-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Thanks for sharing mate. This is good to know ;-) Cheers, - -Nik Ed W wrote: > Apologies for the apparently random plug, but I was previously posting > to gentoo-hardened about ways to try and avoid bumping along with an > empty entropy pool caused largely by using a "hardened" glibc/kernel > (uses a bunch of entropy putting canarys after all call stacks) and it's > exasperated by Linux's choice to ignore network traffic as a source of > randomness and only focus on keyboard/HD activity (near negligible on a > typical headless server serving files from cache...), and the icing is > of course the nice linux-verver patches which allow us to cram so many > processes into a small server... > > Having tried the bunch of software entropy generators you will find with > a quick google search and finding they simply burn CPU for very little > benefit - I then bought an entropy key from the nice folks at Simtec via > http://entropykey.co.uk > > Short version is you plug it in, install the ekeyd package and even on a > hardened installation the entropy pool never deviates from full up... > > Now, at £30 it seems like a bargain for a fancy random number generator, > but then I read that the daemon can be switched to pipe the data out in > "egd" format and essentially you can have one machine supply high > volumes of random numbers for a fair number of networked clients. In my > case this solves the problem of how to pipe entropy to some cheap rented > servers where we don't get to touch the physical hardware... Very nice > > I have no relationship with the entropy-key guys other than being a > happy customer. They seem like a small shop and I think they deserve a > plug (and really need to work on their presence via google... Searches > on this stuff only turn up $400 alternatives... Sheesh) > > > For those who have no idea what this means, simply try: "cat > /proc/sys/kernel/random/entropy_avail" - if the answer is bumping along > in low triple digits then perhaps do a little experimentation along the > lines of the above > > Good luck > > Ed W > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQEcBAEBAgAGBQJLrGaqAAoJEDFLYVOGGjgXnBwH/jLcRCqxm2R1mn1GdY99LMur Prw9KA6otFSH+sTamSoDgygtvkpvE8E32DWsU02hRAEtX+lMYAxDCwTG/NFqAzj5 bn5TCTkMmRKktuBfTYXXlVhbbB4tDLszCi78x20jzpEwD1uA3yJ5it7Zih1G1RXE 6I64vGYozMbEOmZ2lNatUdT6GsywWydYrFcIerMYFWdxpoWTZ5iIG300xk2xb5D8 u3T+HelemqcyDY3IUhXu2lStXGmwWDLcLawbiEzqvYUnxbHAGpi+eAxszyuMC727 NDYMv9ZE0xxT1lWmpGJpkiT/vrz3hZfguyIalnQBKVD2aPqPlDHFl8A6n9T2SHA= =GRo7 -----END PGP SIGNATURE-----