Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Trying to generate a key for a server.

gpg --gen-key

We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy.

and it just hangs there.

There is another error:

can't connect to `/root/.gnupg/S.gpg-agent': No such file or directory

which seems to go away after:

gpg-agent --daemon
GPG_AGENT_INFO=/tmp/gpg-4c5hyT/S.gpg-agent:1397:1; export GPG_AGENT_INFO;

#GPG_AGENT_INFO=/tmp/gpg-4c5hyT/S.gpg-agent:1397:1; export GPG_AGENT_INFO;
gpg --gen-key
...

but again, it hangs at "...gain enough entropy".

There are no "++++++++++++++++++++++++++++++++++++++++++"'s which from forum posts looks like should be expected as the key is generated.

I have tried reinstalling the package, but seemingly everything depends on gpg.

I've read other people having problems with this on centos 6 too (whereas centos 5 works fine).

There is nothing remarkable in /var/log/*.

Any ideas on where to go from here?

Thanks.

share|improve this question
add comment

3 Answers

up vote 5 down vote accepted

Anytime I've seen it (gpg --gen-key) hang like this, I log in to another shell and start a "dd if=/dev/sda of=/dev/zero" and it takes off after a few seconds / minutes.

share|improve this answer
    
Awesome. Thank you. I can't believe I missed that part of the manual :/ –  stormdrain Jan 22 '13 at 15:59
    
It would be a much better idea to grab different entropy each time. If you're system is constantly running out of entropy then something is terribly wrong with your configuration or you're using up entropy very quickly (to the point where you should have a hardware RNG). If you need more entropy on a regular basis there are valid places to simply download more, like Humboldt-Universität's Quantum RNG. –  Chris S Jan 23 '13 at 16:38
    
@ChrisS Thanks. I only needed to generate the key once for use with an authentication system; it won't be an ongoing thing. Should it become more frequent an issue, I will use the HSM that the company sells (which I planned to get anyway). This was just confusing because there was no indication at all that the process was still running. Even ps seemed to indicate it was just sitting there... –  stormdrain Jan 23 '13 at 17:20
add comment

For a more reliable solution you could install random number generator related utilities, which will make sure that you always have enough random bytes.

yum install rng-tools

and then edit /etc/sysconfig/rngd and add EXTRAOPTIONS="-r /dev/random"

Start the service

 service rngd start

Voila and you live happily ever after :)

share|improve this answer
add comment

Both comments given before are perfectly fine. But here is just my 2 cents.

The problem with RHEL/centos 6 and entropy is that they are tickless kernels. So, by themselves, these kernels don't generate enough entropy. You have to get some keyboard attached or even some mouse movement or use dd as mentioned.

rngd daemon is awesome and most commercial entities use it.

However, the best approach I have seen is use of dedicated TPM device. They are small hardware which are quite expensive. You put them and rngd utilizes random true entropy from the hardware source. As far as I know, Fujitsu has some good TPM device.

Yeah, these three methods pretty much cover the entropy part.

share|improve this answer
    
Very interesting. Thank you. As I mentioned to Chris, I will have access to an HSM soon which comes with an RNG. –  stormdrain Jan 23 '13 at 17:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.