What do I need to configure, to make sure my software uses /dev/urandom?

Question

When setting up a server, what configuration changes do I need to make sure that all of the software uses /dev/urandom instead of /dev/random?

Some servers don't have much entropy in the entropy pool (e.g., VPSs). If a software component uses /dev/random, then it may block and cause the server to become mysteriously slower. Is there any software that comes out-of-the-box using /dev/random by default? If so, how can I configure it to force it to use /dev/urandom? It'd be nice to have a checklist of configuration settings to set, when setting up a new VPS environment.

Answer 1

General advice

Any program written in Java

Add

-Djava.security.egd=file:///dev/urandom switch

or

-Djava.security.egd=file:/dev/./urandom

to the command line invocation used to start the Java process. (Without this, Java uses /dev/random to seed its SecureRandom class, which can cause Java code to block unexpectedly.)

Alternatively, in the $JAVA_HOME/jre/lib/security/java.security configuration file, add the line

securerandom.source=file:/dev/./urandom

Footnote: In the above examples, you need the crazy-looking filename, e.g., the extra /./, to trick Java into accepting your filename. If you just use /dev/urandom, Java decides you didn't really mean it and replaces what you wrote with /dev/random. Craziness!

Chroot

If you are starting some service in a chroot environment, don't forget to create the /dev/urandom device inside your chroot directory.

Specific software

Apache mod_ssl

Use

SSLRandomSeed startup file:/dev/urandom 512
SSLRandomSeed connect file:/dev/urandom 512

in the mod_ssl configuration file. Avoid using file:/dev/random with SSLRandomSeed.

Cyrus POP3, IMAPD, and SASL

Compile Cyrus SASL (libsasl) with the configuration flag --with-devrandom=/dev/urandom.

By default, Cyrus POP3 reads from /dev/random. I couldn't find any configuration setting to change this, short of recompiling.

OpenLDAP

Add

TLSRandFile /dev/urandom

to the slapd.conf configuration file. (This hopefully should be the default, but some guides misleadingly suggest using /dev/random, so you might want to double-check.)

Postfix

Use

tls_random_source = dev:/dev/urandom

in the main.cf configuration file, or

sudo postconf -e 'tls_random_source = dev:/dev/urandom'

from the command line.

Answer 2

Everything:

As root, just do this:

rm /dev/random
mknod /dev/random c 1 9

Now /dev/random will actually access the same underlying logic as /dev/urandom.

After this change, both /dev/random and /dev/urandom will draw from the non-blocking pool. The non-blocking pool will draw from the blocking pool, which the system will still fill.

Answer 3

Great initiative by D.W. to list different software configurations (I am a die-out fan of D.W. already)

BUT - As I mentioned on my previous comment, On my VPS servers I personally still prefer to install one single component (haveged) that gets everything running smoothly.

Perhaps @DavidSchwartz's suggestion is the only one that could be even easier, but I haven't tried it.

Individually configuring each component instead of the underlying entropy pool sounds a little silly to me to be perfectly honest. When I have a problem, I try to solve the root cause and keep the DRY principle.

Answer 4

PHP

For PHP sessions you can use /dev/urandom as an entropy source

session.entropy_file = /dev/urandom

Answer 5

JAVA Application/Server

I would recommended to read the Everything about Java's SecureRandom article.

TL;DR

You have two options:

1. set the java.security.egd system property to file:/dev/urandom. The easiest option is to configure it by using the JAVA_TOOL_OPTIONS environment variable:

   export JAVA_TOOL_OPTIONS = '-Djava.security.egd=file:/dev/urandom'
   

2. set the securerandom.source security property in the Java Security file to file:/dev/urandom:

   securerandom.source=file:/dev/urandom
   

   It could be defined in the following locations:

   • $JAVA_HOME/jre/lib/security/java.security (all JDK versions)
   • $JAVA_HOME/conf/security (JDK 9+)

Don't use /dev/./urandom

Don't use the mentioned file:/dev/./urandom path. The sun.security.provider.SeedGenerator class supports paths as follow:

• for /dev/random and /dev/urandom it creates an instance of the NativeSeedGenerator class. For Unix the implementation is very simple (see the class):

    class NativeSeedGenerator extends SeedGenerator.URLSeedGenerator {
  
        NativeSeedGenerator(String seedFile) throws IOException {
            super(seedFile);
        }
  
    }
  

  It only extends the sun.security.provider.SeedGenerator.URLSeedGenerator class.

• for all other paths it creates an instance of the sun.security.provider.SeedGenerator.URLSeedGenerator class with the configured path.

It generally means that setting /dev/./urandom works the same as setting /dev/urandom. There is only one difference - it works only on Unix machines. On Windows it throws IOException because /dev/./urandom is an invalid path. /dev/urandom works because for this path a new instance of the Windows compatible NativeSeedGenerator class is created.

The core part of the sun.security.provider.SeedGenerator class:

/*
 * Try the URL specifying the source (e.g. file:/dev/random)
 *
 * The URLs "file:/dev/random" or "file:/dev/urandom" are used to
 * indicate the SeedGenerator should use OS support, if available.
 *
 * On Windows, this causes the MS CryptoAPI seeder to be used.
 *
 * On Solaris/Linux/MacOS, this is identical to using
 * URLSeedGenerator to read from /dev/[u]random
 */
if (egdSource.equals(SunEntries.URL_DEV_RANDOM) ||
        egdSource.equals(SunEntries.URL_DEV_URANDOM)) {
    try {
        instance = new NativeSeedGenerator(egdSource);
        if (debug != null) {
            debug.println(
                "Using operating system seed generator" + egdSource);
        }
    } catch (IOException e) {
        if (debug != null) {
            debug.println("Failed to use operating system seed "
                          + "generator: " + e.toString());
        }
    }
} else if (egdSource.length() != 0) {
    try {
        instance = new URLSeedGenerator(egdSource);
        if (debug != null) {
            debug.println("Using URL seed generator reading from "
                          + egdSource);
        }
    } catch (IOException e) {
        if (debug != null) {
            debug.println("Failed to create seed generator with "
                          + egdSource + ": " + e.toString());
        }
    }
}