When setting up a server, what configuration changes do I need to make sure that all of the software uses /dev/urandom instead of /dev/random?

Some servers don't have much entropy in the entropy pool (e.g., VPSs). If a software component uses /dev/random, then it may block and cause the server to become mysteriously slower. Is there any software that comes out-of-the-box using /dev/random by default? If so, how can I configure it to force it to use /dev/urandom? It'd be nice to have a checklist of configuration settings to set, when setting up a new VPS environment.

  • Voted to close as too broad, for the reason explained in my answer on meta. – Gilles May 1 '12 at 0:21
  • 2
    @Gilles I dont think it's too broad, though admittedly a list of problematic programs would never be complete - but it would be effectively complete, once it covers most of the most common programs. And, it should continue to incrementally be added to.... Though I agree about the "one per answer". – AviD May 1 '12 at 7:54
  • 3
    Should be one answer to your own question, not six. Please merge them. @Gilles lol@"Welcome" :) – Jeff Ferland May 1 '12 at 8:38

General advice

Any program written in Java

Add

-Djava.security.egd=file:///dev/urandom switch

or

-Djava.security.egd=file:/dev/./urandom

to the command line invocation used to start the Java process. (Without this, Java uses /dev/random to seed its SecureRandom class, which can cause Java code to block unexpectedly.)

Alternatively, in the $JAVA_HOME/jre/lib/security/java.security configuration file, add the line

securerandom.source=file:/dev/./urandom

Footnote: In the above examples, you need the crazy-looking filename, e.g., the extra /./, to trick Java into accepting your filename. If you just use /dev/urandom, Java decides you didn't really mean it and replaces what you wrote with /dev/random. Craziness!

Chroot

If you are starting some service in a chroot environment, don't forget to create the /dev/urandom device inside your chroot directory.

Specific software

Apache mod_ssl

Use

SSLRandomSeed startup file:/dev/urandom 512
SSLRandomSeed connect file:/dev/urandom 512

in the mod_ssl configuration file. Avoid using file:/dev/random with SSLRandomSeed.

Cyrus POP3, IMAPD, and SASL

Compile Cyrus SASL (libsasl) with the configuration flag --with-devrandom=/dev/urandom.

By default, Cyrus POP3 reads from /dev/random. I couldn't find any configuration setting to change this, short of recompiling.

OpenLDAP

Add

TLSRandFile /dev/urandom

to the slapd.conf configuration file. (This hopefully should be the default, but some guides misleadingly suggest using /dev/random, so you might want to double-check.)

Postfix

Use

tls_random_source = dev:/dev/urandom

in the main.cf configuration file, or

sudo postconf -e 'tls_random_source = dev:/dev/urandom'

from the command line.

Everything:

As root, just do this:

rm /dev/random
mknod /dev/random c 1 9

Now /dev/random will actually access the same underlying logic as /dev/urandom.

After this change, both /dev/random and /dev/urandom will draw from the non-blocking pool. The non-blocking pool will draw from the blocking pool, which the system will still fill.

  • 4
    Yes, it's safe. After this change, /dev/random becomes just another name for /dev/urandom. So nothing you previously knew about /dev/random applies any more. (Specifically, it is no longer in any way associated with the pool that /dev/urandom draws off.) – David Schwartz May 1 '12 at 10:34
  • 12
    @Polynomial “/dev/urandom is seeded from entropy in /dev/random” is a shortcut. Actually, /dev/random and /dev/urandom are both doorways into the same driver inside Linux kernel. The entropy feed happens inside the kernel. Erasing the label on one of the doorways doesn't change what happens under the hood. – Gilles May 1 '12 at 10:55
  • 1
    afaik, freebsd is using prng for both /dev/urandom and /dev/random – Dog eat cat world May 3 '12 at 22:45
  • 1
    @Dogeatcatworld: A PRNG can either block or not block, it's still a PRNG. – David Schwartz May 4 '12 at 11:27
  • 1
    @Navin It does remove a safety against broken startup. You're still safe as long as your startup logic correctly seeds the entropy pool. If you're paranoid, you could add an extra startup script that runs after the pool is supposed to be seeded and checks to make sure that the pool actually was seeded and halts the system if it isn't. – David Schwartz Jan 7 '16 at 18:43

Great initiative by D.W. to list different software configurations (I am a die-out fan of D.W. already)

BUT - As I mentioned on my previous comment, On my VPS servers I personally still prefer to install one single component (haveged) that gets everything running smoothly.

Perhaps @DavidSchwartz's suggestion is the only one that could be even easier, but I haven't tried it.

Individually configuring each component instead of the underlying entropy pool sounds a little silly to me to be perfectly honest. When I have a problem, I try to solve the root cause and keep the DRY principle.

PHP

For PHP sessions you can use /dev/urandom as an entropy source

session.entropy_file = /dev/urandom

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.