Date: Thu, 8 Apr 2004 20:05:18 +0200 From: Dirk-Willem van Gulik <dirkx@webweaving.org> To: RYAN vAN GINNEKEN <rmvg@shaw.ca> Cc: freebsd-questions@freebsd.org Subject: Re: startssl at boot time Message-ID: <4B0FC7F0-8987-11D8-BD91-000A95CDA38A@webweaving.org> In-Reply-To: <40748790.9050206@shaw.ca> References: <406F324B.1050005@shaw.ca> <20040404112328.GB7849@happy-idiot-talk.infracaninophile.co.uk> <4072488A.7050200@shaw.ca> <20040406090720.GB17361@happy-idiot-talk.infracaninophile.co.uk> <4074751E.2070607@shaw.ca> <20040407222702.GA66122@happy-idiot-talk.infracaninophile.co.uk> <40748790.9050206@shaw.ca>
next in thread | previous in thread | raw e-mail | index | archive | help
On Apr 8, 2004, at 12:58 AM, RYAN vAN GINNEKEN wrote: > THANKS but i already have that line in my rc.conf file and the log > entries that i have submitted to this list are not from a reboot but > rather apachectl stop and start or startssl. So when i run a startssl > i get the randomness i need however when i just use apachectl start > which is 99.9% the same command it does not. honestly i am stumped > hope you have some more wisdom to share. There is also the line about > ssl cache i have do some googleing but have not been able to come up > with anything that helps. The trouble you are having is not with the SSLCache (which you should enable regardless, but for different reasons). If you already do rand_irqs's in your rc.conf and you safe/load the entropy over boot time; then that is about the best you can do in assuring there is 'real' entropy in the /dev/random sort of getting into special kernels and/or hardware. So next step is to read the comments in the section 'Pseudo Random Number Generator' and the mod_ssl manual and deceide if in -your- case you can get away with less randomness. In some specific cases you can. What is puzzling is that, assuming that the log file you are showing us is complete, is that you are -not- getting the fatal error "Failed to generate temporary 512 bit RSA private key". S o it may be worth to switch logging to 'debug' level and double check that not something else (e.g. DNS timeout, lack of a ca-bundle/chain) is biting you. There is a very complete FAQ on ssl and apache in the apache bundle. Dw > Matthew Seaman wrote: > >> On Wed, Apr 07, 2004 at 03:39:42PM -0600, RYAN vAN GINNEKEN wrote: >> >> >>> Seems to initialize ssl but my ssl page still does not work however >>> my >>> regular page does work. Here is a print out of the log file when i >>> do >>> an apachectl stop and apachectl startssl. when i use startssl >>> everything work great including my ssl page. >>> >> >> >>> [Wed Apr 07 13:20:08 2004] [info] Init: Seeding PRNG with 0 bytes of >>> entropy >>> [Wed Apr 07 13:20:08 2004] [warn] Init: Session Cache is not >>> configured >>> [hint: SSLSess >>> >> >> The fact that you can do an apachectl startssl and have everything >> work as desired means that you're 99.99% of the way to gettting it all >> to work. The modification to the apache2.sh script I sent you last >> time sould force that script to always run 'apachectl startssl' >> itself, so that shouldn't be the problem. >> >> Hmmm... I think that perhaps the problem arises from when the >> apache2.sh script is run. I'm guessing that the 'Seeding PRNG' line >> is significant -- it aparently means that there is no random data yet >> available from /dev/random at the point when apache is started up in >> the boot sequence. As you're running 4.9, that can be cured by >> telling the system to use some appropriate IRQs as sources of >> randomness. First run: >> >> % vmstat -i >> >> and look for the IRQs where there are a lot of interrupts generated. >> Not the 'clk' or 'rtc' interrupts, as those are clock ticks, firing at >> regular intervals, which is worse than useless as a source of >> randomness. I find that irq12 (psm0 -- the mouse), irq1 (atkbd0 -- >> the keyboard), irq11 (mux -- multiplex: but this is network activity >> mostly) and irq15 (mux -- multiplex again, but disk activity mostly) >> work well for me, but you will have to choose 2 or 3 or 4 suitable >> IRQs on your own system to harvest for randomness. >> >> Then add them to /etc/rc.conf >> >> rand_irqs="1 11 12 15" >> >> Then reboot. (See rndcontrol(8) for more details) >> >> With luck, and a following wind, there will be sufficient system >> activity during startup that there will be sufficient random data >> available to prime the PRNG used by OpenSSL, which should let apache >> start up automatically. >> >> Cheers, >> >> Matthew >> >> > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to > "freebsd-questions-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4B0FC7F0-8987-11D8-BD91-000A95CDA38A>