Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1

From	Kurt Roeckx <kurt@roeckx.be>
Newsgroups	linux.debian.bugs.dist, linux.kernel
Subject	Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1
Date	2018-10-30 19:40 +0100
Message-ID	<wOH5M-24D-15@gated-at.bofh.it> (permalink)
References	<wOomu-7SK-15@gated-at.bofh.it> <wOq4V-u7-1@gated-at.bofh.it> <wOD29-8ce-1@gated-at.bofh.it> <wNLXP-1Xv-1@gated-at.bofh.it> <wOD29-8ce-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

On Tue, Oct 30, 2018 at 10:15:44AM -0400, Theodore Y. Ts'o wrote:
> On Tue, Oct 30, 2018 at 01:18:08AM +0100, Sebastian Andrzej Siewior wrote:
> > Using ioctl(/dev/urandom, RNDADDENTROPY, ) instead writting to
> > /dev/urandom would do the trick. Or using RNDADDTOENTCNT to increment
> > the entropy count after it was written. Those two are documented in
> > random(4). Or RNDRESEEDCRNG could be used to force crng to be reseeded.
> > It does also the job, too.
> > 
> > Ted, is there any best practise what to do with the seed which as
> > extrected from /dev/urandom on system shutdown? Using RNDADDTOENTCNT to
> > speed up init or just write to back to urandom and issue RNDRESEEDCRNG?
> 
> The reason why writing to /dev/[u]random via something like:
> 
>     cat /var/lib/random/seed > /dev/random
> 
> Dosn't bump the the entropy counter is because it's possible that an
> attacker could read /var/lib/random/seed.  Even if the seed file is
> refreshed on shutdown, (a) the attacker could have read the file while
> the system is down, or (b) the system could have crashed so the seed
> file was not refreshed and the attacker could have read the file
> before the crash.

So are you saying that the /var/lib/random/seed is untrusted, and
should never be used, and we should always wait for fresh entropy?

Anyway, I think if an attacker somehow has access to that file,
you have much more serious problems.


Kurt

Thread

Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2018-10-30 01:30 +0100
  Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 "Theodore Y. Ts'o" <tytso@mit.edu> - 2018-10-30 15:20 +0100
    Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Kurt Roeckx <kurt@roeckx.be> - 2018-10-30 19:40 +0100
      Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 "Theodore Y. Ts'o" <tytso@mit.edu> - 2018-10-30 22:00 +0100
        Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2018-10-31 13:00 +0100
          Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 "Theodore Y. Ts'o" <tytso@mit.edu> - 2018-10-31 23:50 +0100
            Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2018-11-01 23:30 +0100
              Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 "Theodore Y. Ts'o" <tytso@mit.edu> - 2018-11-02 01:00 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Kurt Roeckx <kurt@roeckx.be> - 2018-11-02 01:30 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 "Theodore Y. Ts'o" <tytso@mit.edu> - 2018-11-02 03:20 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2018-11-04 01:30 +0100

csiph-web