Groups > linux.debian.bugs.dist > #925642

Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1

From	"Theodore Y. Ts'o" <tytso@mit.edu>
Newsgroups	linux.debian.bugs.dist, linux.kernel
Subject	Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1
Date	2018-11-02 01:00 +0100
Message-ID	<wPv2x-6wZ-7@gated-at.bofh.it> (permalink)
References	(5 earlier) <wOXke-3om-13@gated-at.bofh.it> <wP7tf-103-5@gated-at.bofh.it> <wPtDs-5Qa-25@gated-at.bofh.it> <wNLXP-1Xv-1@gated-at.bofh.it> <wPtDs-5Qa-25@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

On Thu, Nov 01, 2018 at 11:18:14PM +0100, Sebastian Andrzej Siewior wrote:
> Okay. So you wrote what can be done for a system with HW-RNG/kvm. On
> bare metal with nothing fancy I have:
> [    3.544985] systemd[1]: systemd 239 running in system mode. (+PAM…
> [   10.363377] r8169 0000:05:00.0 eth0: link up
> [   41.966375] random: crng init done
> 
> which means I have to wait about half a minute until I can ssh into. And
> there is no way to speed it up?

So that surprises me.  Can you tell me more about the hardware?  Is it
something like a Rasberry Pi?  Or is it an x86 server or desktop?  In
my experience for most x86 platforms this isn't an issue.

The main reason why I've talked about VM system is because this is
where it where most of the problems that people ahve reported to me.

Here's the problem: if we "speed it up" inappropriately, you're
risking the security of the ssh.  If people who are making a print
server or Wifi Rounter who screw it up, they're the ones who are at
fault.  (And this isn't hypothetical.  See https://factorable.net)

So if I make a blanket recommendation, and it causes Debian to ship
some kind of default that causes Debian users to be insecure, I'm
going to be feel really bad.  This is why I'm very cautious about what
I say.  If you want to do whatever you want on your own system, hey
consulting adults can do whatever they want.  :-)

> You did not oppose RNDADDTOENTCNT/RNDADDENTROPY but you wanted to make
> it configureable and not default, correct?

I'd want to see a full design doc, or a git repository, or set of
changes before I give it an unqualified endorsement, but there *are*
configurations where such a thing would be sane.

That's the problem with security recommendations.  It's much like a
lawyer giving legal advice.  They're very careful about doing that in
an unstructured circumstances.  If it gets taken in the wrong way,
they could be legally liable and people might blame/sue them.

And then on top of that, there are the political considerations.
Suppose I told you, "just use RDRAND and be happy".  Some people who
sure that RDRAND has been backdoored would claim that I'm in the
pocket of the NSA and/or Intel.  That's why all I'm going to say is,
"I'm comfortable turning RDRAND on my own systems; you can do what you
want."

Cheers,

						- Ted

P.S.  Although if I were going to generate a high-value key, I *would*
plug in my handy-dandy Chaos Key[1] first.  Keith gave a
presentation[2] about it at Debconf 16.

[1] https://keithp.com/blogs/chaoskey/
[2] https://debconf16.debconf.org/talks/94/

And certainly if you were doing something where you had millions of
dollars at risk, or where the EU might fine you into oblivion for
millions of Euros due to some privacy exposure of your users, I
certainly would recommend that you spend the $40 USD to get a Chaos
Key and just be *done* with it.

Thread

Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 jim_p <pitsiorisj@gmail.com> - 2018-10-28 06:40 +0100
  Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Bernhard Übelacker <bernhardu@mailbox.org> - 2018-10-28 11:50 +0100
    Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Colin Watson <cjwatson@debian.org> - 2018-10-28 19:50 +0100
      Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Bernhard Übelacker <bernhardu@mailbox.org> - 2018-10-29 01:00 +0100
        Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Colin Watson <cjwatson@debian.org> - 2018-10-29 01:40 +0100
          Bug#912087: [Pkg-openssl-devel] Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Kurt Roeckx <kurt@roeckx.be> - 2018-10-29 08:40 +0100
            Bug#912087: [Pkg-openssl-devel] Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Kurt Roeckx <kurt@roeckx.be> - 2018-10-29 18:30 +0100
              Bug#912087: [Pkg-openssl-devel] Bug#912087: Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2018-10-29 22:10 +0100
                Bug#912087: [Pkg-openssl-devel] Bug#912087: Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Kurt Roeckx <kurt@roeckx.be> - 2018-10-29 23:40 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2018-10-30 01:30 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Michael Biebl <biebl@debian.org> - 2018-10-30 03:40 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 "Theodore Y. Ts'o" <tytso@mit.edu> - 2018-10-30 15:20 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Kurt Roeckx <kurt@roeckx.be> - 2018-10-30 19:40 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 "Theodore Y. Ts'o" <tytso@mit.edu> - 2018-10-30 22:00 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2018-10-31 13:00 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 "Theodore Y. Ts'o" <tytso@mit.edu> - 2018-10-31 23:50 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2018-11-01 23:30 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 "Theodore Y. Ts'o" <tytso@mit.edu> - 2018-11-02 01:00 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Kurt Roeckx <kurt@roeckx.be> - 2018-11-02 01:30 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 "Theodore Y. Ts'o" <tytso@mit.edu> - 2018-11-02 03:20 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2018-11-04 01:30 +0100
  Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 jim_p <pitsiorisj@gmail.com> - 2018-10-29 06:30 +0100
  Bug#912087: [Pkg-openssl-devel] Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Kurt Roeckx <kurt@roeckx.be> - 2018-10-29 22:00 +0100
  Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Olaf van der Spek <olafvdspek@gmail.com> - 2018-11-18 10:50 +0100

csiph-web