From: Leo Famulari <leo@famulari.name>
To: David Craven <david@craven.ch>
Cc: guix-devel@gnu.org
Subject: Re: [PATCH 2/2] services: Add 'dropbear-service'.
Date: Sat, 9 Jul 2016 18:41:25 -0400 [thread overview]
Message-ID: <20160709224125.GA11385@jasmine> (raw)
In-Reply-To: <20160707172517.GA5283@jasmine>
On Thu, Jul 07, 2016 at 01:25:17PM -0400, Leo Famulari wrote:
> If so, what does Dropbear do? How does it get random numbers to generate
> the host key?
I looked into it — Dropbear uses /dev/urandom, which *may* not be safe
to use immediately after first boot.
What do you think about implementing the '-R' option, described below?
From dropbear(8) [0]:
"Host key files are read at startup from a standard location, by default
/etc/dropbear/dropbear_dss_host_key, /etc/dropbear/dropbear_rsa_host_key, and
/etc/dropbear/dropbear_ecdsa_host_key or specified on the commandline with -r.
These are of the form generated by dropbearkey. The -R option can be used to
automatically generate keys in the default location - keys will be generated
after startup when the first connection is established. This had the benefit
that the system /dev/urandom random number source has a better chance of being
securely seeded."
[0]
https://github.com/mkj/dropbear/blob/master/dropbear.8#L143
next prev parent reply other threads:[~2016-07-09 22:41 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-07-04 20:56 [PATCH 1/2] gnu: lsh: Move to (gnu packages ssh) David Craven
2016-07-04 20:56 ` [PATCH 2/2] services: Add 'dropbear-service' David Craven
2016-07-07 17:25 ` Leo Famulari
2016-07-07 17:54 ` David Craven
2016-07-09 14:39 ` David Craven
2016-07-09 18:32 ` Leo Famulari
2016-07-09 21:31 ` David Craven
2016-07-09 22:41 ` Leo Famulari [this message]
2016-07-09 22:43 ` Leo Famulari
2016-07-09 23:03 ` David Craven
2016-07-09 23:34 ` David Craven
2016-07-11 8:33 ` Ludovic Courtès
2016-07-13 13:09 ` David Craven
2016-07-13 15:58 ` David Craven
2016-07-13 16:25 ` David Craven
2016-07-05 6:01 ` [PATCH 1/2] gnu: lsh: Move to (gnu packages ssh) Efraim Flashner
2016-07-05 6:24 ` Efraim Flashner
2016-07-05 11:47 ` David Craven
-- strict thread matches above, loose matches on Subject: below --
2016-07-13 16:13 [PATCH 0/2] Dropbear service take two David Craven
2016-07-13 16:13 ` [PATCH 2/2] services: Add 'dropbear-service' David Craven
2016-07-15 16:00 ` Ludovic Courtès
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160709224125.GA11385@jasmine \
--to=leo@famulari.name \
--cc=david@craven.ch \
--cc=guix-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).