Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #211155
| From | Reco <recoverym4n@enotuniq.net> |
|---|---|
| Newsgroups | linux.debian.user |
| Subject | Re: fix for no ssh |
| Date | 2019-07-10 14:30 +0200 |
| Message-ID | <yijTr-7Z-1@gated-at.bofh.it> (permalink) |
| References | (5 earlier) <yhEZX-ug-11@gated-at.bofh.it> <yhTvX-14m-1@gated-at.bofh.it> <yifZw-6fY-19@gated-at.bofh.it> <yih5f-6Sz-1@gated-at.bofh.it> <yijgJ-87J-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
Hi.
On Wed, Jul 10, 2019 at 11:46:33AM +0000, Andy Smith wrote:
> > Further, I would like to know whether the patch will be "baked into the
> > kernel" or whether it can be toggled on and/or off at the *user's*
> > discretion. I don't remember being clear on this point after reading the
> > notes (maybe it's there and I missed it).
> >
> > It wasn't clear to me, either, in the release-notes, the recommended way
> > forward for those with amd64 cpus lacking the RDRAND instruction (and who
> > therefore cannot "benefit" from the patch).
>
> ... Neither of them say how to disable it but they do say:
>
> for amd64: use a recent kernel with CONFIG_RANDOM_TRUST_CPU set
> (less recent kernels may need random.trust_cpu=on added to the
> commandline)
>
> which kind of makes it obvious to me that to disable it you would do
> "random.trust_cpu=off".
Pfft. Wiki. Trust the source (in this case, drivers/char/random.c with
Debian patches applied):
static bool trust_cpu __ro_after_init =
IS_ENABLED(CONFIG_RANDOM_TRUST_CPU);
static int __init parse_trust_cpu(char *arg)
{
return kstrtobool(arg, &trust_cpu);
}
early_param("random.trust_cpu", parse_trust_cpu);
First things first, CONFIG_RANDOM_TRUST_CPU (the name could use some
improvement. Is it "trust randomly"? "random trusts cpu"? Whatever) is a
simple default value, there's no #ifdefs.
Second, a kernel parses cmdline (aka /proc/cmdline), to set "trust"
value if it encounters "random.trust_cpu=foo".
Second, this wonderful remark (you don't have a usable /dev/urandom
immediately after the boot):
/*
* Get a random word for internal kernel use only. The quality of the
* random number is either as good as RDRAND or as good as /dev/urandom,
* with the goal of being quite fast and not depleting entropy.
*/
So, you trust RDRAND for the initial internal kernel CRNG initialization
as there's nothing else. If it's controlled by certain three letter
acronym agency - your kernel is screwed big time right after the boot.
The good news are - it's x86(_64) only (and if you're using it there are
*other* creative ways to screw you), and it can be disabled with
"random.trust_cpu=off".
Reco
Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
fix for no ssh Gene Heskett <gheskett@shentel.net> - 2019-07-07 16:30 +0200
Re: fix for no ssh Tixy <tixy@yxit.co.uk> - 2019-07-07 16:50 +0200
Re: fix for no ssh Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-07 18:50 +0200
Re: fix for no ssh Nicholas Geovanis <nickgeovanis@gmail.com> - 2019-07-07 19:50 +0200
Re: fix for no ssh Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-08 09:00 +0200
Re: fix for no ssh Curt <curty@free.fr> - 2019-07-08 11:10 +0200
Re: fix for no ssh Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-08 12:20 +0200
Re: fix for no ssh Curt <curty@free.fr> - 2019-07-08 13:00 +0200
Re: fix for no ssh Curt <curty@free.fr> - 2019-07-08 16:50 +0200
Re: fix for no ssh Greg Wooledge <wooledg@eeg.ccf.org> - 2019-07-08 17:40 +0200
Re: fix for no ssh Curt <curty@free.fr> - 2019-07-08 18:20 +0200
Re: fix for no ssh Andy Smith <andy@strugglers.net> - 2019-07-08 18:50 +0200
Re: fix for no ssh Curt <curty@free.fr> - 2019-07-09 10:20 +0200
Re: fix for no ssh Andy Smith <andy@strugglers.net> - 2019-07-10 10:20 +0200
Re: fix for no ssh Curt <curty@free.fr> - 2019-07-10 11:30 +0200
Re: fix for no ssh Andy Smith <andy@strugglers.net> - 2019-07-10 13:50 +0200
Re: fix for no ssh Reco <recoverym4n@enotuniq.net> - 2019-07-10 14:30 +0200
Re: fix for no ssh Greg Wooledge <wooledg@eeg.ccf.org> - 2019-07-10 15:10 +0200
Re: fix for no ssh Curt <curty@free.fr> - 2019-07-10 16:10 +0200
Re: fix for no ssh Andy Smith <andy@strugglers.net> - 2019-07-11 14:10 +0200
Re: fix for no ssh Reco <recoverym4n@enotuniq.net> - 2019-07-11 16:20 +0200
Re: fix for no ssh Andy Smith <andy@strugglers.net> - 2019-07-11 17:10 +0200
Re: fix for no ssh Reco <recoverym4n@enotuniq.net> - 2019-07-11 17:20 +0200
Re: fix for no ssh Curt <curty@free.fr> - 2019-07-10 16:00 +0200
Re: fix for no ssh David Wright <deblis@lionunicorn.co.uk> - 2019-07-10 21:20 +0200
Re: fix for no ssh Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-10 21:30 +0200
[OT] Trustfulness. Was: Re: fix for no ssh "Thomas Schmitt" <scdbackup@gmx.net> - 2019-07-08 18:00 +0200
Re: [OT] Trustfulness. Was: Re: fix for no ssh Reco <recoverym4n@enotuniq.net> - 2019-07-08 18:10 +0200
Re: fix for no ssh Andy Smith <andy@strugglers.net> - 2019-07-08 18:10 +0200
Re: fix for no ssh Henrique de Moraes Holschuh <hmh@debian.org> - 2019-07-09 01:30 +0200
Re: fix for no ssh Curt <curty@free.fr> - 2019-07-08 10:50 +0200
Re: fix for no ssh Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-08 11:00 +0200
Re: fix for no ssh Curt <curty@free.fr> - 2019-07-08 11:20 +0200
Re: fix for no ssh Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-08 11:30 +0200
Re: fix for no ssh Curt <curty@free.fr> - 2019-07-08 11:50 +0200
Re: fix for no ssh Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-08 12:00 +0200
Re: fix for no ssh Curt <curty@free.fr> - 2019-07-08 12:30 +0200
Re: fix for no ssh Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-08 18:30 +0200
Re: fix for no ssh Curt <curty@free.fr> - 2019-07-08 19:50 +0200
Re: fix for no ssh Andy Smith <andy@strugglers.net> - 2019-07-08 20:20 +0200
Re: fix for no ssh Gene Heskett <gheskett@shentel.net> - 2019-07-08 21:00 +0200
Re: fix for no ssh Andy Smith <andy@strugglers.net> - 2019-07-08 22:50 +0200
Fwd: fix for no ssh Nicholas Geovanis <nickgeovanis@gmail.com> - 2019-07-08 23:50 +0200
Re: Fwd: fix for no ssh Andy Smith <andy@strugglers.net> - 2019-07-09 00:40 +0200
Re: fix for no ssh John Hasler <jhasler@newsguy.com> - 2019-07-09 01:20 +0200
Re: fix for no ssh Nicholas Geovanis <nickgeovanis@gmail.com> - 2019-07-09 01:30 +0200
Re: fix for no ssh Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-09 09:50 +0200
Re: fix for no ssh Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-08 23:00 +0200
Re: fix for no ssh Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-08 23:00 +0200
Re: fix for no ssh Curt <curty@free.fr> - 2019-07-10 09:50 +0200
Re: fix for no ssh Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-10 21:40 +0200
Re: fix for no ssh David Wright <deblis@lionunicorn.co.uk> - 2019-07-09 01:30 +0200
Re: fix for no ssh Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-09 10:00 +0200
Re: fix for no ssh David Wright <deblis@lionunicorn.co.uk> - 2019-07-10 01:20 +0200
Re: fix for no ssh Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-10 05:40 +0200
Re: fix for no ssh Gene Heskett <gheskett@shentel.net> - 2019-07-07 22:50 +0200
csiph-web