You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@perl.apache.org by Stas Bekman <st...@stason.org> on 2004/12/23 00:11:30 UTC
how to raise entropy
The story goes like this, I run a smoke of some 70+ mp2 configurations
every other night, and very often I had the test suite hang on startup.
when I'd run things manually everything will work just fine.
most of the time the error log will stop at:
[Wed Dec 22 03:57:01 2004] [notice] Digest: generating secret for digest
authentication ...
so what I suspect is that Apache tries to get data from /dev/(u?)random
which blocks if it doesn't have enough entropy and hence we timeout. Now
when I tap-tap-tap on my keyboard the entropy is happily generated, though
when I'm asleep and nothing happens on my notebook the entropy device has
not enough inputs to satisfy the software demands. Of course this is just
an idea. I should have really run the nightly smoke with strace to see
where it blocks for real.
So any idea how to feed the entropy device, other than waking up every 15
minutes to hug my notebook?
This can also help this problem reported not once by users:
http://perl.apache.org/docs/2.0/user/troubleshooting/troubleshooting.html#Server_Hanging_at_the_Startup
--
__________________________________________________________________
Stas Bekman JAm_pH ------> Just Another mod_perl Hacker
http://stason.org/ mod_perl Guide ---> http://perl.apache.org
mailto:stas@stason.org http://use.perl.org http://apacheweek.com
http://modperlbook.org http://apache.org http://ticketmaster.com
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org
Re: how to raise entropy
Posted by Stas Bekman <st...@stason.org>.
Garrett Rooney wrote:
> Stas Bekman wrote:
>
>>> Use /dev/urandom, which will not block.
>>
>>
>>
>> It's not us who uses it, but Apache, so it's not under our control.
>> Notice that Digest: generating secret for digest authentication ... is
>> coming from an apache module.
>
>
> I believe you can compile APR to use urandom instead of random, which
> should cause Apache to use it as well (unless Apache is accessing
> /dev/random on it's own, which I doubt). See the --with-devrandom flag
> for APRs configure.
Right, this is documented here:
http://perl.apache.org/docs/2.0/user/troubleshooting/troubleshooting.html#Server_Hanging_at_the_Startup
and it also says: however, that is not secure for certain needs.
--
__________________________________________________________________
Stas Bekman JAm_pH ------> Just Another mod_perl Hacker
http://stason.org/ mod_perl Guide ---> http://perl.apache.org
mailto:stas@stason.org http://use.perl.org http://apacheweek.com
http://modperlbook.org http://apache.org http://ticketmaster.com
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org
Re: how to raise entropy
Posted by Garrett Rooney <ro...@electricjellyfish.net>.
Stas Bekman wrote:
>> Use /dev/urandom, which will not block.
>
>
> It's not us who uses it, but Apache, so it's not under our control.
> Notice that Digest: generating secret for digest authentication ... is
> coming from an apache module.
I believe you can compile APR to use urandom instead of random, which
should cause Apache to use it as well (unless Apache is accessing
/dev/random on it's own, which I doubt). See the --with-devrandom flag
for APRs configure.
-garrett
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org
Re: how to raise entropy
Posted by Markus Wichitill <ma...@gmx.de>.
Stas Bekman wrote:
> Jie Gao wrote:
>> Use /dev/urandom, which will not block.
>
> It's not us who uses it, but Apache, so it's not under our control.
> Notice that Digest: generating secret for digest authentication ... is
> coming from an apache module.
If mod_ssl is enabled, too, you could set the SSLRandomSeed directive to
point to a static file, leaving more /dev/random bytes for mod_auth_digest.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org
Re: how to raise entropy
Posted by Stas Bekman <st...@stason.org>.
Philippe M. Chiasson wrote:
> Also, if your hardware is running a 2.6 kernel, try to insmod hw_random
> and if
> that reports finding something like :
>
> hw_random: AMD768 system management I/O registers at 0x5000.
> hw_random hardware driver 1.0.0 loaded
>
> Then you can just start /usr/sbin/rngd and you should get a very much
> improved
> entropy.
Dec 23 15:55:17 rabbit kernel: hw_random: cannot enable RNG, aborting
but no rngd here.
Anyway, I've recompiled apache/apr with --with-devrandom=/dev/urandom and
it seems to do the trick. This is good enough for my smoking purposes. No
real stong crypto is needed here.
Thanks to everybody to the suggestions!
--
__________________________________________________________________
Stas Bekman JAm_pH ------> Just Another mod_perl Hacker
http://stason.org/ mod_perl Guide ---> http://perl.apache.org
mailto:stas@stason.org http://use.perl.org http://apacheweek.com
http://modperlbook.org http://apache.org http://ticketmaster.com
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org
Re: how to raise entropy
Posted by "Philippe M. Chiasson" <go...@ectoplasm.org>.
Also, if your hardware is running a 2.6 kernel, try to insmod hw_random and if
that reports finding something like :
hw_random: AMD768 system management I/O registers at 0x5000.
hw_random hardware driver 1.0.0 loaded
Then you can just start /usr/sbin/rngd and you should get a very much improved
entropy.
--------------------------------------------------------------------------------
Philippe M. Chiasson m/gozer\@(apache|cpan|ectoplasm)\.org/ GPG KeyID : 88C3A5A5
http://gozer.ectoplasm.org/ F9BF E0C2 480E 7680 1AE5 3631 CB32 A107 88C3A5A5
Re: how to raise entropy
Posted by "Philippe M. Chiasson" <go...@ectoplasm.org>.
Just tested http://www.vanheusden.com/aed/ on my box, and it feeds random data
into the pool from your audio speakers quite decently.
Turns out that you can't just write() to /dev/random, you have to be a bit
fancier than that to feed entropy back in.
Would make a nice CPAN module at some point. But for me, running that deamon
on a system with an audio card and no console improved the performance of /dev/random
dramatically.
Worth giving it a shot stas!
--------------------------------------------------------------------------------
Philippe M. Chiasson m/gozer\@(apache|cpan|ectoplasm)\.org/ GPG KeyID : 88C3A5A5
http://gozer.ectoplasm.org/ F9BF E0C2 480E 7680 1AE5 3631 CB32 A107 88C3A5A5
Re: how to raise entropy
Posted by "Philippe M. Chiasson" <go...@ectoplasm.org>.
Stas Bekman wrote:
> Stas Bekman wrote:
>
>>in one window start:
>>
>>cat /dev/random
>>
>>in the other:
>>
>>perl -le 'system ("cat /proc/sys/kernel/random/entropy_avail"), sleep 1
>>while 1'
>>3712
>>0
>>0
>>688
>
> and if in the third window I try to feed /dev/random while doing the above:
>
> perl -le 'system ("echo stas >> /dev/random") while 1'
>
> it makes no difference at all. no entropy is added. On the other hand
> /dev/urandom seems to be always full.
Yes, that's documented behaviour, at least for urandom. urandom is a very
pseudo random source and it will never block
/dev/random on the other hand, is supposed to come with entropy guarantees
and can block when it runs out of it. BUT, I believe that writing to /dev/random
is supposed to add to the entropy pool.
--------------------------------------------------------------------------------
Philippe M. Chiasson m/gozer\@(apache|cpan|ectoplasm)\.org/ GPG KeyID : 88C3A5A5
http://gozer.ectoplasm.org/ F9BF E0C2 480E 7680 1AE5 3631 CB32 A107 88C3A5A5
Re: how to raise entropy
Posted by Stas Bekman <st...@stason.org>.
Stas Bekman wrote:
> in one window start:
>
> cat /dev/random
>
> in the other:
>
> perl -le 'system ("cat /proc/sys/kernel/random/entropy_avail"), sleep 1
> while 1'
> 3712
> 0
> 0
> 688
and if in the third window I try to feed /dev/random while doing the above:
perl -le 'system ("echo stas >> /dev/random") while 1'
it makes no difference at all. no entropy is added. On the other hand
/dev/urandom seems to be always full.
--
__________________________________________________________________
Stas Bekman JAm_pH ------> Just Another mod_perl Hacker
http://stason.org/ mod_perl Guide ---> http://perl.apache.org
mailto:stas@stason.org http://use.perl.org http://apacheweek.com
http://modperlbook.org http://apache.org http://ticketmaster.com
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org
Re: how to raise entropy
Posted by Stas Bekman <st...@stason.org>.
Stas Bekman wrote:
> heh, how about patching Apache::Test to try to write to /dev/u?random if
> the server takes a long time to start, assuming that this is where
> things block?
That's funny:
in one window start:
cat /dev/random
in the other:
perl -le 'system ("cat /proc/sys/kernel/random/entropy_avail"), sleep 1
while 1'
3712
3712
3712
3712
3712
3712
3712
3712
0
0
0
0
0
1
1
7
688
as you move a mouse or type the entropy adds.
Thanks to gozer for the /proc/sys/kernel/random/entropy_avail tip.
--
__________________________________________________________________
Stas Bekman JAm_pH ------> Just Another mod_perl Hacker
http://stason.org/ mod_perl Guide ---> http://perl.apache.org
mailto:stas@stason.org http://use.perl.org http://apacheweek.com
http://modperlbook.org http://apache.org http://ticketmaster.com
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org
Re: how to raise entropy
Posted by Stas Bekman <st...@stason.org>.
heh, how about patching Apache::Test to try to write to /dev/u?random if
the server takes a long time to start, assuming that this is where things
block?
--
__________________________________________________________________
Stas Bekman JAm_pH ------> Just Another mod_perl Hacker
http://stason.org/ mod_perl Guide ---> http://perl.apache.org
mailto:stas@stason.org http://use.perl.org http://apacheweek.com
http://modperlbook.org http://apache.org http://ticketmaster.com
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org
Re: how to raise entropy
Posted by Stas Bekman <st...@stason.org>.
Perrin Harkins wrote:
> On Wed, 2004-12-22 at 18:57 -0500, Stas Bekman wrote:
>
>>it's read only on my system
>
>
> Change it then. The random(4) manpage on my system shows it being
> written to as root, and if this is a closed system you can probably
> allow another user to do that.
I guess so. I just didn't know that writing to it, supposed to do any
difference. Stracing registry's startup shows that both are used, but I
don't know who does those calls.
open("/dev/random", O_RDONLY) = 3
open("/dev/random", O_RDONLY) = 3
open("/dev/urandom", O_RDONLY|O_NONBLOCK|O_NOCTTY) = 11
--
__________________________________________________________________
Stas Bekman JAm_pH ------> Just Another mod_perl Hacker
http://stason.org/ mod_perl Guide ---> http://perl.apache.org
mailto:stas@stason.org http://use.perl.org http://apacheweek.com
http://modperlbook.org http://apache.org http://ticketmaster.com
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org
Re: how to raise entropy
Posted by Perrin Harkins <pe...@elem.com>.
On Wed, 2004-12-22 at 18:57 -0500, Stas Bekman wrote:
> it's read only on my system
Change it then. The random(4) manpage on my system shows it being
written to as root, and if this is a closed system you can probably
allow another user to do that.
- Perrin
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org
Re: how to raise entropy
Posted by Stas Bekman <st...@stason.org>.
Perrin Harkins wrote:
> On Wed, 2004-12-22 at 18:28 -0500, Stas Bekman wrote:
>
>>>Use /dev/urandom, which will not block.
>>
>>It's not us who uses it, but Apache, so it's not under our control.
>
>
> I think that if you just cat some stuff to /dev/urandom it will raise
> entropy.
it's read only on my system:
l /dev/urandom
cr--r--r-- 1 root root 1, 9 Dec 10 11:21 /dev/urandom
on the other hand /dev/random is writable:
l /dev/random
crw-rw-rw- 1 root root 1, 8 Dec 10 11:21 /dev/random
--
__________________________________________________________________
Stas Bekman JAm_pH ------> Just Another mod_perl Hacker
http://stason.org/ mod_perl Guide ---> http://perl.apache.org
mailto:stas@stason.org http://use.perl.org http://apacheweek.com
http://modperlbook.org http://apache.org http://ticketmaster.com
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org
Re: how to raise entropy
Posted by Perrin Harkins <pe...@elem.com>.
On Wed, 2004-12-22 at 18:28 -0500, Stas Bekman wrote:
> > Use /dev/urandom, which will not block.
>
> It's not us who uses it, but Apache, so it's not under our control.
I think that if you just cat some stuff to /dev/urandom it will raise
entropy.
- Perrin
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org
Re: how to raise entropy
Posted by Stas Bekman <st...@stason.org>.
Jie Gao wrote:
>
>
> On Wed, 22 Dec 2004, Stas Bekman wrote:
>
>
>>Date: Wed, 22 Dec 2004 18:11:30 -0500
>>From: Stas Bekman <st...@stason.org>
>>To: mod_perl Dev <de...@perl.apache.org>
>>Subject: how to raise entropy
>>
>>The story goes like this, I run a smoke of some 70+ mp2 configurations
>>every other night, and very often I had the test suite hang on startup.
>>when I'd run things manually everything will work just fine.
>>
>>most of the time the error log will stop at:
>>
>>[Wed Dec 22 03:57:01 2004] [notice] Digest: generating secret for digest
>>authentication ...
>>
>>so what I suspect is that Apache tries to get data from /dev/(u?)random
>>which blocks if it doesn't have enough entropy and hence we timeout. Now
>>when I tap-tap-tap on my keyboard the entropy is happily generated, though
>>when I'm asleep and nothing happens on my notebook the entropy device has
>>not enough inputs to satisfy the software demands. Of course this is just
>>an idea. I should have really run the nightly smoke with strace to see
>>where it blocks for real.
>>
>>So any idea how to feed the entropy device, other than waking up every 15
>>minutes to hug my notebook?
>>
>>This can also help this problem reported not once by users:
>>http://perl.apache.org/docs/2.0/user/troubleshooting/troubleshooting.html#Server_Hanging_at_the_Startup
>
>
> Use /dev/urandom, which will not block.
It's not us who uses it, but Apache, so it's not under our control. Notice
that Digest: generating secret for digest authentication ... is coming
from an apache module.
--
__________________________________________________________________
Stas Bekman JAm_pH ------> Just Another mod_perl Hacker
http://stason.org/ mod_perl Guide ---> http://perl.apache.org
mailto:stas@stason.org http://use.perl.org http://apacheweek.com
http://modperlbook.org http://apache.org http://ticketmaster.com
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org
Re: how to raise entropy
Posted by Jie Gao <J....@isu.usyd.edu.au>.
On Wed, 22 Dec 2004, Stas Bekman wrote:
> Date: Wed, 22 Dec 2004 18:11:30 -0500
> From: Stas Bekman <st...@stason.org>
> To: mod_perl Dev <de...@perl.apache.org>
> Subject: how to raise entropy
>
> The story goes like this, I run a smoke of some 70+ mp2 configurations
> every other night, and very often I had the test suite hang on startup.
> when I'd run things manually everything will work just fine.
>
> most of the time the error log will stop at:
>
> [Wed Dec 22 03:57:01 2004] [notice] Digest: generating secret for digest
> authentication ...
>
> so what I suspect is that Apache tries to get data from /dev/(u?)random
> which blocks if it doesn't have enough entropy and hence we timeout. Now
> when I tap-tap-tap on my keyboard the entropy is happily generated, though
> when I'm asleep and nothing happens on my notebook the entropy device has
> not enough inputs to satisfy the software demands. Of course this is just
> an idea. I should have really run the nightly smoke with strace to see
> where it blocks for real.
>
> So any idea how to feed the entropy device, other than waking up every 15
> minutes to hug my notebook?
>
> This can also help this problem reported not once by users:
> http://perl.apache.org/docs/2.0/user/troubleshooting/troubleshooting.html#Server_Hanging_at_the_Startup
Use /dev/urandom, which will not block.
Regards,
Jie
> --
> __________________________________________________________________
> Stas Bekman JAm_pH ------> Just Another mod_perl Hacker
> http://stason.org/ mod_perl Guide ---> http://perl.apache.org
> mailto:stas@stason.org http://use.perl.org http://apacheweek.com
> http://modperlbook.org http://apache.org http://ticketmaster.com
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
> For additional commands, e-mail: dev-help@perl.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org
Re: how to raise entropy
Posted by John Saylor <jo...@worldwinner.com>.
hi
( 04.12.22 18:11 -0500 ) Stas Bekman:
> So any idea how to feed the entropy device, other than waking up every
> 15 minutes to hug my notebook?
a sound card can be used to generate entropy [white noise, input from
static radio frequency, prolly lots of others too]. but i think this
will entail some programming on your part to feed it in to your system
appropriately.
good luck!
--
\js oblique strategy: lost in useless territory
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org
Re: how to raise entropy
Posted by Vivek Khera <kh...@kcilink.com>.
On Dec 22, 2004, at 6:11 PM, Stas Bekman wrote:
> So any idea how to feed the entropy device, other than waking up every
> 15 minutes to hug my notebook?
>
Can you add disk and network I/O interrupts to your entropy source?
I'm sure your disk is churning away all the time during these tests.
I don't suppose your notebook has a slot for a crypto accelerator card
:-)
Vivek Khera, Ph.D.
+1-301-869-4449 x806
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org