cba96d16f7
- New /etc/security check for entropy in daily security report.
- New /etc/rc.d/entropy script runs (after random_seed and rndctl) to
check for entropy at boot -- in rc.conf, you can:
. set `entropy=check' to halt multiuser boot and enter single-user
mode if not enough entropy
. set `entropy=wait' to make multiuser boot wait until enough entropy
Default is to always boot without waiting -- and rely on other
channels like security report to alert the operator if there's a
problem.
- New man page entropy(7) discussing the higher-level concepts and
system integration with cross-references.
- New paragraph in afterboot(8) about entropy citing entropy(7) for
more details.
This change addresses many of the issues discussed in security/55659.
This is a first draft; happy to take improvements to the man pages and
scripted messages to improve clarity.
I considered changing motd to include an entropy warning with a
reference to the entropy(7) man page, but it's a little trickier:
- Not sure it's appropriate for all users to see at login rather than
users who have power to affect the entropy estimate (maybe it is,
just haven't decided).
- We only have a mechanism for changing once at boot; the message would
remain until next boot even if an operator adds enough entropy.
- The mechanism isn't really conducive to making a message appear
conditionally from boot to boot.
|
||
|---|---|---|
| .. | ||
| acorn32 | ||
| alpha | ||
| amd64 | ||
| amiga | ||
| arc | ||
| atari | ||
| bebox | ||
| cats | ||
| cdrom | ||
| cobalt | ||
| common | ||
| dreamcast | ||
| emips | ||
| evbarm | ||
| evbmips | ||
| evbppc | ||
| evbsh3 | ||
| ews4800mips | ||
| hp300 | ||
| hpcarm | ||
| hpcmips | ||
| hpcsh | ||
| hppa | ||
| i386 | ||
| ia64 | ||
| ibmnws | ||
| landisk | ||
| luna68k | ||
| mac68k | ||
| macppc | ||
| miniroot | ||
| mipsco | ||
| mvme68k | ||
| mvmeppc | ||
| news68k | ||
| newsmips | ||
| notes | ||
| ofppc | ||
| playstation2 | ||
| pmax | ||
| prep | ||
| riscv | ||
| rs6000 | ||
| sandpoint | ||
| sets | ||
| sgimips | ||
| shark | ||
| sparc | ||
| sparc64 | ||
| sun2 | ||
| sun3 | ||
| syspkg | ||
| utils | ||
| vax | ||
| x68k | ||
| zaurus | ||
| Makefile | ||
| Makefile.inc | ||