rndctl
—
kernel entropy pool management tool
rndctl |
[-CcEe ] [-d
devname | -t
devtype] |
rndctl |
[-lsv ] [-d
devname | -t
devtype] |
The rndctl
program displays statistics on the current
state of the rnd(4) device, and
controls which sources are allowed to contribute to the entropy pool
maintained by rnd(4).
The following options are available:
-C
- Disable collection of data for the given device name or device type.
-c
- Enable collection of data for the given device name or device type.
-d
- Only the device named devname is altered or
displayed. This is mutually exclusive with
-t
.
-E
- Ignore estimates of entropy from the drivers for the given device name or
type.
If collection is still enabled, data is still collected and
mixed into the internal entropy pool, but no entropy is assumed to be
present and data from the selected devices will not unblock
/dev/random.
-e
- Accept estimates of entropy from the drivers for the given device name or
type.
rndctl -e
does not change the estimate
provided by the driver; if the driver's estimate is zero, as it
generally is for devices of types other than
rng
, it remains zero after
rndctl -e
.
-i
- With the
-L
option to load a seed from a file,
ignore any estimate in the file of the entropy of the seed. This still
loads the data into the kernel, but won't unblock
/dev/random even if the file claims to have
adequate entropy. This is useful if the file is on a medium, such as an
NFS share, that the operator does not know to be secret.
-L
- Load a seed from save-file generated by
rndctl -S
. Overwrite it with a seed derived by
hashing it together with output from /dev/urandom
so that the new seed has at least as much entropy as either the old seed
had or the system already has. If interrupted, either the old seed or the
new seed will be in place.
-l
- List all sources, or, if the
-t
or
-d
flags are specified, only those specified by
the devtype or devname
specified.
-S
- Generate a seed from the system entropy pool and save it to
save-file for later use with
rndctl
-L
.
The file format is specific to rndctl
and includes an estimate of the amount of saved entropy and a checksum.
The prior internal state of the system entropy pool cannot be recovered
from save-file, so disclosure of
save-file does not compromise past secrets drawn
from /dev/urandom or equivalent.
-s
- Display statistics on the current state of the entropy pool.
-t
- All devices of type devtype are altered or
displayed. This is mutually exclusive with
-d
.
The available types are:
disk
- Physical hard drives.
net
- Network interfaces.
tape
- Tape devices.
tty
- Terminal, mouse, or other user input devices.
rng
- Hardware random number generators.
-v
- Verbose output.
The rndctl
program was first made available in
NetBSD 1.3.
The rndctl
program was written by
Michael Graff ⟨explorer@flame.org⟩.