Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When setting up a server, what configuration changes do I need to make sure that all of the software uses /dev/urandom instead of /dev/random?

Some servers don't have much entropy in the entropy pool (e.g., VPSs). If a software component uses /dev/random, then it may block and cause the server to become mysteriously slower. Is there any software that comes out-of-the-box using /dev/random by default? If so, how can I configure it to force it to use /dev/urandom? It'd be nice to have a checklist of configuration settings to set, when setting up a new VPS environment.

share|improve this question
    
Welcome to Stack Exchange. Please read the faq. This is a good question; I've removed the bit about “one piece of software per answer”, which would make it look like it's calling for a list of items rather than proper answers. –  Gilles Apr 30 '12 at 23:04
    
Gilles, I have read the faq, and I still prefer "one piece of software per answer" so that people can vote separately on each, and to organize things more cleanly. I believe this complies with the rules: if you disagree, let's take the discussion to Meta. –  D.W. Apr 30 '12 at 23:53
    
Voted to close as too broad, for the reason explained in my answer on meta. –  Gilles May 1 '12 at 0:21
    
@Gilles I dont think it's too broad, though admittedly a list of problematic programs would never be complete - but it would be effectively complete, once it covers most of the most common programs. And, it should continue to incrementally be added to.... Though I agree about the "one per answer". –  AviD May 1 '12 at 7:54
2  
Should be one answer to your own question, not six. Please merge them. @Gilles lol@"Welcome" :) –  Jeff Ferland May 1 '12 at 8:38

4 Answers 4

Everything:

As root, just do this:

rm /dev/random
mknod /dev/random c 1 9

Now /dev/random will actually access the same underlying logic as /dev/urandom.

After this change, both /dev/random and /dev/urandom will draw from the non-blocking pool. The non-blocking pool will draw from the blocking pool, which the system will still fill.

share|improve this answer
    
Is this safe? I was under the impression that /dev/urandom is seeded from entropy in /dev/random - wouldn't such an operation cause /dev/urandom to end up seeding itself, using only a CSPRNG and no new entropy? –  Polynomial May 1 '12 at 9:43
3  
Yes, it's safe. After this change, /dev/random becomes just another name for /dev/urandom. So nothing you previously knew about /dev/random applies any more. (Specifically, it is no longer in any way associated with the pool that /dev/urandom draws off.) –  David Schwartz May 1 '12 at 10:34
5  
@Polynomial “/dev/urandom is seeded from entropy in /dev/random” is a shortcut. Actually, /dev/random and /dev/urandom are both doorways into the same driver inside Linux kernel. The entropy feed happens inside the kernel. Erasing the label on one of the doorways doesn't change what happens under the hood. –  Gilles May 1 '12 at 10:55
    
Makes sense. Thanks :) –  Polynomial May 1 '12 at 12:11
    
afaik, freebsd is using prng for both /dev/urandom and /dev/random –  Dog eat cat world May 3 '12 at 22:45

General advice

Any program written in Java

Add

-Djava.security.egd=file:///dev/urandom switch

or

-Djava.security.egd=file:/dev/./urandom

to the command line invocation used to start the Java process. (Without this, Java uses /dev/random to seed its SecureRandom class, which can cause Java code to block unexpectedly.)

Alternatively, in the $JAVA_HOME/jre/lib/security/java.security configuration file, add the line

securerandom.source=file:/dev/./urandom

Footnote: In the above examples, you need the crazy-looking filename, e.g., the extra /./, to trick Java into accepting your filename. If you just use /dev/urandom, Java decides you didn't really mean it and replaces what you wrote with /dev/random. Craziness!

Chroot

If you are starting some service in a chroot environment, don't forget to create the /dev/urandom device inside your chroot directory.

Specific software

Apache mod_ssl

Use

SSLRandomSeed startup file:/dev/urandom 512
SSLRandomSeed connect file:/dev/urandom 512

in the mod_ssl configuration file. Avoid using file:/dev/random with SSLRandomSeed.

Cyrus POP3, IMAPD, and SASL

Compile Cyrus SASL (libsasl) with the configuration flag --with-devrandom=/dev/urandom.

By default, Cyrus POP3 reads from /dev/random. I couldn't find any configuration setting to change this, short of recompiling.

OpenLDAP

Add

TLSRandFile /dev/urandom

to the slapd.conf configuration file. (This hopefully should be the default, but some guides misleadingly suggest using /dev/random, so you might want to double-check.)

Postfix

Use

tls_random_source = dev:/dev/random

in the main.cf configuration file, or

sudo postconf -e 'tls_random_source = dev:/dev/urandom'

from the command line.

share|improve this answer

Great initiative by D.W. to list different software configurations (I am a die-out fan of D.W. already)

BUT - As I mentioned on my previous comment, On my VPS servers I personally still prefer to install one single component (haveged) that gets everything running smoothly.

Perhaps @DavidSchwartz's suggestion is the only one that could be even easier, but I haven't tried it.

Individually configuring each component instead of the underlying entropy pool sounds a little silly to me to be perfectly honest. When I have a problem, I try to solve the root cause and keep the DRY principle.

share|improve this answer

PHP

For PHP sessions you can use /dev/urandom as an entropy source

session.entropy_file = /dev/urandom
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.