Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #227853 > unrolled thread

Stretch => Buster: Entropy during boot

Back to article view | Back to linux.debian.user

Contents

  Stretch => Buster: Entropy during boot Jesper Dybdal <jd-debian-user@dybdal.dk> - 2020-10-16 12:30 +0200
    Re: Stretch => Buster: Entropy during boot Reco <recoverym4n@enotuniq.net> - 2020-10-16 12:40 +0200
    Re: Stretch => Buster: Entropy during boot Andrei POPESCU <andreimpopescu@gmail.com> - 2020-10-16 14:50 +0200
      Re: Stretch => Buster: Entropy during boot Reco <recoverym4n@enotuniq.net> - 2020-10-16 15:40 +0200
    Re: Stretch => Buster: Entropy during boot Andy Smith <andy@strugglers.net> - 2020-10-16 16:50 +0200

#227853 — Stretch => Buster: Entropy during boot

The Buster release notes warn about a possibly insufficient entropy 
source during boot and recommends installing "haveged" on systems with 
that problem.

I run a few Stretch systems on old processors that do not support the 
RDRAND instruction.

Can I simply install "haveged" on the Stretch systems *before* the 
upgrade to Buster to avoid problems during the upgrade?

Thanks,
Jesper

-- 
Jesper Dybdal
https://www.dybdal.dk

[toc] | [next] | [standalone]

#227854

	Hi.

On Fri, Oct 16, 2020 at 12:28:13PM +0200, Jesper Dybdal wrote:
> Can I simply install "haveged" on the Stretch systems *before* the
> upgrade to Buster to avoid problems during the upgrade?

If you have a hardware random generator on these systems (i.e. you see
/dev/hwrng there) - you should install rng-tools, not haveged.
If you lack /dev/hwrng - haveged will solve this issue indeed.

If you need to do it enterprise way, and your hosts can connect to each
other - the entropybroker is the right answer for this question.

Reco

[toc] | [prev] | [next] | [standalone]

#227864

[Multipart message — attachments visible in raw view] — view raw

On Vi, 16 oct 20, 12:28:13, Jesper Dybdal wrote:
> The Buster release notes warn about a possibly insufficient entropy source
> during boot and recommends installing "haveged" on systems with that
> problem.
> 
> I run a few Stretch systems on old processors that do not support the RDRAND
> instruction.
> 
> Can I simply install "haveged" on the Stretch systems *before* the upgrade
> to Buster to avoid problems during the upgrade?

Short version: I wouldn't bother unless it's a problem in practice.

Long version:

In my understanding using haveged is less secure than "real" entropy.

The lack of entropy is mostly an issue for systems you access via SSH 
with very few other things "going on".

E.g. a PINE A64 did exhibit some problems with a minimal buster install 
and no or very limited connections. They disappeared as soon as I 
connected more stuff to it (ethernet, USB HDD rack, etc.) because the 
kernel can use any kind of activity as a source of entropy.

If you have local access to the system simply pressing keys on the 
keyboard will provide entropy and eventually allow the system to reach 
the login prompt.

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#227865

	Hi.

On Fri, Oct 16, 2020 at 03:49:27PM +0300, Andrei POPESCU wrote:
> On Vi, 16 oct 20, 12:28:13, Jesper Dybdal wrote:
> > The Buster release notes warn about a possibly insufficient entropy source
> > during boot and recommends installing "haveged" on systems with that
> > problem.
> > 
> > I run a few Stretch systems on old processors that do not support the RDRAND
> > instruction.
> > 
> > Can I simply install "haveged" on the Stretch systems *before* the upgrade
> > to Buster to avoid problems during the upgrade?
> 
> Short version: I wouldn't bother unless it's a problem in practice.

Some may consider a rebooted server that does not answer by SSH a problem.


> In my understanding using haveged is less secure than "real" entropy.

It's correct. The only source of entropy haveged considers is
PRNG-based. You need a good and proper hardware random number generator,
or, if you trust NSA - at least that RDRAND Intel instruction.


> The lack of entropy is mostly an issue for systems you access via SSH 
> with very few other things "going on".

Or you have an LVM2 configured. Or you're using the encryption.
Or it's the web- or e-mail server. Let's not disregard a VPN server.

There are many ways a server can consume an entropy, some of them are
applicable for the desktops of course.


> E.g. a PINE A64 did exhibit some problems with a minimal buster install 
> and no or very limited connections.

On Exsynos 5422 that "problem" (rather - whoever thought is way a good
idea to add getrand syscall to libc) adds 30 seconds to every boot just
because LVM2 needs some good random numbers for some transcendent
reason.


> They disappeared as soon as I connected more stuff to it (ethernet,
> USB HDD rack, etc.) because the kernel can use any kind of activity as
> a source of entropy.

It can help with SSH I suppose. It surely cannot help if you're blocked
at initramfs (see above).


> If you have local access to the system simply pressing keys on the 
> keyboard will provide entropy and eventually allow the system to reach 
> the login prompt.

Surely you agree that if you have many servers such workaround is
tedious at best.

Reco

[toc] | [prev] | [next] | [standalone]

#227870

Hi Jesper,

On Fri, Oct 16, 2020 at 12:28:13PM +0200, Jesper Dybdal wrote:
> I run a few Stretch systems on old processors that do not support the RDRAND
> instruction.
> 
> Can I simply install "haveged" on the Stretch systems *before* the upgrade
> to Buster to avoid problems during the upgrade?

In July last year I experimented with boot times on a virtual
machine while:

- running normally

- disallowing RDRAND for early entropy

- disallowing RDRAND entirely

The normal boot (RDRAND) took ~1 second; the "no RDRAND at all" boot
took ~49 seconds. Given that a virtual machine has no real hardware
to provide sources of entropy I would consider this to be near to a
worst case for SSH. If you have other boot-time services that
require entropy then they may take significantly longer.

So if it's mainly SSH you're worried about, I don't think this will
be the end of the world for you to just do it and see what happens.

    https://strugglers.net/~andy/blog/2019/07/11/experiments-with-rdrand-and-entropykey/

Cheers,
Andy

-- 
https://bitfolk.com/ -- No-nonsense VPS hosting

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web