Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #926023

Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1

Cross-posted to 2 groups.

Show all headers | View raw

On 2018-11-01 19:50:35 [-0400], Theodore Y. Ts'o wrote:
> On Thu, Nov 01, 2018 at 11:18:14PM +0100, Sebastian Andrzej Siewior wrote:
> > Okay. So you wrote what can be done for a system with HW-RNG/kvm. On
> > bare metal with nothing fancy I have:
> > [    3.544985] systemd[1]: systemd 239 running in system mode. (+PAM…
> > [   10.363377] r8169 0000:05:00.0 eth0: link up
> > [   41.966375] random: crng init done
> > 
> > which means I have to wait about half a minute until I can ssh into. And
> > there is no way to speed it up?
> 
> So that surprises me.  Can you tell me more about the hardware?  Is it
> something like a Rasberry Pi?  Or is it an x86 server or desktop?  In
> my experience for most x86 platforms this isn't an issue.

another boot on the same box:
|  dmesg |grep -i random
| [    0.000000] random: get_random_bytes called from start_kernel+0x94/0x52e with crng_init=0
| [    1.774332] random: fast init done
| [    7.318640] random: systemd: uninitialized urandom read (16 bytes read)
| [    7.318925] random: systemd: uninitialized urandom read (16 bytes read)
| [    7.338074] random: systemd: uninitialized urandom read (16 bytes read)
| [   68.791389] random: crng init done
| [   68.791397] random: 7 urandom warning(s) missed due to ratelimiting

This is a headless i7-Sandy Bridge. A small rootfs partition and there
are hardly any daemons comming up. It waits for a remote login. Running
Debian unstable (incl. kernel).

> The main reason why I've talked about VM system is because this is
> where it where most of the problems that people ahve reported to me.
Yes. Thanks for that. I have another box which I use as a desktop
machine (basically a terminal). It is older than the i7 but I unlock the
crypted root disk as part of the boot process and I assume that due to
this it initializes in less than 10secs. Same goes for my notebook.  But
the i7 has just two cables…

> So if I make a blanket recommendation, and it causes Debian to ship
> some kind of default that causes Debian users to be insecure, I'm
> going to be feel really bad.  This is why I'm very cautious about what
> I say.  If you want to do whatever you want on your own system, hey
> consulting adults can do whatever they want.  :-)

I have a few other headless boxes but those are newer and support
RDRAND. I assume that this makes a difference because otherwise I don't
see a difference (and they don't take long to init).

> > You did not oppose RNDADDTOENTCNT/RNDADDENTROPY but you wanted to make
> > it configureable and not default, correct?
> 
> I'd want to see a full design doc, or a git repository, or set of
> changes before I give it an unqualified endorsement, but there *are*
> configurations where such a thing would be sane.
> 
> That's the problem with security recommendations.  It's much like a
> lawyer giving legal advice.  They're very careful about doing that in
> an unstructured circumstances.  If it gets taken in the wrong way,
> they could be legally liable and people might blame/sue them.
> 
> And then on top of that, there are the political considerations.
> Suppose I told you, "just use RDRAND and be happy".  Some people who
> sure that RDRAND has been backdoored would claim that I'm in the
> pocket of the NSA and/or Intel.  That's why all I'm going to say is,
> "I'm comfortable turning RDRAND on my own systems; you can do what you
> want."

Okay, okay. Let sum that up:
- openssh uses openssl's random number generator which now uses
  getrandom().
- getrandom() blocks until the random pool is initializes. Can be
  checked in dmesg:
  [  TIME.STAMP] random: crng init done
  This wasn't the case earlier where /dev/urandom was used.
- random entropy like interrupts or HW random support (<ad> chaos
  key</ad>) will speed the initalisation process up.
- emulated hardware / KVM can take long to init but it helps if a hw-rnd
  device is added as part of qemu setup.
- it is possible to manually increase the entropy count and/or tell the
  random pool to init asap but it shouldn't be done because it will
  probably lead to weak random pool and probably used in wrong setups.

> Cheers,
> 
> 						- Ted
> 
> P.S…
> I
> certainly would recommend that you spend the $40 USD to get a Chaos
> Key and just be *done* with it.

I do own a Nitrokey which can create random. That is not the problem. I
just have one devel box which requires me to wait a minute before I can
login and I have to figure out how to deal with it.

Sebastian

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 jim_p <pitsiorisj@gmail.com> - 2018-10-28 06:40 +0100
  Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Bernhard Übelacker <bernhardu@mailbox.org> - 2018-10-28 11:50 +0100
    Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Colin Watson <cjwatson@debian.org> - 2018-10-28 19:50 +0100
      Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Bernhard Übelacker <bernhardu@mailbox.org> - 2018-10-29 01:00 +0100
        Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Colin Watson <cjwatson@debian.org> - 2018-10-29 01:40 +0100
          Bug#912087: [Pkg-openssl-devel] Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Kurt Roeckx <kurt@roeckx.be> - 2018-10-29 08:40 +0100
            Bug#912087: [Pkg-openssl-devel] Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Kurt Roeckx <kurt@roeckx.be> - 2018-10-29 18:30 +0100
              Bug#912087: [Pkg-openssl-devel] Bug#912087: Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2018-10-29 22:10 +0100
                Bug#912087: [Pkg-openssl-devel] Bug#912087: Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Kurt Roeckx <kurt@roeckx.be> - 2018-10-29 23:40 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2018-10-30 01:30 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Michael Biebl <biebl@debian.org> - 2018-10-30 03:40 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 "Theodore Y. Ts'o" <tytso@mit.edu> - 2018-10-30 15:20 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Kurt Roeckx <kurt@roeckx.be> - 2018-10-30 19:40 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 "Theodore Y. Ts'o" <tytso@mit.edu> - 2018-10-30 22:00 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2018-10-31 13:00 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 "Theodore Y. Ts'o" <tytso@mit.edu> - 2018-10-31 23:50 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2018-11-01 23:30 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 "Theodore Y. Ts'o" <tytso@mit.edu> - 2018-11-02 01:00 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Kurt Roeckx <kurt@roeckx.be> - 2018-11-02 01:30 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 "Theodore Y. Ts'o" <tytso@mit.edu> - 2018-11-02 03:20 +0100
                Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2018-11-04 01:30 +0100
  Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 jim_p <pitsiorisj@gmail.com> - 2018-10-29 06:30 +0100
  Bug#912087: [Pkg-openssl-devel] Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Kurt Roeckx <kurt@roeckx.be> - 2018-10-29 22:00 +0100
  Bug#912087: openssh-server: Slow startup after the upgrade to 7.9p1 Olaf van der Spek <olafvdspek@gmail.com> - 2018-11-18 10:50 +0100

csiph-web