{"id":55510,"date":"2020-01-22T00:00:00","date_gmt":"2020-01-21T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/linux-udalenie-pula-blokirovok-dev-random"},"modified":"2020-02-18T14:03:38","modified_gmt":"2020-02-18T11:03:38","slug":"linux-udalenie-pula-blokirovok-dev-random","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/linux-udalenie-pula-blokirovok-dev-random","title":{"rendered":"Linux: heqja e grupit t\u00eb bllokimit \/dev\/random","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Si\u00e7 dihet, \/dev\/random, gjeneratori i numrave t\u00eb rastit me q\u00ebndrim t\u00eb kriptografis\u00eb (CSPRNG), ka nj\u00eb problem t\u00eb pak\u00ebndsh\u00ebm \u2013 bllokimi. Ky artikull shpjegon se si mund t\u00eb zgjidhet ky problem. <\/p>\n

Gjat\u00eb muajve t\u00eb fundit, mjetet p\u00ebr gjenerimin e numrave t\u00eb rastit n\u00eb b\u00ebrtham\u00eb jan\u00eb p\u00ebrmir\u00ebsuar pak, por problemet n\u00eb k\u00ebt\u00eb n\u00ebnshkall\u00eb jan\u00eb trajtuar p\u00ebr nj\u00eb periudh\u00eb m\u00eb t\u00eb gjer\u00eb kohore<\/a><\/noindex>. Ndryshimet m\u00eb t\u00eb fundit<\/a><\/noindex> u b\u00ebn\u00eb me q\u00ebllim p\u00ebr t\u00eb parandaluar bllokimin e gjat\u00eb t\u00eb thirrjes sistemike getrandom () gjat\u00eb ngarkes\u00ebs s\u00eb sistemit, por arsyeja themelore p\u00ebr k\u00ebt\u00eb ka qen\u00eb sjellja e grupit bllokues t\u00eb rastit. Ndryshimi i fundit do t\u00eb hiqte k\u00ebt\u00eb grup, dhe pritej q\u00eb ai t\u00eb shkonte n\u00eb b\u00ebrtham\u00ebn kryesore. <\/p>\n

Andy Lutomirski publikoi versionin e tret\u00eb t\u00eb ndryshimit n\u00eb fund t\u00eb dhjetorit. Ai sjell \u00abdy ndryshime themelore semantike n\u00eb API-t\u00eb e rastit t\u00eb Linux\u00bb<\/i>. Patch shton nj\u00eb flamur t\u00eb ri GRND_INSECURE n\u00eb thirrjen sistemore getrandom() (ndon\u00ebse Lutomirski i referohet asaj si getentropy(), e cila \u00ebsht\u00eb e realizuar n\u00eb glibc me getrandom() me flamuj t\u00eb ngurt\u00eb); ky flamur b\u00ebn q\u00eb thirrja t\u00eb kthej\u00eb gjithmon\u00eb sasin\u00eb e dh\u00ebnave t\u00eb k\u00ebrkuara, por pa garantimin se k\u00ebto t\u00eb dh\u00ebna jan\u00eb t\u00eb rast\u00ebsishme. B\u00ebrthama thjesht do t\u00eb b\u00ebj\u00eb p\u00ebrpjekje p\u00ebr t\u00eb ofruar t\u00eb dh\u00ebnat m\u00eb t\u00eb mira t\u00eb rast\u00ebsishme q\u00eb ka n\u00eb at\u00eb moment. \u00abNdoshta gj\u00ebja m\u00eb e mir\u00eb q\u00eb mund t\u00eb b\u00ebsh \u00ebsht\u00eb ta quash at\u00eb \"INSECURE\"<\/i> (jo t\u00eb sigurt), p\u00ebr t\u00eb parandaluar p\u00ebrdorimin e k\u00ebtij API p\u00ebr gj\u00ebra q\u00eb k\u00ebrkojn\u00eb siguri\u00bb.<\/a><\/noindex><\/p>\n

Patch-at gjithashtu heqin pellgun bllokues. Aktualisht, b\u00ebrthama mb\u00ebshtet dy pellgje t\u00eb t\u00eb dh\u00ebnave t\u00eb rast\u00ebsishme, nj\u00ebri p\u00ebrputhet me \/dev\/random, dhe tjetri me \/dev\/urandom, si\u00e7 p\u00ebrshkruhet n\u00eb k\u00ebt\u00eb artikullin<\/a><\/noindex> t\u00eb vitit 2015. Pellgu bllokues \u00ebsht\u00eb nj\u00eb pellg p\u00ebr \/dev\/random; leximi p\u00ebr k\u00ebt\u00eb pajisje do t\u00eb bllokohet (ka t\u00eb b\u00ebj\u00eb me emrin e saj) derisa nga sistemi t\u00eb mblidhet \"mjaft\" entropi p\u00ebr t\u00eb k\u00ebnaqur k\u00ebrkes\u00ebn. Lexime t\u00eb m\u00ebtejshme nga ky file gjithashtu bllokohen, n\u00ebse n\u00eb pellg ka pak entropi. <\/p>\n

\u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043f\u0443\u043b\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043e\u043a \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0447\u0442\u0435\u043d\u0438\u0435 \u0438\u0437 \/dev\/random \u0432\u0435\u0434\u0435\u0442 \u0441\u0435\u0431\u044f \u043a\u0430\u043a getrandom() \u0441\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c flags \u0440\u0430\u0432\u043d\u044b\u043c \u043d\u0443\u043b\u044e (\u0438 \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u0444\u043b\u0430\u0433 GRND_RANDOM \u0432 noop). \u041f\u043e\u0441\u043b\u0435 \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0433\u0435\u043d\u0435\u0440\u0430\u0442\u043e\u0440\u0430 \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0445 \u0447\u0438\u0441\u0435\u043b (CRNG), \u0447\u0442\u0435\u043d\u0438\u0435 \u0438\u0437 \/dev\/random \u0438 \u0432\u044b\u0437\u043e\u0432\u044b getrandom(…,0) \u043d\u0435 \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u0442 \u043a \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0435 \u0438 \u0432\u0435\u0440\u043d\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.<\/p>\n

Lutomirski thot\u00eb: \u00abMendoj se rezervuari bllokues i Linux ka p\u00ebrfunduar. CRNG i Linux gjeneron dalje q\u00eb jan\u00eb mjaft t\u00eb mira p\u00ebr t'u p\u00ebrdorur edhe p\u00ebr gjenerimin e \u00e7el\u00ebsave. Rezervuari bllokues nuk \u00ebsht\u00eb m\u00eb i fort\u00eb n\u00eb asnj\u00eb aspekt material, dhe k\u00ebrkon shum\u00eb infrastruktur\u00eb me vler\u00eb dyshuese p\u00ebr ta mbajtur at\u00eb.\u00bb <\/i><\/p>\n

Ndryshimet jan\u00eb b\u00ebr\u00eb me synimin q\u00eb programet ekzistuese t\u00eb mos vuajn\u00eb n\u00eb t\u00eb v\u00ebrtet\u00eb, dhe n\u00eb t\u00eb v\u00ebrtet\u00eb, problemet me pritje t\u00eb gjat\u00eb p\u00ebr gj\u00ebra si gjenerimi i \u00e7el\u00ebsave GnuPG do t\u00eb zvog\u00eblohen.<\/p>\n

\u00abK\u00ebto seri nuk duhet t\u00eb shkelin ndonj\u00eb program ekzistues. \/dev\/urandom mbetet i pandryshuar. \/dev\/random ende bllokohet menj\u00ebher\u00eb pas ngarkimit, por bllokohet m\u00eb pak se m\u00eb par\u00eb. getentropy() me flamujt ekzistues do t\u00eb kthej\u00eb nj\u00eb rezultat q\u00eb do t\u00eb jet\u00eb po aq i p\u00ebrshtatsh\u00ebm p\u00ebr q\u00ebllime praktike sa m\u00eb par\u00eb\u00bb.<\/i> <\/p>\n

Lutomirski vuri n\u00eb dukje se pyetja, n\u00ebse b\u00ebrthama duhet t\u00eb ofroj\u00eb at\u00eb q\u00eb quhet \u00abnumra t\u00eb v\u00ebrtet\u00eb rast\u00ebsor\u00eb\u00bb, mbetet ende e hapur, gj\u00eb q\u00eb n\u00eb nj\u00eb mas\u00eb duhet ta b\u00ebnte b\u00ebrthama bllokuese. Ai sheh vet\u00ebm nj\u00eb arsye p\u00ebr k\u00ebt\u00eb: \u00abrespektimin e standardeve shtet\u00ebrore\u00bb. Lutomirski supozoi se n\u00ebse b\u00ebrthama duhet ta siguroj\u00eb k\u00ebt\u00eb, at\u00ebher\u00eb duhet t\u00eb b\u00ebhet p\u00ebrmes nj\u00eb interfesi krejt\u00ebsisht t\u00eb ndrysh\u00ebm ose duhet t\u00eb transferohet n\u00eb hap\u00ebsir\u00ebn e p\u00ebrdoruesit, duke i ofruar atij mund\u00ebsin\u00eb t\u00eb nxjerr\u00eb mostra t\u00eb pap\u00ebrpunuara ngjarjesh, q\u00eb mund t\u00eb p\u00ebrdoren p\u00ebr t\u00eb krijuar nj\u00eb grup t\u00eb till\u00eb bllokimi.\u00bb <\/p>\n

Stephan M\u00fcller sugjeroi se seti i tij patchesh<\/a><\/noindex> p\u00ebr gjeneratorin e numrave t\u00eb rast\u00ebsish\u00ebm Linux (LRNG) (aktualisht \u00ebsht\u00eb l\u00ebshuar versioni 26) mund t\u00eb jet\u00eb nj\u00eb m\u00ebnyr\u00eb p\u00ebr t\u00eb ofruar numra t\u00eb v\u00ebrtet\u00eb t\u00eb rast\u00ebsish\u00ebm p\u00ebr aplikacionet q\u00eb kan\u00eb nevoj\u00eb p\u00ebr to. LRNG \"plot\u00ebson k\u00ebrkesat e 'Rekomandimeve p\u00ebr burimet e entropis\u00eb q\u00eb p\u00ebrdoren p\u00ebr gjenerimin e bit\u00ebve t\u00eb rast\u00ebsish\u00ebm' SP800-90B\", duke e b\u00ebr\u00eb at\u00eb nj\u00eb zgjidhje p\u00ebr problemin e standardeve qeveritare.
\nMatthew Garrett kund\u00ebrshtoi termin 't\u00eb dh\u00ebna t\u00eb v\u00ebrteta rast\u00ebsore', duke theksuar se pajisjet e zgjedhura n\u00eb parim mund t\u00eb modelohen mjaft sakt\u00ebsisht p\u00ebr t'i b\u00ebr\u00eb ato t\u00eb parashikueshme: 'ne k\u00ebtu nuk po marrim ngjarje kuantike'.<\/p>\n

M\u00fcller u p\u00ebrgjigj se ky term vjen nga standardi gjerman AIS 31 p\u00ebr p\u00ebrshkrimin e gjeneratorit t\u00eb numrave t\u00eb rast\u00ebsish\u00ebm, i cili vet\u00ebm jep rezultat 'me t\u00eb nj\u00ebjtin rit\u00ebm me t\u00eb cilin burimi baz\u00eb i zhurm\u00ebs prodhon entropi'. <\/p>\n

P\u00ebrve\u00e7 mospajtimeve t\u00eb terminologjis, ekzistenca e nj\u00eb pool bllokimi, si\u00e7 sugjerohen patch-et LRNG, do t\u00eb sillte thjesht probleme t\u00eb ndryshme, t\u00eb pakt\u00ebn n\u00ebse \u00ebsht\u00eb n\u00eb dispozicion pa privilegje. <\/p>\n

Sipas Lutomirsky: \u00abKjo nuk e zgjidh problemin. N\u00ebse dy p\u00ebrdorues t\u00eb ndrysh\u00ebm ekzekutojn\u00eb programe t\u00eb padobishme si gnupg, ata p\u00ebrfundojn\u00eb duke i shpenzuar t\u00eb dy nj\u00ebri-tjetrin. Shoh q\u00eb aktualisht ekzistojn\u00eb dy probleme kryesore me \/dev\/random: ai \u00ebsht\u00eb i ekspozuar ndaj DoS (dmth shpenzimit t\u00eb burimeve, ndikimit keqdash\u00ebs, apo ndonj\u00eb gj\u00ebje t\u00eb ngjashme), dhe, pasi nuk k\u00ebrkohen privilegje p\u00ebr ta p\u00ebrdorur, ai gjithashtu \u00ebsht\u00eb i prirur ndaj abuzimeve. Gnupg \u00ebsht\u00eb e gabuar, \u00ebsht\u00eb nj\u00eb kolaps total. N\u00ebse ne shtojm\u00eb nj\u00eb nd\u00ebrfaqe t\u00eb re pa privilegje q\u00eb do t\u00eb p\u00ebrdorin gnupg dhe programe t\u00eb ngjashme, ne p\u00ebrs\u00ebri do t\u00eb humbasim.\u00bb<\/i> <\/p>\n

M\u00fcller vuri n\u00eb dukje se shtimi i getrandom() tani do t'i jap\u00eb GnuPG mund\u00ebsin\u00eb p\u00ebr t\u00eb p\u00ebrdorur k\u00ebt\u00eb nd\u00ebrfaqe, pasi do t\u00eb siguroj\u00eb garantimin e nevojsh\u00ebm q\u00eb pool-i t\u00eb jet\u00eb inicializuar. Bazuar n\u00eb diskutimet me zhvilluesin e GnuPG, Werner Koch, M\u00fcller mendon se garantia \u00ebsht\u00eb arsyeja e vetme p\u00ebr t\u00eb cil\u00ebn GnuPG aktualisht lexon drejtp\u00ebrdrejt nga \/dev\/random. Por n\u00ebse ka nj\u00eb nd\u00ebrfaqe jo privilegjuese q\u00eb \u00ebsht\u00eb e ndjeshme ndaj refuzimit t\u00eb sh\u00ebrbimit (ashtu si \/dev\/random sot), sipas Lutomirski, ajo do t\u00eb p\u00ebrdoret gabimisht nga disa aplikacione. <\/p>\n

\u0422\u0435\u043e\u0434\u043e\u0440 \u0426\u0430\u043e (Theodore Yue Tak Ts’o), \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0445 \u0447\u0438\u0441\u0435\u043b Linux, \u043f\u043e-\u0432\u0438\u0434\u0438\u043c\u043e\u043c\u0443, \u0438\u0437\u043c\u0435\u043d\u0438\u043b \u0441\u0432\u043e\u0435 \u043c\u043d\u0435\u043d\u0438\u0435 \u043f\u043e \u043f\u043e\u0432\u043e\u0434\u0443 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u043f\u0443\u043b\u0430. \u041e\u043d \u0441\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u044d\u0442\u043e\u0433\u043e \u043f\u0443\u043b\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0437\u0431\u0430\u0432\u0438\u0442\u044c\u0441\u044f \u043e\u0442 \u0438\u0434\u0435\u0438, \u0447\u0442\u043e Linux \u0438\u043c\u0435\u0435\u0442 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0438\u0439 \u0433\u0435\u043d\u0435\u0440\u0430\u0442\u043e\u0440 \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0445 \u0447\u0438\u0441\u0435\u043b (TRNG): \u00ab\u044d\u0442\u043e \u043d\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0431\u0435\u0441\u0441\u043c\u044b\u0441\u043b\u0438\u0446\u0435\u0439, \u0442\u0430\u043a \u043a\u0430\u043a \u044d\u0442\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u0442\u043e, \u0447\u0442\u043e \u0432\u0441\u0435\u0433\u0434\u0430 \u0434\u0435\u043b\u0430\u043b\u0438 *BSD".<\/i><\/p>\n

Ai \u00ebsht\u00eb gjithashtu i shqet\u00ebsuar se ofrimi i mekanizmit TRNG do t\u00eb sh\u00ebrbej\u00eb thjesht si nj\u00eb kurth p\u00ebr zhvilluesit e aplikacioneve dhe mendon se, duke marr\u00eb parasysh llojet e ndryshme t\u00eb harduerit t\u00eb mb\u00ebshtetur nga Linux, \u00ebsht\u00eb e pamundur t\u00eb garantosh TRNG-in n\u00eb b\u00ebrtham\u00eb. Problemi nuk do t\u00eb zgjidhet as nga mund\u00ebsia e operimit me pajisje vet\u00ebm mbi baza t\u00eb privilegjeve root: \u00ab\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442, \u0447\u0442\u043e\u0431\u044b \u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0432 \u0446\u0435\u043b\u044f\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e \u043a\u0430\u043a root, \u043f\u043e\u0442\u043e\u043c\u0443 \u0442\u043e\u043b\u044c\u043a\u043e \u0442\u0430\u043a \u0432\u044b \u043c\u043e\u0436\u0435\u0442\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u00ab\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0445\u043e\u0440\u043e\u0448\u0438\u043c\u00bb \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u043c \u0447\u0438\u0441\u043b\u0430\u043c".<\/i><\/p>\n

M\u00fcller pyeti n\u00ebse Cao kishte hequr dor\u00eb nga implementimi i grupit bllokues, t\u00eb cilin ai vet\u00eb e kishte propozuar prej koh\u00ebsh. Cao u p\u00ebrgjigj se planifikon t\u00eb marr\u00eb patch-et e Lutomirskit dhe \u00ebsht\u00eb aktivisht kund\u00ebr rikthimit t\u00eb nd\u00ebrfaqes bllokuese n\u00eb b\u00ebrtham\u00eb. <\/p>\n

\u00abNj\u00eb b\u00ebrthame nuk mund t\u00eb ofroj\u00eb asnj\u00eb garanci n\u00eb lidhje me n\u00ebse burimi i zhurm\u00ebs \u00ebsht\u00eb karakterizuar si\u00e7 duhet. E vetmja gj\u00eb q\u00eb nj\u00eb zhvillues GPG ose OpenSSL mund t\u00eb marr\u00eb \u00ebsht\u00eb nj\u00eb ndjenj\u00eb t\u00eb paqart\u00eb se TRUERANDOM \u00ebsht\u00eb 'm\u00eb i mir\u00eb', dhe p\u00ebr sa i p\u00ebrket siguris\u00eb, ata padyshim do t\u00eb p\u00ebrpiqen ta p\u00ebrdorin. N\u00eb nj\u00eb moment, ai do t\u00eb bllokohet, dhe kur ndonj\u00eb p\u00ebrdorues tjet\u00ebr inteligjent (ndoshta nj\u00eb specialist n\u00eb l\u00ebshimin e shp\u00ebrndarjes) ta vendos\u00eb at\u00eb n\u00eb nj\u00eb skript init dhe sistemet t\u00eb ndalojn\u00eb s\u00eb funksionuari, p\u00ebrdoruesit do t\u00eb mbesin vet\u00ebm p\u00ebr t\u00eb ankuar Linus Torvalds-it t\u00eb vet\u00eb.\u201d<\/i> <\/p>\n

Cao gjithashtu e mb\u00ebshtet sigurimin e nj\u00eb m\u00ebnyre p\u00ebr kriptograf\u00ebt dhe ata q\u00eb v\u00ebrtet kan\u00eb nevoj\u00eb p\u00ebr TRNG p\u00ebr t\u00eb mbledhur entropin\u00eb e tyre n\u00eb hap\u00ebsir\u00ebn e p\u00ebrdoruesit, p\u00ebr ta p\u00ebrdorur at\u00eb sipas d\u00ebshir\u00ebs s\u00eb tyre. Ai thot\u00eb se mbledhja e entropis\u00eb nuk \u00ebsht\u00eb nj\u00eb proces q\u00eb mund t\u00eb realizohet nga b\u00ebrthama n\u00eb \u00e7do pajisje t\u00eb mb\u00ebshtetur prej saj, gjithashtu, vet\u00eb b\u00ebrthama nuk mund t\u00eb vler\u00ebsoj\u00eb sasin\u00eb e entropis\u00eb q\u00eb sigurohet nga burime t\u00eb ndryshme. <\/p>\n

\u00abNuk i duhet t\u00eb p\u00ebrziej\u00eb s\u00eb bashku burime t\u00eb ndryshme zhurmash, dhe natyrisht, nuk duhet t\u00eb p\u00ebrpiqet t\u00eb pohonte se di se sa bita entropie merr kur p\u00ebrpiqet t\u00eb luaj\u00eb nj\u00eb \"loj\u00eb t\u00eb \u00e7mendur entropie\" n\u00eb nj\u00eb arkitektur\u00eb CPU q\u00eb \u00ebsht\u00eb thjesht e ul\u00ebt p\u00ebr rastet p\u00ebrdoruese IoT\/Embedded, kur gjith\u00e7ka \u00ebsht\u00eb jasht\u00eb sinkronit me nj\u00eb generator kryesor, kur nuk ka ndonj\u00eb instrukcion CPU p\u00ebr riorganizimin ose rinamingun e regjistrit, etj.\u00bb<\/p>\n

\u00abMund t\u00eb flitet p\u00ebr ofrimin e mjeteve q\u00eb p\u00ebrpiqen t\u00eb b\u00ebjn\u00eb k\u00ebto llogaritje, por k\u00ebto gj\u00ebra duhet t\u00eb realizohen n\u00eb pajisjet e \u00e7do p\u00ebrdoruesi, q\u00eb p\u00ebr shumic\u00ebn e p\u00ebrdoruesve t\u00eb shp\u00ebrndarjes \u00ebsht\u00eb thjesht e paprakti. N\u00ebse kjo \u00ebsht\u00eb e destinuar vet\u00ebm p\u00ebr kriptograf\u00ebt, le t\u00eb b\u00ebhet n\u00eb hap\u00ebsir\u00ebn e tyre t\u00eb p\u00ebrdoruesit. Dhe le t\u00eb mos e thjeshtojm\u00eb GPG, OpenSSL, etj., n\u00eb m\u00ebnyr\u00eb q\u00eb t\u00eb gjith\u00eb t\u00eb thon\u00eb: \u00abne duam \u00abrast\u00ebsin\u00eb e v\u00ebrtet\u00eb\u00bb dhe nuk pranojm\u00eb m\u00eb pak\u00bb. Mund t\u00eb flasim p\u00ebr m\u00ebnyr\u00ebn se si ofrojm\u00eb nd\u00ebrfaqet p\u00ebr kriptograf\u00ebt, n\u00eb m\u00ebnyr\u00eb q\u00eb ata t\u00eb mund t\u00eb marrin informacionin e nevojsh\u00ebm me an\u00eb t\u00eb aksesit n\u00eb burimet e zhurm\u00ebs primare, t\u00eb ndara dhe t\u00eb em\u00ebruara dhe, ndoshta, ndonj\u00eb burim zhurme do t\u00eb jet\u00eb n\u00eb gjendje t\u00eb autentifikoj\u00eb veten n\u00eb bibliotek\u00eb ose aplikacionin e hap\u00ebsir\u00ebs s\u00eb p\u00ebrdoruesit.\u00bb<\/i><\/p>\n

Kishte nj\u00eb diskutim t\u00eb vog\u00ebl se si mund t\u00eb duket nj\u00eb nd\u00ebrfaqe e till\u00eb, pasi, p\u00ebr shembull, disa ngjarje mund t\u00eb ken\u00eb pasoja n\u00eb aspektin e siguris\u00eb. Cao theksoi se kodet e skanimit t\u00eb tastier\u00ebs (dmth, shtypjet e \u00e7el\u00ebsave) p\u00ebrzihen n\u00eb nj\u00eb grup si pjes\u00eb e mbledhjes s\u00eb entropis\u00eb: \"Transferimi i k\u00ebsaj n\u00eb hap\u00ebsir\u00ebn e p\u00ebrdoruesit, madje p\u00ebrmes nj\u00eb thirrjeje sistemike me privilegje, do t\u00eb ishte, t\u00eb pakt\u00ebn, i paarsyesh\u00ebm\". Ka shum\u00eb gjasa q\u00eb koha e ngjarjeve t\u00eb tjera mund t\u00eb krijoj\u00eb ndonj\u00eb rrjedhje informacioni p\u00ebrmes kanaleve an\u00ebsore. <\/p>\n

K\u00ebshtu, krijohet p\u00ebrshtypja se problemi i gjat\u00eb i n\u00ebncil\u00ebs s\u00eb numrave t\u00eb rast\u00ebsish\u00ebm n\u00eb Linux \u00ebsht\u00eb n\u00eb rrug\u00ebn e zgjidhjes. Ndryshimet q\u00eb n\u00ebncil\u00ebs s\u00eb numrave t\u00eb rast\u00ebsish\u00ebm i jan\u00eb b\u00ebr\u00eb koh\u00ebve t\u00eb fundit, n\u00eb fakt, kan\u00eb sjell\u00eb vet\u00ebm probleme DoS gjat\u00eb p\u00ebrdorimit t\u00eb saj. Tani, ka metoda efektive p\u00ebr t\u00eb marr\u00eb numra t\u00eb rast\u00ebsish\u00ebm m\u00eb t\u00eb mir\u00eb se \u00e7far\u00eb ofron b\u00ebrthama. N\u00ebse TRNG ende d\u00ebshirohet p\u00ebr Linux, at\u00ebher\u00eb ky defekt duhet t\u00eb zgjidhet n\u00eb t\u00eb ardhmen, por, m\u00eb s\u00eb shumti, nuk do t\u00eb b\u00ebhet brenda b\u00ebrtham\u00ebs vet\u00eb. <\/p>\n

Pak reklam\u00eb \ud83d\ude42<\/h3>\n

\nFaleminderit q\u00eb q\u00ebndroni me ne. Ju p\u00eblqejn\u00eb artikujt tan\u00eb? D\u00ebshironi t\u00eb shihni m\u00eb shum\u00eb materiale interesante? Na mb\u00ebshtetni duke b\u00ebr\u00eb nj\u00eb porosi ose duke na rekomanduar njohurive tuaj, VPS cloud p\u00ebr zhvillues nga $4.99<\/a><\/noindex>, nj\u00eb analog unik i server\u00ebve entry-level, i nd\u00ebrtuar p\u00ebr ju:<\/b> E gjith\u00eb e v\u00ebrteta rreth VPS (KVM) E5-2697 v3 (6 Nuclea) 10GB DDR4 480GB SSD 1Gbps nga $19 ose si ta ndajm\u00eb sakt\u00ebsisht serverin?<\/a><\/noindex> (disponohen variante me RAID1 dhe RAID10, deri n\u00eb 24 b\u00ebrthama dhe deri n\u00eb 40GB DDR4).<\/p>\n

Dell R730xd dyfish m\u00eb i lir\u00eb n\u00eb qendr\u00ebn e t\u00eb dh\u00ebnave Equinix Tier IV n\u00eb Amsterdam?<\/b> Vet\u00ebm k\u00ebtu 2 x Intel TetraDeca-Core Xeon 2x E5-2697v3 2.6GHz 14C 64GB DDR4 4x960GB SSD 1Gbps 100 TB nga $199<\/a><\/noindex> n\u00eb Holand\u00eb! Dell R420 \u2014 2x E5-2430 2.2Ghz 6C 128GB DDR3 2x960GB SSD 1Gbps 100TB \u2014 nga $99!<\/b><\/b> Lexoni rreth Si t\u00eb nd\u00ebrtosh nj\u00eb infrastruktur\u00eb t\u00eb klas\u00ebs korporative me p\u00ebrdorimin e server\u00ebve Dell R730xd E5-2650 v4 me \u00e7mim prej 9000 euro p\u00ebr pak para?<\/a><\/noindex>
\n
Burimi: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u0430\u043a \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, \u0443 \/dev\/random, \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438 \u0441\u0442\u043e\u0439\u043a\u043e\u0433\u043e \u0433\u0435\u043d\u0435\u0440\u0430\u0442\u043e\u0440\u0430 \u043f\u0441\u0435\u0432\u0434\u043e\u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0445 \u0447\u0438\u0441\u0435\u043b (CSPRNG), \u0438\u043c\u0435\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0430 \u043d\u0435\u043f\u0440\u0438\u044f\u0442\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u2013 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438. \u0412 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f, \u043a\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043c\u043e\u0436\u043d\u043e \u0435\u0435 \u0440\u0435\u0448\u0438\u0442\u044c. \u0417\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0445 \u0447\u0438\u0441\u0435\u043b \u0432 \u044f\u0434\u0440\u0435 \u0431\u044b\u043b\u0438 \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u044b, \u043d\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 \u044d\u0442\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0440\u0435\u0448\u0430\u043b\u0438\u0441\u044c \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u0431\u043e\u043b\u0435\u0435 \u0448\u0438\u0440\u043e\u043a\u0438\u0445 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0440\u0430\u043c\u043e\u043a. \u0421\u0430\u043c\u044b\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0431\u044b\u043b\u0438 \u0441\u0434\u0435\u043b\u0430\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-55510","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Linux: heqja e grupit t\u00eb bllokadave \/dev\/random | ProHoster","description":"Si\u00e7 dihet, \/dev\/random, gjeneratori i numrave pseudorrandom t\u00eb q\u00ebndruesh\u00ebm nga ana kriptografike (CSPRNG), ka nj\u00eb problem t\u00eb pak\u00ebndsh\u00ebm \u2013 bllokime. Ky artikull flet p\u00ebr m\u00ebnyrat si mund t\u00eb zgjidhet ky problem. Gjat\u00eb muajve t\u00eb fundit, mjetet p\u00ebr gjenerimin e numrave random n\u00eb b\u00ebrtham\u00eb jan\u00eb p\u00ebrmir\u00ebsuar paksa, por problemet n\u00eb k\u00ebt\u00eb n\u00ebnsistem jan\u00eb trajtuar p\u00ebr nj\u00eb periudh\u00eb m\u00eb t\u00eb gjat\u00eb. Ndryshimet m\u00eb t\u00eb fundit jan\u00eb b\u00ebr\u00eb","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/linux-udalenie-pula-blokirovok-dev-random","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Linux: \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043f\u0443\u043b\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043e\u043a \/dev\/random | ProHoster","og:description":"\u041a\u0430\u043a \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, \u0443 \/dev\/random, \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438 \u0441\u0442\u043e\u0439\u043a\u043e\u0433\u043e \u0433\u0435\u043d\u0435\u0440\u0430\u0442\u043e\u0440\u0430 \u043f\u0441\u0435\u0432\u0434\u043e\u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0445 \u0447\u0438\u0441\u0435\u043b (CSPRNG), \u0438\u043c\u0435\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0430 \u043d\u0435\u043f\u0440\u0438\u044f\u0442\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u2013 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438. \u0412 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f, \u043a\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043c\u043e\u0436\u043d\u043e \u0435\u0435 \u0440\u0435\u0448\u0438\u0442\u044c. \u0417\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0445 \u0447\u0438\u0441\u0435\u043b \u0432 \u044f\u0434\u0440\u0435 \u0431\u044b\u043b\u0438 \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u044b, \u043d\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 \u044d\u0442\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0440\u0435\u0448\u0430\u043b\u0438\u0441\u044c \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u0431\u043e\u043b\u0435\u0435 \u0448\u0438\u0440\u043e\u043a\u0438\u0445 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0440\u0430\u043c\u043e\u043a. \u0421\u0430\u043c\u044b\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0431\u044b\u043b\u0438 \u0441\u0434\u0435\u043b\u0430\u043d\u044b","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/linux-udalenie-pula-blokirovok-dev-random","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-21T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55510","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:43:30","updated":"2022-10-02 22:01:02"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/55510","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=55510"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/55510\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=55510"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=55510"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=55510"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}