random number generator ... not seeded

[Terrence Johnson]

I'm trying to generate a secure key set using openssl in Apache. I keep getting an error stating that the random number generator:SSLEAY_RAND_BYTES:PRNG: not seeded. What's that all about?

[Tom Jackson]

See if this helps -> http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&threadm=9me1cj%24iqv%241%40FreeBSD.csie.NCTU.edu.tw&rnum=12&prev=/groups%3Fq%3Dapache%2BSSLEAY_RAND_BYTES:PRNG:%2Bnot%2Bseeded.%26hl%3Den%26lr%3D%26ie%3DUTF-8%26start%3D10%26sa%3DN

Tom

[Paul Sperry]

The OpenSSL req.c command has a -rand option too.
try and add a -rand /home/entropy to these lines in
grid-cert-request.in and grid-cert-request

${SSLEAY} req -new -keyout ${KEY_FILE} -out ${REQ_OUTPUT} -config ${SSLEAY_USER_CONFIG} ${NO_DES}
and
${SSLEAY} req -new -keyout ${KEY_FILE} -out ${REQ_OUTPUT} -config ${used_config} ${NO_DES} < ${REQ_INPUT}


Also looking closer, it look like it will create a .rnd file
for you if you have the RANDFILE=$ENV::HOME/.rnd
set in the globus-user-ssleay.conf

The app_RAND_ routines in apps/app_rand.c will check if
the RANDFILE is a EGD socket and not try and write to it.


The GSI will also try and call the EGD using the OpenSSL interface,
from src/Security/gssapi_ssleay/sslutils.c. See the comments which
start at line 325. But I have not tried the EGD this myself.

Can you try and set the EDG_PATH to point to your socket?

The GSI code does try and add some extra randomness, and will use the
$HOME/.rnd or RANDFILE if set.


351 #if SSLEAY_VERSION_NUMBER >= 0x0090581fL
352 /*
353 * Try to use the Entropy Garthering Deamon
354 * See the OpenSSL crypto/rand/rand_egd.c
355 */
356 egd_path = getenv("EGD_PATH");
357 if (egd_path == NULL) {
358 egd_path = "/etc/entropy";
359 }
360 RAND_egd(egd_path);
361 #endif
362

[U.SivaKumar_2]

Hi,

It is looking for /dev/urandom random seed generator device file.

HP-UX 11i v1.6 has kernel support for that device file. ( Not Installed by default)

HP-UX 11.x and 10.x don;t have support for this file. You have use some other random generator

regards,
U.SivaKumar