Module Name: src
Committed By: riastradh
Date: Sun Jan 10 23:24:26 UTC 2021
Modified Files:
src/distrib/sets/lists/etc: mi
src/distrib/sets/lists/man: mi
src/etc: security
src/etc/defaults: rc.conf security.conf
src/etc/rc.d: Makefile
src/share/man/man4: rnd.4
src/share/man/man5: rc.conf.5 security.conf.5
src/share/man/man7: Makefile security.7
src/share/man/man8: afterboot.8
Added Files:
src/etc/rc.d: entropy
src/share/man/man7: entropy.7
Log Message:
Various entropy integration improvements.
- New /etc/security check for entropy in daily security report.
- New /etc/rc.d/entropy script runs (after random_seed and rndctl) to
check for entropy at boot -- in rc.conf, you can:
. set `entropy=check' to halt multiuser boot and enter single-user
mode if not enough entropy
. set `entropy=wait' to make multiuser boot wait until enough entropy
Default is to always boot without waiting -- and rely on other
channels like security report to alert the operator if there's a
problem.
- New man page entropy(7) discussing the higher-level concepts and
system integration with cross-references.
- New paragraph in afterboot(8) about entropy citing entropy(7) for
more details.
This change addresses many of the issues discussed in security/55659.
This is a first draft; happy to take improvements to the man pages and
scripted messages to improve clarity.
I considered changing motd to include an entropy warning with a
reference to the entropy(7) man page, but it's a little trickier:
- Not sure it's appropriate for all users to see at login rather than
users who have power to affect the entropy estimate (maybe it is,
just haven't decided).
- We only have a mechanism for changing once at boot; the message would
remain until next boot even if an operator adds enough entropy.
- The mechanism isn't really conducive to making a message appear
conditionally from boot to boot.
To generate a diff of this commit:
cvs rdiff -u -r1.263 -r1.264 src/distrib/sets/lists/etc/mi
cvs rdiff -u -r1.1712 -r1.1713 src/distrib/sets/lists/man/mi
cvs rdiff -u -r1.127 -r1.128 src/etc/security
cvs rdiff -u -r1.160 -r1.161 src/etc/defaults/rc.conf
cvs rdiff -u -r1.27 -r1.28 src/etc/defaults/security.conf
cvs rdiff -u -r1.109 -r1.110 src/etc/rc.d/Makefile
cvs rdiff -u -r0 -r1.1 src/etc/rc.d/entropy
cvs rdiff -u -r1.35 -r1.36 src/share/man/man4/rnd.4
cvs rdiff -u -r1.187 -r1.188 src/share/man/man5/rc.conf.5
cvs rdiff -u -r1.42 -r1.43 src/share/man/man5/security.conf.5
cvs rdiff -u -r1.35 -r1.36 src/share/man/man7/Makefile
cvs rdiff -u -r0 -r1.1 src/share/man/man7/entropy.7
cvs rdiff -u -r1.15 -r1.16 src/share/man/man7/security.7
cvs rdiff -u -r1.75 -r1.76 src/share/man/man8/afterboot.8
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/distrib/sets/lists/etc/mi
diff -u src/distrib/sets/lists/etc/mi:1.263 src/distrib/sets/lists/etc/mi:1.264
--- src/distrib/sets/lists/etc/mi:1.263 Tue Sep 8 12:52:44 2020
+++ src/distrib/sets/lists/etc/mi Sun Jan 10 23:24:25 2021
@@ -1,4 +1,4 @@
-# $NetBSD: mi,v 1.263 2020/09/08 12:52:44 martin Exp $
+# $NetBSD: mi,v 1.264 2021/01/10 23:24:25 riastradh Exp $
#
# Note: end-user configuration files that are moved to another location
# should not be marked "obsolete"; they should just be removed from
@@ -214,6 +214,7 @@
./etc/rc.d/dhcrelay etc-dhcpd-rc
./etc/rc.d/dmesg etc-sys-rc
./etc/rc.d/downinterfaces etc-sys-rc
+./etc/rc.d/entropy etc-sys-rc
./etc/rc.d/envsys etc-sys-rc
./etc/rc.d/fixsb etc-obsolete obsolete
./etc/rc.d/fsck etc-sys-rc
Index: src/distrib/sets/lists/man/mi
diff -u src/distrib/sets/lists/man/mi:1.1712 src/distrib/sets/lists/man/mi:1.1713
--- src/distrib/sets/lists/man/mi:1.1712 Sun Dec 27 21:13:18 2020
+++ src/distrib/sets/lists/man/mi Sun Jan 10 23:24:25 2021
@@ -1,4 +1,4 @@
-# $NetBSD: mi,v 1.1712 2020/12/27 21:13:18 reinoud Exp $
+# $NetBSD: mi,v 1.1713 2021/01/10 23:24:25 riastradh Exp $
#
# Note: don't delete entries from here - mark them as "obsolete" instead.
#
@@ -2340,6 +2340,7 @@
./usr/share/man/cat7/c99.0 man-reference-catman .cat
./usr/share/man/cat7/des_modes.0 man-reference-catman .cat
./usr/share/man/cat7/editline.0 man-sys-catman .cat
+./usr/share/man/cat7/entropy.0 man-reference-catman .cat
./usr/share/man/cat7/environ.0 man-reference-catman .cat
./usr/share/man/cat7/glob.0 man-reference-catman .cat
./usr/share/man/cat7/groups.0 man-reference-catman .cat
@@ -2367,6 +2368,7 @@
./usr/share/man/cat7/pcap-linktype.0 man-netutil-catman .cat
./usr/share/man/cat7/pcap-tstamp.0 man-netutil-catman .cat
./usr/share/man/cat7/pkgsrc.0 man-reference-catman .cat
+./usr/share/man/cat7/random.0 man-reference-catman .cat
./usr/share/man/cat7/re_format.0 man-reference-catman .cat
./usr/share/man/cat7/release.0 man-reference-catman .cat
./usr/share/man/cat7/rfc6056.0 man-reference-catman .cat
@@ -5465,6 +5467,7 @@
./usr/share/man/html7/c99.html man-reference-htmlman html
./usr/share/man/html7/des_modes.html man-reference-htmlman html
./usr/share/man/html7/editline.html man-sys-htmlman html
+./usr/share/man/html7/entropy.html man-reference-htmlman html
./usr/share/man/html7/environ.html man-reference-htmlman html
./usr/share/man/html7/glob.html man-reference-htmlman html
./usr/share/man/html7/groups.html man-reference-htmlman html
@@ -5488,6 +5491,7 @@
./usr/share/man/html7/pcap-linktype.html man-netutil-htmlman html
./usr/share/man/html7/pcap-tstamp.html man-netutil-htmlman html
./usr/share/man/html7/pkgsrc.html man-reference-htmlman html
+./usr/share/man/html7/random.html man-reference-htmlman html
./usr/share/man/html7/re_format.html man-reference-htmlman html
./usr/share/man/html7/release.html man-reference-htmlman html
./usr/share/man/html7/rfc6056.html man-reference-htmlman html
@@ -8560,6 +8564,7 @@
./usr/share/man/man7/c99.7 man-reference-man .man
./usr/share/man/man7/des_modes.7 man-reference-man .man
./usr/share/man/man7/editline.7 man-sys-man .man
+./usr/share/man/man7/entropy.7 man-reference-man .man
./usr/share/man/man7/environ.7 man-reference-man .man
./usr/share/man/man7/glob.7 man-reference-man .man
./usr/share/man/man7/groups.7 man-reference-man .man
@@ -8586,6 +8591,7 @@
./usr/share/man/man7/pcap-linktype.7 man-netutil-man .man
./usr/share/man/man7/pcap-tstamp.7 man-netutil-man .man
./usr/share/man/man7/pkgsrc.7 man-reference-man .man
+./usr/share/man/man7/random.7 man-reference-man .man
./usr/share/man/man7/re_format.7 man-reference-man .man
./usr/share/man/man7/release.7 man-reference-man .man
./usr/share/man/man7/rfc6056.7 man-reference-man .man
Index: src/etc/security
diff -u src/etc/security:1.127 src/etc/security:1.128
--- src/etc/security:1.127 Wed Dec 2 14:18:13 2020
+++ src/etc/security Sun Jan 10 23:24:25 2021
@@ -1,6 +1,6 @@
#!/bin/sh -
#
-# $NetBSD: security,v 1.127 2020/12/02 14:18:13 wiz Exp $
+# $NetBSD: security,v 1.128 2021/01/10 23:24:25 riastradh Exp $
# from: @(#)security 8.1 (Berkeley) 6/9/93
#
@@ -192,6 +192,19 @@ for file in $special_files; do
done | mtree -CM -k all > $SPECIALSPEC || exit 1
+# Check for enough entropy.
+#
+if checkyesno check_entropy; then
+ if ! dd if=/dev/random iflag=nonblock of=/dev/null bs=1 count=1 \
+ msgfmt=quiet 2>/dev/null; then
+ printf '\n'
+ printf 'Entropy:\n'
+ printf 'System may need more entropy for cryptography.\n'
+ printf 'See the entropy(7) man page for details.\n'
+ fi
+fi
+
+
# Check the master password file syntax.
#
if checkyesno check_passwd; then
Index: src/etc/defaults/rc.conf
diff -u src/etc/defaults/rc.conf:1.160 src/etc/defaults/rc.conf:1.161
--- src/etc/defaults/rc.conf:1.160 Tue Sep 29 02:49:55 2020
+++ src/etc/defaults/rc.conf Sun Jan 10 23:24:25 2021
@@ -1,4 +1,4 @@
-# $NetBSD: rc.conf,v 1.160 2020/09/29 02:49:55 msaitoh Exp $
+# $NetBSD: rc.conf,v 1.161 2021/01/10 23:24:25 riastradh Exp $
#
# /etc/defaults/rc.conf --
# default configuration of /etc/rc.conf
@@ -384,6 +384,11 @@ veriexec_flags="-k"
#
random_seed=YES
+# Set to `check' to abort multi-user boot if not enough entropy, or
+# `wait' to wait until enough entropy.
+#
+entropy=""
+
# Creating / updating of man page index on boot
makemandb=YES
Index: src/etc/defaults/security.conf
diff -u src/etc/defaults/security.conf:1.27 src/etc/defaults/security.conf:1.28
--- src/etc/defaults/security.conf:1.27 Fri Dec 6 14:43:29 2019
+++ src/etc/defaults/security.conf Sun Jan 10 23:24:25 2021
@@ -1,4 +1,4 @@
-# $NetBSD: security.conf,v 1.27 2019/12/06 14:43:29 riastradh Exp $
+# $NetBSD: security.conf,v 1.28 2021/01/10 23:24:25 riastradh Exp $
#
# /etc/defaults/security.conf --
# default configuration of /etc/security.conf
@@ -9,6 +9,7 @@
# EDIT /etc/security.conf INSTEAD.
#
+check_entropy=YES
check_passwd=YES
check_group=YES
check_rootdotfiles=YES
Index: src/etc/rc.d/Makefile
diff -u src/etc/rc.d/Makefile:1.109 src/etc/rc.d/Makefile:1.110
--- src/etc/rc.d/Makefile:1.109 Tue Sep 8 12:54:36 2020
+++ src/etc/rc.d/Makefile Sun Jan 10 23:24:25 2021
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.109 2020/09/08 12:54:36 martin Exp $
+# $NetBSD: Makefile,v 1.110 2021/01/10 23:24:25 riastradh Exp $
.include <bsd.own.mk>
@@ -20,7 +20,7 @@ CONFIGFILES=\
ccd cgd clearcritlocal cleartmp cron \
devpubd dhcpcd dhcpd dhcpd6 dhcrelay dmesg \
downinterfaces \
- envsys \
+ entropy envsys \
fsck fsck_root ftp_proxy ftpd \
gpio \
hostapd httpd \
Index: src/share/man/man4/rnd.4
diff -u src/share/man/man4/rnd.4:1.35 src/share/man/man4/rnd.4:1.36
--- src/share/man/man4/rnd.4:1.35 Wed May 6 18:38:20 2020
+++ src/share/man/man4/rnd.4 Sun Jan 10 23:24:25 2021
@@ -1,4 +1,4 @@
-.\" $NetBSD: rnd.4,v 1.35 2020/05/06 18:38:20 riastradh Exp $
+.\" $NetBSD: rnd.4,v 1.36 2021/01/10 23:24:25 riastradh Exp $
.\"
.\" Copyright (c) 2014-2020 The NetBSD Foundation, Inc.
.\" All rights reserved.
@@ -634,6 +634,7 @@ The system has full entropy for the firs
.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
.Sh SEE ALSO
.Xr arc4random 3 ,
+.Xr entropy 7 ,
.Xr rndctl 8 ,
.Xr cprng 9 ,
.Xr rnd 9
Index: src/share/man/man5/rc.conf.5
diff -u src/share/man/man5/rc.conf.5:1.187 src/share/man/man5/rc.conf.5:1.188
--- src/share/man/man5/rc.conf.5:1.187 Fri Sep 11 12:20:01 2020
+++ src/share/man/man5/rc.conf.5 Sun Jan 10 23:24:26 2021
@@ -1,4 +1,4 @@
-.\" $NetBSD: rc.conf.5,v 1.187 2020/09/11 12:20:01 wiz Exp $
+.\" $NetBSD: rc.conf.5,v 1.188 2021/01/10 23:24:26 riastradh Exp $
.\"
.\" Copyright (c) 1996 Matthew R. Green
.\" All rights reserved.
@@ -439,6 +439,35 @@ from the output of
.Xr dmesg 8 .
Passes
.Sy dmesg_flags .
+.It Sy entropy
+A string,
+.Sq Li check
+or
+.Sq Li wait .
+If set, then during boot-up, after
+.Sy random_seed
+and
+.Sy rndctl ,
+check for or wait until enough entropy before any networking is
+enabled.
+.Pp
+If not enough entropy is available, then:
+.Bl -bullet -compact
+.It
+With
+.Sq Li entropy=check ,
+stop multiuser boot and enter single-user mode instead.
+.It
+With
+.Sq Li entropy=wait ,
+wait until enough entropy is available.
+.El
+.Pp
+Note that
+.Sq Li entropy=wait
+may cause the system to hang indefinitely at boot if it has neither a
+random seed nor any hardware random number generators \(em use with
+care.
.It Sy envsys
Boolean value.
Sets preferences for the environmental systems framework,
Index: src/share/man/man5/security.conf.5
diff -u src/share/man/man5/security.conf.5:1.42 src/share/man/man5/security.conf.5:1.43
--- src/share/man/man5/security.conf.5:1.42 Wed Dec 2 14:18:13 2020
+++ src/share/man/man5/security.conf.5 Sun Jan 10 23:24:26 2021
@@ -1,4 +1,4 @@
-.\" $NetBSD: security.conf.5,v 1.42 2020/12/02 14:18:13 wiz Exp $
+.\" $NetBSD: security.conf.5,v 1.43 2021/01/10 23:24:26 riastradh Exp $
.\"
.\" Copyright (c) 1996 Matthew R. Green
.\" All rights reserved.
@@ -47,6 +47,9 @@ system, if configured do to so from
.Pp
The variables described below can be set to "NO" to disable the test:
.Bl -tag -width check_pkg_vulnerabilities
+.It Sy check_entropy
+This checks whether the system has enough entropy
+.Pq see Xr entropy 7 .
.It Sy check_passwd
This checks the
.Pa /etc/master.passwd
Index: src/share/man/man7/Makefile
diff -u src/share/man/man7/Makefile:1.35 src/share/man/man7/Makefile:1.36
--- src/share/man/man7/Makefile:1.35 Tue Jun 23 16:08:46 2020
+++ src/share/man/man7/Makefile Sun Jan 10 23:24:26 2021
@@ -1,11 +1,12 @@
-# $NetBSD: Makefile,v 1.35 2020/06/23 16:08:46 maxv Exp $
+# $NetBSD: Makefile,v 1.36 2021/01/10 23:24:26 riastradh Exp $
# @(#)Makefile 8.1 (Berkeley) 6/5/93
.include <bsd.init.mk>
# missing: eqnchar.7 man.7 ms.7 term.7
-MAN= ascii.7 c.7 environ.7 glob.7 groups.7 hier.7 hostname.7 intro.7 \
+MAN= ascii.7 c.7 entropy.7 environ.7 glob.7 groups.7 hier.7 hostname.7 \
+ intro.7 \
kernel_sanitizers.7 mailaddr.7 module.7 nls.7 operator.7 orders.7 \
pkgsrc.7 release.7 \
rfc6056.7 security.7 script.7 setuid.7 signal.7 src.7 sticky.7 \
@@ -23,6 +24,7 @@ tests.7: tests.atf.7
MLINKS+=c.7 c78.7 \
c.7 c89.7 \
c.7 c90.7 \
- c.7 c99.7
+ c.7 c99.7 \
+ entropy.7 random.7
.include <bsd.man.mk>
Index: src/share/man/man7/security.7
diff -u src/share/man/man7/security.7:1.15 src/share/man/man7/security.7:1.16
--- src/share/man/man7/security.7:1.15 Mon Jul 3 21:30:59 2017
+++ src/share/man/man7/security.7 Sun Jan 10 23:24:26 2021
@@ -1,4 +1,4 @@
-.\" $NetBSD: security.7,v 1.15 2017/07/03 21:30:59 wiz Exp $
+.\" $NetBSD: security.7,v 1.16 2021/01/10 23:24:26 riastradh Exp $
.\"
.\" Copyright (c) 2006, 2011 Elad Efrat <[email protected]>
.\" All rights reserved.
@@ -56,6 +56,9 @@ Information filtering
.It
Administrative security
.El
+.Pp
+See also
+.Xr entropy 7 .
.Ss Veriexec
.Em Veriexec
is a file integrity subsystem.
@@ -450,6 +453,7 @@ fetch_pkg_vulnerabilities=YES
.Sh SEE ALSO
.Xr ssp 3 ,
.Xr options 4 ,
+.Xr entropy 7 ,
.Xr paxctl 8 ,
.Xr sysctl 8 ,
.Xr veriexec 8 ,
Index: src/share/man/man8/afterboot.8
diff -u src/share/man/man8/afterboot.8:1.75 src/share/man/man8/afterboot.8:1.76
--- src/share/man/man8/afterboot.8:1.75 Mon Oct 5 14:54:24 2020
+++ src/share/man/man8/afterboot.8 Sun Jan 10 23:24:26 2021
@@ -1,4 +1,4 @@
-.\" $NetBSD: afterboot.8,v 1.75 2020/10/05 14:54:24 nia Exp $
+.\" $NetBSD: afterboot.8,v 1.76 2021/01/10 23:24:26 riastradh Exp $
.\" $OpenBSD: afterboot.8,v 1.72 2002/02/22 02:02:33 miod Exp $
.\"
.\" Originally created by Marshall M. Midden -- 1997-10-20, [email protected]
@@ -108,6 +108,26 @@ See
and
.Xr security.conf 5
for more details.
+.Ss Entropy
+If your machine does not have a hardware random number generator, it
+may not be safe to use on the internet until it has enough entropy to
+generate unpredictable secrets for programs like web browsers and
+.Xr ssh 1 .
+You can use
+.Xr rndctl 8
+to list the entropy sources with
+.Ic rndctl -l ,
+or save entropy from another machine running
+.Nx
+with
+.Ic rndctl -S
+and load it on this one with
+.Ic rndctl -L
+(as long as there are no eavesdroppers on the medium between the two
+machines).
+See
+.Xr entropy 7
+for more details.
.Ss Login
On a fresh install with no other user accounts, login as
.Dq Ic root .
Added files:
Index: src/etc/rc.d/entropy
diff -u /dev/null src/etc/rc.d/entropy:1.1
--- /dev/null Sun Jan 10 23:24:26 2021
+++ src/etc/rc.d/entropy Sun Jan 10 23:24:25 2021
@@ -0,0 +1,40 @@
+#!/bin/sh
+#
+# $NetBSD: entropy,v 1.1 2021/01/10 23:24:25 riastradh Exp $
+#
+
+# PROVIDE: entropy
+# REQUIRE: random_seed rndctl
+# BEFORE: ike ipsec network
+
+$_rc_subr_loaded . /etc/rc.subr
+
+name="entropy"
+start_cmd="entropy_start"
+stop_cmd=":"
+
+entropy_start()
+{
+ case ${entropy-} in
+ '') ;;
+ check) echo -n "Checking for entropy..."
+ # dd will print an error message `Resource temporarily
+ # unavailable' to stderr, which is a little annoying,
+ # but getting rid of it is also a little annoying.
+ if dd if=/dev/random iflag=nonblock of=/dev/null bs=1 count=1 \
+ msgfmt=quiet; then
+ echo "done"
+ else
+ echo "not enough entropy available, aborting boot."
+ stop_boot
+ fi
+ ;;
+ wait) echo -n "Waiting for entropy..."
+ dd if=/dev/random of=/dev/null bs=1 count=1 msgfmt=quiet
+ echo "done"
+ ;;
+ esac
+}
+
+load_rc_config "$name"
+run_rc_command "$1"
Index: src/share/man/man7/entropy.7
diff -u /dev/null src/share/man/man7/entropy.7:1.1
--- /dev/null Sun Jan 10 23:24:26 2021
+++ src/share/man/man7/entropy.7 Sun Jan 10 23:24:26 2021
@@ -0,0 +1,241 @@
+.\" $NetBSD: entropy.7,v 1.1 2021/01/10 23:24:26 riastradh Exp $
+.\"
+.\" Copyright (c) 2021 The NetBSD Foundation, Inc.
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\" notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\" notice, this list of conditions and the following disclaimer in the
+.\" documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+.\" POSSIBILITY OF SUCH DAMAGE.
+.\"
+.Dd January 4, 2021
+.Dt ENTROPY 7
+.Os
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.Sh NAME
+.Nm entropy
+.Nd random unpredictable secrets needed for security
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.Sh DESCRIPTION
+Computers need random unpredictable secrets for the security of
+software such as web browsers and
+.Xr ssh 1 .
+.Pp
+Computers are designed to behave in highly predictable ways, so they
+rely on observations of random physical phenomena around them, called
+.Nm entropy sources ,
+to derive unpredictable secrets for cryptography.
+.Pp
+While some computers have reliable entropy sources such as hardware
+random number generators based on thermal noise in silicon circuits,
+others may require operator intervention for security.
+.\""""""""""""""""""""""""""""""""""""""
+.Ss Threats
+.Bl -bullet
+.It
+Web browsers and programs such as
+.Xr ssh 1
+rely on unpredictable secrets in cryptography to prevent eavesdropping
+and detect tampering of sessions over the network.
+.It
+.Xr ssh-keygen 1
+relies on unpredictable secrets to create keys that allow you to log in
+but keep out malicious adversaries; if an adversary could guess the key
+then they could impersonate you.
+.It
+.Nx
+relies on unpredictable secrets to make sure that private user data
+stored on nonvolatile media when memory is scarce
+.Pq Xr swapctl 8 , using So Li vm.swap_encrypt=1 Sc ; see Xr sysctl 7
+cannot be recovered by forensic tools after shutdown.
+.El
+.\""""""""""""""""""""""""""""""""""""""
+.Ss Entropy in Nx
+.Nx
+gathers samples from various kinds of entropy sources, including:
+.Bl -bullet -compact
+.It
+hardware random number generators
+.It
+network traffic timing
+.It
+user input (keystrokes, mouse movements, etc.)
+.It
+disk I/O latency
+.It
+environment sensors
+.Pq Xr envsys 4
+.El
+The samples are mixed together with cryptography to yield unpredictable
+secrets through
+.Pa /dev/urandom
+.Pq see Xr rnd 4
+and related interfaces used by programs like
+.Xr ssh 1 ,
+Firefox, and so on.
+.Pp
+.Nx
+also stores a random seed at
+.Pa /var/db/entropy-file
+to carry unpredictable secrets over from one boot to the next, as long
+as the medium remains secret and can be updated on boot.
+The seed is maintained automatically by
+.Pa /etc/rc.d/random_seed
+.Pq see Xr rc.conf 5 .
+.\""""""""""""""""""""""""""""""""""""""
+.Ss Ensuring enough entropy
+Entropy is measured in bits, and only 256 bits of entropy are needed
+for security, thanks to modern cryptography.
+.Pp
+To detect potentially insecure systems,
+.Nx
+records how many bits it needs to achieve the full 256 bits, exposed
+via the
+.Xr sysctl 7
+variable
+.Li kern.entropy.needed ,
+and takes measures to alert the operator if there isn't definitely
+enough for security:
+.Bl -bullet
+.It
+Setting
+.Sq Li entropy=check
+in
+.Xr rc.conf 5
+makes
+.Nx
+refuse to boot to multiuser unless there is enough entropy, or
+.Sq Li entropy=wait
+makes it wait for entropy before booting to multiuser (with the caveat
+that it may cause boot to hang forever).
+.It
+The daily security script sends an alert if there is not enough entropy
+.Pq see Xr security.conf 5 .
+.El
+.Pp
+Since it is difficult to confidently model the unpredictability of most
+physical systems, only devices specifically designed to be hardware
+random number generators count toward
+.Nx Ns 's
+estimate of the entropy.
+.Pp
+Many new computers have hardware random number generators, such as
+RDRAND/RDSEED in Intel/AMD CPUs, or ARMv8.5-RNDRRS;
+.Xr virtio 4 Ns -based
+virtualization platforms such as QEMU can expose entropy from the host
+with
+.Xr viornd 4 ;
+bootloader firmware such as UEFI may also expose an underlying
+platform's random number generator.
+.Pp
+However, many older computers have no reliable entropy sources.
+Some have the hardware, but have it off by default, such as a disabled
+.Xr tpm 4 .
+On computers with no built-in reliable entropy source, you may wish to
+transfer a seed from another computer with
+.Xr rndctl 8 ,
+or manually enter samples into
+.Pa /dev/urandom
+\(em see below.
+.\""""""""""""""""""""""""""""""""""""""
+.Ss Adding entropy
+.Pp
+You can manually save and load seeds with the
+.Xr rndctl 8
+tool.
+For example, you might use
+.Dl rndctl -S seed
+to save a seed from one machine, transfer it over a medium where you
+are confident there are no eavesdroppers to another machine, and load
+it with
+.Dl rndctl -L seed
+on the target machine; then run
+.Dl /etc/rc.d/random_seed stop
+on the target machine to ensure that the entropy will be saved for next
+boot, even if the system crashes or otherwise shuts down uncleanly.
+.Ic rndctl -S
+records the number of bits of entropy in the seed so that
+.Ic rndctl -L
+can count it.
+.Pp
+Users can write data to
+.Pa /dev/urandom
+to be mixed together with all other samples.
+For example, no matter what entropy sources are built into a computer,
+you can ensure it has enough entropy (as long as there are no
+surveillance cameras watching you) by flipping a coin 256 times and
+running:
+.Dl echo thttthhhhttththtttht... > /dev/urandom
+Then run
+.Dl /etc/rc.d/random_seed stop
+to ensure that the effort will be saved for next boot.
+.Pp
+Inputs from the superuser (uid 0) to
+.Pa /dev/urandom
+count toward the system's entropy estimate, at the maximum rate of one
+bit of entropy per bit of data; inputs from unprivileged users will
+affect subsequent outputs but will be counted as having zero entropy.
+.Pp
+After adding entropy,
+.Sy make sure to regenerate any long-term keys
+that might be predictable because they were previously generated with
+too little entropy.
+For example, if
+.Sq Li sshd=YES
+is enabled in
+.Pa /etc/rc.conf ,
+then
+.Nx
+will automatically generate ssh host keys on boot; if they were
+generated with too little entropy, then you may wish to delete them and
+create new ones before allowing anyone to log in via
+.Xr ssh 1 .
+.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+.Sh SEE ALSO
+.Xr getrandom 2 ,
+.Xr arc4random 3 ,
+.Xr rnd 4 ,
+.Xr rc.conf 5 ,
+.Xr rc 8 ,
+.Xr rndctl 8
+.Rs
+.%A Nadia Heninger
+.%A Zakir Durumeric
+.%A Eric Wustrow
+.%A J. Alex Halderman
+.%T Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices
+.%B Proceedings of the 21st USENIX Security Symposium
+.%I USENIX
+.%D August 2012
+.%P 205-220
+.%U https://www.usenix.org/conference/usenixsecurity12/technical-sessions/presentation/heninger
+.%U https://factorable.net/
+.Re
+.Rs
+.%T openssl \(em predictable random number generator
+.%I Debian Security Advisory
+.%O DSA-1571-1
+.%D 2008-05-13
+.Re
+.Rs
+.%T Features/VirtIORNG
+.%I QEMU Wiki
+.%U https://wiki.qemu.org/Features/VirtIORNG
+.%D 2016-10-17
+.Re
