topic Re: ssh entropy commands in Operating System - HP-UX

ssh entropy commands

himacs — Tue, 22 Mar 2011 19:51:36 GMT

Hi Admins,

Below are the ssh-rand-helper output.

test:/opt/ssh/libexec/ssh-rand-helper -vvv
debug1: loading PRNG seed from file //.ssh/prng_seed
Random seed file not found or invalid, ignoring.
.
.
.
debug1: Seeded RNG with 450 bytes from programs
debug1: writing PRNG seed to file //.ssh/prng_seed.bcdZNc2227
debug1: moving temporary PRNG seed to file //.ssh/prng_seed
6f6d3f1df395ab90fd9330228f4006f1b70071edbb5e7ff725d85c9ebbcf026ad68b223eb66759ebebde6966a651afdd

Please tell me why entropy commands required during ssh connection establishment.

Regards
himacs

Re: ssh entropy commands

James R. Ferguson — Tue, 22 Mar 2011 20:19:28 GMT

Hi:

Entropy is disorder or randomness. In order to generate a good random key for a secure connection, 'sshd' needs a random seed. Your messages suggest that you are running a very old version of SSH. Those ported to HP-UX have used '/dev/urandom' for some time. Older versions would sample various process tables, network statistics, etc to obtain a random seed.

[ By the way, I can't resist noting that life is but a pool of negative entropy, if only for a short time. ]

Regards!

...JRF...

Re: ssh entropy commands

himacs — Tue, 22 Mar 2011 20:25:13 GMT

Hi JRF,

Thanks for the response.

My server is B.11.23

ssh -V
OpenSSH_5.2p1+sftpfilecontrol-v1.3-hpn13v5, OpenSSL 0.9.8k 25 Mar 2009
HP-UX Secure Shell-A.05.20.014, HP-UX Secure Shell version

Regards
himacs

Re: ssh entropy commands

himacs — Tue, 22 Mar 2011 20:32:47 GMT

>>Those ported to HP-UX have used '/dev/urandom' for some time

In newer version ssh_prng_cmds file still used?

As per my understanding to get seeds 'ssh-rand-helper' commands runs the 'ssh_prng_cmds' during ssh establishment.

Regards
himacs

Re: ssh entropy commands

Dennis Handly — Fri, 25 Mar 2011 23:06:54 GMT

>JRF: I can't resist noting that life is but a pool of negative entropy, if only for a short time.

And the whole purpose of a sysadmin is to make sure that entropy increases (but not too much :-) and to keep it secure. entropy == info