5

I am using makepasswd to generate a bunch of random passwords in a VM.

After the upgrade to Stretch/Debian 9, the script either generates one or two passwords, and stops, or none at all.

It seems to take quite a (good) while to generate another password again.

First time calling it:

makepasswd
ndmBXpfp3

It generates immediately a random string as expected.

Second time:

makepasswd

And it keeps there waiting...and waiting.

6

It seems makepasswd was changed from using an openssl API to generate (pseudo)random numbers, to nowadays using an API based in /dev/random.

The problem is VMs and iOTs (may) have low activity and do not generate enough entropy to satisfy the script/makepasswd drinking from /dev/random

While I tried to find an option for it to drink random numbers from /dev/urandom, it has none.

So I just got an old version of makepasswd, as it is a perl script, and pointed the script to /opt/bin/makepasswd on my system ; and the script is now working as usual generating the +100 passwords I need in seconds.

As it can be seen from the source:

New makepasswd:

 my $buf = $RNG->bytes($bytes);

Old makepasswd:

 my $buf = Crypt::OpenSSL::Random::random_pseudo_bytes($bytes);

Interestingly enough, the data and version near the copyright has not been changed, which put me off track for a while.

In both of them:

$Program        = 'makepasswd';
$Version        = '1.10';
$Author         = 'Rob Levin <levin@openproject.net>';
$Date           = "Monday, 7 April 1999 at 22:56 (UCT)";
$Copyright      = '1997-1999';

However, from changelog.Debian.gz

Convert from Crypt::OpenSSL::Random to Bytes::Random::Secure (closes:
#792535).

 -- Colin Watson <cjwatson@debian.org>  Thu, 16 Jul 2015 11:45:20 +0100
  • 1
    It would be worth filing a bug about this; the change was made for licensing reasons, not cryptographic ones, and I think setting NonBlocking would be acceptable (so it uses /dev/urandom — see Myths about /dev/urandom for useful background). – Stephen Kitt Oct 31 '16 at 11:33
  • Thanks @StephenKitt , concise and useful comments as always. – Rui F Ribeiro Oct 31 '16 at 12:41
  • Hi @StephenKitt , ended up installing haveged. – Rui F Ribeiro Nov 7 '16 at 12:51
  • @StephenKitt Why taking out all the Stretch tags? If that, the tags description also have to be edited, as they advise putting debian and the codename of the distro in questions together. – Rui F Ribeiro Feb 27 '17 at 12:56
  • See This criquet needs help! and Do we need version specific tags for distributions?. The idea is to get rid of those tags altogether; the debian tag doesn't mention them, so there's no need to edit any tag description. – Stephen Kitt Feb 27 '17 at 13:00
2

Another alternative solution, instead of modifying makepasswd sources, is installing the daemon haveged to speed up the key generation process. To install it:

sudo apt-get install haveged

After installing it, makepasswd works as it should too.

The haveged daemon is now required in VMs and iOTs (e.g. raspberry) where the entropy is normally low.

From Debian, man haveged:

NAME
haveged - Generate random numbers and feed Linux's random device.

DESCRIPTION
haveged generates an unpredictable stream of random numbers harvested from the indirect effects of hardware events on hidden processor state (caches, branch predictors, memory translation tables, etc) using the HAVEGE (HArdware Volatile Entropy Gathering and Expansion) algorithm. The algorithm operates in user space, no special privilege is required for file system access to the output stream.

Linux pools randomness for distribution by the /dev/random and /dev/urandom device interfaces. The standard mechanisms of filling the /dev/random pool may not be sufficient to meet demand on systems with high needs or limited user interaction. In those circumstances, haveged may be run as a privileged daemon to fill the /dev/random pool whenever the supply of random bits in /dev/random falls below the low water mark of the device.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.