Reduce timeout when Setting entropy source to blo

chris (2006-05-02 16:31:52)
2732 views
0 replies
I found myself getting frustrated having to wait 5 mins every time I booted my new freeBSD system, because it was waiting for a bunch of 'random junk' from stdin with which to seed its random number generator. Initially this seems a sensible, pious way of increasing security on freshly booted systems, but on a headless box it's just a nuicence. I found the offending value under /etc/rc.d/sshd -

#!/bin/sh
#
# $NetBSD: sshd,v 1.18 2002/04/29 08:23:34 lukem Exp $
# $FreeBSD: src/etc/rc.d/sshd,v 1.8 2005/01/16 03:12:03 obrien Exp $
#

# PROVIDE: sshd
# REQUIRE: LOGIN cleanvar

. /etc/rc.subr

name="sshd"
rcvar=`set_rcvar`
keygen_cmd="sshd_keygen"
start_precmd="sshd_precmd"
pidfile="/var/run/${name}.pid"
extra_commands="keygen reload"

timeout=300   #  /dev/null`
        if [ "${seeded}" != "" ] ; then
                warn "Setting entropy source to blocking mode."
                echo "===================================================="
                echo "Type a full screenful of random junk to unblock"
                echo "it and remember to finish with . This will"
                echo "timeout in ${timeout} seconds, but waiting for"
                echo "the timeout without typing junk may make the"
                echo "entropy source deliver predictable output."
                echo ""
                echo "Just hit  for fast+insecure startup."
                echo "===================================================="
                sysctl kern.random.sys.seeded=0 2>/dev/null
                read -t ${timeout} junk
                echo "${junk}" `sysctl -a` `date` > /dev/random
        fi
        )
}

so just changing that value from 300 to 3 should do the trick. Note, you'll have to chmod 755 the file (as root) first - just don't forget to chmod 555 it back when you've finished. My feeling is that the kernel will get all the entropy it needs from system interrupts, network activity, disc reads etc anyway, so unless somebody is brute forcing my box at this very instant things should be just fine..

Now time to reboot -

christo
comment