1 |
Ed W <lists@××××××××××.com> 2010-03-03 18:41: |
2 |
> On 03/03/2010 17:35, Natanael Copa wrote: |
3 |
>> On Wed, Mar 3, 2010 at 5:14 PM, Ed W<lists@××××××××××.com> wrote: |
4 |
>> |
5 |
>> |
6 |
>>> I don't have physical access to all machines, so any interesting cheap |
7 |
>>> random number generator dongles would be interesting to know about, but will |
8 |
>>> not be a full solution in this case. If I'm missing some obvious option |
9 |
>>> which is available on recent Intel/AMD hardware which might give me larger |
10 |
>>> amounts of entropy then please shout? |
11 |
>>> |
12 |
>> media-sound/audio-entropyd? |
13 |
>> |
14 |
>> |
15 |
> |
16 |
> Thanks for the idea - the server is a rackmount thing rented from a |
17 |
> hosting company and I don't think it has any soundcard onboard... |
18 |
> |
19 |
> I believe that the kernel doesn't use the network interrupt for |
20 |
> randomness, only keyboard, mouse and HD. This isn't a great situation |
21 |
> for a headless, mouseless webserver which tries as hard as possible not |
22 |
> to touch the disk... |
23 |
> |
24 |
> I ordered an "Entropy Key" from here: http://www.entropykey.co.uk/ |
25 |
> |
26 |
> This will help for the office server, but it doesn't really sort out my |
27 |
> rented racks (no, don't really want some crazy solution involving ssh |
28 |
> piping the data to it...) |
29 |
> |
30 |
> Would be very grateful for any other ideas here. I think the solution is |
31 |
> likely to use a lower quality rng source for the SSP protection rather |
32 |
> than generating more entropy - I'm not really see that a super high |
33 |
> quality rng source is really needed for SSP? Possibly a local attacker |
34 |
> can write code which flogs the rng until they figure out the params, |
35 |
> then use it as part of an SSP attack, however, its low on my list of |
36 |
> fears... |
37 |
> |
38 |
> I can see that glibc previously used to use erandom, but this patch was |
39 |
> dropped - any reason? |
40 |
> |
41 |
> Cheers |
42 |
> |
43 |
> Ed W |
44 |
|
45 |
Interesting subject. |
46 |
|
47 |
Here's [1] another technique I found to make use of the rng in the TPM if it's |
48 |
available. Seems to be working fairly well in my tests so far [3], though I |
49 |
think I'd prefer an entropy key as well. From some other reading [2] it |
50 |
seems that the virtio-rng modules (for use with qemu/kvm based guests) |
51 |
can make use of a host side /dev/hw_random device which I believe the |
52 |
entropy key provides. The TPM currently does not, though may in the |
53 |
future. |
54 |
|
55 |
Cheers, |
56 |
Brian |
57 |
|
58 |
[1] http://www.outflux.net/blog/archives/2010/02/08/rng-tools-with-tpm/ |
59 |
[2] http://lwn.net/Articles/283103/ |
60 |
[3] I was able to enable it in the BIOS using the IPMI SOL, so hopefully |
61 |
you won't need physical access. Not doing anything like TrustedGrub |
62 |
yet. To be honest, I don't really see the point. Feel free to |
63 |
enlighten me. |