produkuje entropiu.\" <\/p>\n

Okrem nejednozna\u010dnost\u00ed terminol\u00f3gie, existencia zamykacieho poolu, ako sa navrhuje v patchoch LRNG, jednoducho vytvor\u00ed r\u00f4zne probl\u00e9my, aspo\u0148 ak je dostupn\u00fd bez privil\u00e9gi\u00ed. <\/p>\n

Ako povedal Lutomirsky: \"To nerie\u0161i probl\u00e9m. Ak dvaja r\u00f4zni u\u017e\u00edvatelia spustia hl\u00fape programy, ako gnupg, jednoducho si navz\u00e1jom vy\u010derpaj\u00fa zdroje. Vid\u00edm, \u017ee v s\u00fa\u010dasnosti existuj\u00fa dva hlavn\u00e9 probl\u00e9my s \/dev\/random: m\u00e1 tendenciu k DoS (t. j. vy\u010derpaniu zdrojov, \u0161kodliv\u00e9mu ovplyvneniu alebo nie\u010domu podobn\u00e9mu), a preto\u017ee nie s\u00fa potrebn\u00e9 \u017eiadne privil\u00e9gi\u00e1 na jeho pou\u017eitie, tie\u017e sa \u010dasto zneu\u017e\u00edva. Gnupg - to je nespr\u00e1vne, to je \u00fapln\u00fd kolaps. Ak prid\u00e1me nov\u00e9 nepriviligovan\u00e9 rozhranie, ktor\u00e9 bud\u00fa pou\u017e\u00edva\u0165 gnupg a podobn\u00e9 programy, znovu prehr\u00e1me.\"<\/i> <\/p>\n

M\u00fcller poznamenal, \u017ee pridanie getrandom() teraz umo\u017en\u00ed GnuPG pou\u017e\u00edva\u0165 toto rozhranie, preto\u017ee poskytne potrebn\u00fa z\u00e1ruku, \u017ee pool bol inicializovan\u00fd. Na z\u00e1klade diskusi\u00ed s v\u00fdvoj\u00e1rom GnuPG Wernerom Kochom, M\u00fcller pova\u017euje z\u00e1ruku za jedin\u00fd d\u00f4vod, pre\u010do GnuPG v s\u00fa\u010dasnosti \u010d\u00edta priamo z \/dev\/random. Ale ak existuje nepriviligovan\u00e9 rozhranie, ktor\u00e9 je n\u00e1chyln\u00e9 na \u00fatoky Denial-of-Service (ako dnes \/dev\/random), potom pod\u013ea Lutomirsk\u00e9ho bude nespr\u00e1vne pou\u017e\u00edvan\u00e9 niektor\u00fdmi aplik\u00e1ciami. <\/p>\n

Teodor Cao (Theodore Yue Tak Ts’o), v\u00fdvoj\u00e1r subsyst\u00e9mu n\u00e1hodn\u00fdch \u010d\u00edsel Linux, sa zjavne zmenil v n\u00e1zore na potrebu blokuj\u00faceho poolu. Povedal, \u017ee odstr\u00e1nenie tohto poolu umo\u017en\u00ed efekt\u00edvne zbavi\u0165 sa predstavy, \u017ee Linux m\u00e1 skuto\u010dn\u00fd gener\u00e1tor n\u00e1hodn\u00fdch \u010d\u00edsel (TRNG): \u201eToto nie je nezmysel, preto\u017ee presne to, \u010do v\u017edy robili *BSD.<\/i><\/p>\n

Je tie\u017e znepokojen\u00fd t\u00fdm, \u017ee poskytnutie mechanizmu TRNG bude iba n\u00e1vnadou pre v\u00fdvoj\u00e1rov aplik\u00e1ci\u00ed a pova\u017euje za nemo\u017en\u00e9 zaru\u010di\u0165 TRNG v jadre, ke\u010f zoh\u013eadn\u00edme r\u00f4zne typy hardv\u00e9ru podporovan\u00fdch Linuxom. Probl\u00e9m nerie\u0161i ani mo\u017enos\u0165 fungovania s hardv\u00e9rom len na z\u00e1klade root-privil\u00e9gi\u00ed: \u201eV\u00fdvoj\u00e1ri aplik\u00e1ci\u00ed odpor\u00fa\u010daj\u00fa, aby bolo ich aplik\u00e1cia z bezpe\u010dnostn\u00fdch d\u00f4vodov nain\u0161talovan\u00e1 ako root, len tak m\u00f4\u017eete z\u00edska\u0165 pr\u00edstup k 'naozaj dobr\u00fdm' n\u00e1hodn\u00fdm \u010d\u00edslam.\"<\/i><\/p>\n

M\u00fcller sa op\u00fdtal, \u010di sa Cao vzdal realiz\u00e1cie blokovacieho poolu, ktor\u00fd s\u00e1m d\u00e1vno navrhol. Cao odpovedal, \u017ee pl\u00e1nuje prevzia\u0165 patche Lutomirsk\u00e9ho a akt\u00edvne sa oponuje pridaniu blokovacieho rozhrania sp\u00e4\u0165 do jadra. <\/p>\n

\u201eJadro nem\u00f4\u017ee poskytn\u00fa\u0165 \u017eiadne z\u00e1ruky t\u00fdkaj\u00face sa toho, \u010di bol noise source riadne charakterizovan\u00fd. Jedin\u00e9, \u010do m\u00f4\u017ee v\u00fdvoj\u00e1r GPG alebo OpenSSL z\u00edska\u0165, je neur\u010dit\u00fd pocit, \u017ee TRUERANDOM je \u201elep\u0161\u00ed\u201c, a preto, ak chc\u00fa v\u00e4\u010d\u0161iu bezpe\u010dnos\u0165, ur\u010dite sa pok\u00fasia to vyu\u017ei\u0165. V ur\u010ditej chv\u00edli sa to zablokuje, a ke\u010f nejak\u00fd in\u00fd zdatn\u00fd pou\u017e\u00edvate\u013e (mo\u017eno \u0161pecialista na vydanie distrib\u00facie) to vlo\u017e\u00ed do init skriptu a syst\u00e9my prestan\u00fa fungova\u0165, pou\u017e\u00edvate\u013eom ostane iba s\u0165a\u017eova\u0165 sa samotn\u00e9mu Linusovi Torvaldsovi.\"<\/i> <\/p>\n

Cao sa taktie\u017e vyslovil za to, aby sa kryptografom a t\u00fdm, ktor\u00ed skuto\u010dne potrebuj\u00fa TRNG, poskytol sp\u00f4sob, ako zbiera\u0165 svoj vlastn\u00fd entropiu v u\u017e\u00edvate\u013eskom priestore na vlastn\u00e9 vyu\u017eitie. Hovor\u00ed, \u017ee zbieranie entropie nie je proces, ktor\u00fd by mohlo vykon\u00e1va\u0165 jadro na v\u0161etk\u00fdch podporovan\u00fdch hardv\u00e9rov\u00fdch prostriedkoch, navy\u0161e samo jadro nem\u00f4\u017ee pos\u00fadi\u0165 mno\u017estvo entropie, ktor\u00e9 poskytuj\u00fa r\u00f4zne zdroje. <\/p>\n

\u201eJadro by nemalo mie\u0161a\u0165 r\u00f4zne noise source a samozrejme by sa nemalo pok\u00fa\u0161a\u0165 tvrdi\u0165, \u017ee vie, ko\u013eko bitov entropie z\u00edskava, ke\u010f sa sna\u017e\u00ed hra\u0165 nejak\u00fa 'trhnut\u00fa hru entropie' na prekliato jednoduch\u00fdch architekt\u00farach CPU pre pou\u017e\u00edvate\u013esk\u00e9 pr\u00edpady IOT\/Embedded, ke\u010f je v\u0161etko nesynchronizovan\u00e9 s jedin\u00fdm master-gener\u00e1torom, ke\u010f neexistuje \u017eiadna in\u0161trukcia CPU na preusporiadanie alebo premenovanie registra a podobne.\u201c<\/p>\n

\u201eM\u00f4\u017eeme hovori\u0165 o poskytovan\u00ed n\u00e1strojov, ktor\u00e9 sa pok\u00fa\u0161aj\u00fa tieto v\u00fdpo\u010dty vykona\u0165, ale tak\u00e9to veci by sa mali vykon\u00e1va\u0165 na zariadeniach ka\u017ed\u00e9ho pou\u017e\u00edvate\u013ea, \u010do je pre v\u00e4\u010d\u0161inu pou\u017e\u00edvate\u013eov distrib\u00facie jednoducho nepraktick\u00e9. Ak je to v\u0161ak ur\u010den\u00e9 len pre kryptografov, tak nech sa to deje v ich pou\u017e\u00edvate\u013eskom Priestore. A nenechajme sa zmias\u0165 GPG, OpenSSL a podobne, aby v\u0161etci hovorili: 'chceme \u201eprav\u00fa n\u00e1hodnos\u0165\u201c a nechceme menej'. M\u00f4\u017eeme hovori\u0165 o tom, ako poskytujeme rozhrania kryptografom, aby mohli z\u00edska\u0165 potrebn\u00e9 inform\u00e1cie prostredn\u00edctvom pr\u00edstupu k prim\u00e1rnym noise sources, oddelen\u00fdm a pomenovan\u00fdm, a mo\u017eno, \u017ee nejak\u00fdm sp\u00f4sobom noise source bude schopn\u00fd autentifikova\u0165 sa v kni\u017enici alebo aplik\u00e1cii pou\u017e\u00edvate\u013esk\u00e9ho priestoru.\u201c<\/i><\/p>\n

Prebehla mal\u00e1 diskusia o tom, ako by tak\u00e9to rozhranie mohlo vyzera\u0165, preto\u017ee niektor\u00e9 udalosti m\u00f4\u017eu ma\u0165 n\u00e1sledky z h\u013eadiska bezpe\u010dnosti. Cao poznamenal, \u017ee k\u00f3dy skenovania kl\u00e1vesnice (t.j. stla\u010denia kl\u00e1vesov) sa mie\u0161aj\u00fa do poolu ako s\u00fa\u010das\u0165 zberu entropie: \u201ePrenies\u0165 to do pou\u017e\u00edvate\u013esk\u00e9ho priestoru, aj cez privilegovan\u00fd syst\u00e9mov\u00fd volanie, by bolo aspo\u0148 nerozv\u00e1\u017ene\u201c. Je celkom mo\u017en\u00e9, \u017ee aj in\u00e9 \u010dasovanie udalost\u00ed m\u00f4\u017ee sp\u00f4sobi\u0165 nejak\u00e9 \u00faniky inform\u00e1ci\u00ed cez bo\u010dn\u00e9 kan\u00e1ly. <\/p>\n

Tak vznik\u00e1 pocit, \u017ee star\u00fd probl\u00e9m subsyst\u00e9mu n\u00e1hodn\u00fdch \u010d\u00edsel Linuxu je na ceste k rie\u0161eniu. Zmeny, ktor\u00fdmi tento subsyst\u00e9m ned\u00e1vno pre\u0161iel, v skuto\u010dnosti viedli iba k probl\u00e9mom DoS pri jeho pou\u017e\u00edvan\u00ed. Teraz sa v\u0161ak objavili efekt\u00edvne sp\u00f4soby, ako z\u00edska\u0165 najlep\u0161ie n\u00e1hodn\u00e9 \u010d\u00edsla, ktor\u00e9 m\u00f4\u017ee poskytn\u00fa\u0165 jadro. Ak je TRNG st\u00e1le \u017eiad\u00face pre Linux, tento nedostatok bude potrebn\u00e9 v bud\u00facnosti odstr\u00e1ni\u0165, av\u0161ak pravdepodobne sa to nebude robi\u0165 priamo v jadre. <\/p>\n

Trochu reklamy \ud83d\ude42<\/h3>\n

\n\u010eakujeme, \u017ee ost\u00e1vate s nami. P\u00e1\u010dia sa v\u00e1m na\u0161e \u010dl\u00e1nky? Chcete vidie\u0165 viac zauj\u00edmav\u00fdch materi\u00e1lov? Podporte n\u00e1s, vytvoren\u00edm objedn\u00e1vky alebo odpor\u00fa\u010dan\u00edm zn\u00e1mym, cloud VPS pre v\u00fdvoj\u00e1rov od 4,99 dol\u00e1rov<\/a><\/noindex>, unik\u00e1tny ekvivalent entry-level serverov, ktor\u00fd sme pre v\u00e1s vytvorili:<\/b> Cel\u00e1 pravda o VPS (KVM) E5-2697 v3 (6 jadier) 10GB DDR4 480GB SSD 1Gbps od 19 dol\u00e1rov alebo ako spr\u00e1vne rozdeli\u0165 server?<\/a><\/noindex> (k dispoz\u00edcii varianty s RAID1 a RAID10, a\u017e 24 jadier a a\u017e 40GB DDR4).<\/p>\n

Dell R730xd je dvakr\u00e1t lacnej\u0161\u00ed v d\u00e1tovom centre Equinix Tier IV v Amsterdame?<\/b> Len u n\u00e1s 2 x Intel TetraDeca-Core Xeon 2x E5-2697v3 2.6GHz 14C 64GB DDR4 4x960GB SSD 1Gbps 100 TB od 199 dol\u00e1rov<\/a><\/noindex> v Holandsku! Dell R420 \u2014 2x E5-2430 2.2Ghz 6C 128GB DDR3 2x960GB SSD 1Gbps 100TB \u2014 od 99 dol\u00e1rov!<\/b><\/b> Pre\u010d\u00edtajte si o tom Ako vybudova\u0165 infra\u0161trukt\u00faru korpor\u00e1tneho typu s pou\u017eit\u00edm serverov Dell R730xd E5-2650 v4 s cenou 9000 eur za zlomok ceny?<\/a><\/noindex>
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u0430\u043a \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, \u0443 \/dev\/random, \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438 \u0441\u0442\u043e\u0439\u043a\u043e\u0433\u043e \u0433\u0435\u043d\u0435\u0440\u0430\u0442\u043e\u0440\u0430 \u043f\u0441\u0435\u0432\u0434\u043e\u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0445 \u0447\u0438\u0441\u0435\u043b (CSPRNG), \u0438\u043c\u0435\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0430 \u043d\u0435\u043f\u0440\u0438\u044f\u0442\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u2013 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438. \u0412 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f, \u043a\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043c\u043e\u0436\u043d\u043e \u0435\u0435 \u0440\u0435\u0448\u0438\u0442\u044c. \u0417\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0445 \u0447\u0438\u0441\u0435\u043b \u0432 \u044f\u0434\u0440\u0435 \u0431\u044b\u043b\u0438 \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u044b, \u043d\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 \u044d\u0442\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0440\u0435\u0448\u0430\u043b\u0438\u0441\u044c \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u0431\u043e\u043b\u0435\u0435 \u0448\u0438\u0440\u043e\u043a\u0438\u0445 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0440\u0430\u043c\u043e\u043a. \u0421\u0430\u043c\u044b\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0431\u044b\u043b\u0438 \u0441\u0434\u0435\u043b\u0430\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-55510","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Linux: odstr\u00e1nenie z\u00e1mkov\u00e9ho poolu \/dev\/random | ProHoster","description":"Ako je zn\u00e1me, \/dev\/random, kryptograficky bezpe\u010dn\u00fd gener\u00e1tor pseudon\u00e1hodn\u00fdch \u010d\u00edsel (CSPRNG), m\u00e1 jednu nepr\u00edjemn\u00fa vlastnos\u0165 \u2013 blokovanie. V tomto \u010dl\u00e1nku sa hovor\u00ed o tom, ako tento probl\u00e9m vyrie\u0161i\u0165.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/linux-udalenie-pula-blokirovok-dev-random","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Linux: \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043f\u0443\u043b\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043e\u043a \/dev\/random | ProHoster","og:description":"\u041a\u0430\u043a \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, \u0443 \/dev\/random, \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438 \u0441\u0442\u043e\u0439\u043a\u043e\u0433\u043e \u0433\u0435\u043d\u0435\u0440\u0430\u0442\u043e\u0440\u0430 \u043f\u0441\u0435\u0432\u0434\u043e\u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0445 \u0447\u0438\u0441\u0435\u043b (CSPRNG), \u0438\u043c\u0435\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0430 \u043d\u0435\u043f\u0440\u0438\u044f\u0442\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u2013 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438. \u0412 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f, \u043a\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043c\u043e\u0436\u043d\u043e \u0435\u0435 \u0440\u0435\u0448\u0438\u0442\u044c.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/linux-udalenie-pula-blokirovok-dev-random","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-21T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55510","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:43:30","updated":"2022-10-02 22:01:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/55510","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=55510"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/55510\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=55510"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=55510"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=55510"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}