[solved]s-nail has no access to sufficient entropy for restricted user

ford prefect · 2019-01-21 09:55:13

Hi,

on my headless ArchLinux server I run a restricted user http (no shell, no writing access to home dir ~http), who is aloo sends out notifications about this and that. It's not used too frequently, but I'm doing it with the mail command from the core/s-nail package.
Since a while (used rarely, so I can't pin down exactly when this happened) it fails to get sufficient entropy with the following error:

mail: Panic: Cannot seed the *TLS PseudoRandomNumberGenerator, RAND_status() is 0! Please set *tls-rand-file* to a file with sufficient entropy. On a machine with entropy: "$ dd if=/dev/urandom of=FILE bs=1024 count=1"

Setting up an entropy file instead of /dev/urandom sounds… not very futureproof, but also doesn't work as well. All other users successfully send mail with the same command.

Does anyone have a clue which permission is missing here?

Last edited by ford prefect (2019-01-21 17:09:18)

bugsmanagement · 2019-01-21 13:46:55

Hello there,

It seems with the latest kernel, especially on Archlinux, there's been trouble building entropy, what does `cat /proc/sys/kernel/random/entropy_avail` say? And have you tried https://wiki.archlinux.org/index.php/Haveged? If you have headless box that doesn't do much, can be clear indication for low entropy as well.

Regards

ford prefect · 2019-01-21 13:51:39

hi bugsmanagement: entropy_avail is 3413, and haveged is also running. since other users don't experience this problem, I doubt this is the cause.

bugsmanagement · 2019-01-21 14:00:43

You should change the title from 'mail' to 's-nail' by editing the first post. This removes ambiguous to if it's 'bsd-mail', or '*-mail', to 's-nail'

Last edited by bugsmanagement (2019-01-21 14:02:12)

ua4000 · 2019-01-21 16:31:30

ford prefect wrote:

Please set *tls-rand-file* to a file with sufficient entropy.

I think this is refering to the ".rnd" file.
http://manpages.ubuntu.com/manpages/cos … .3ssl.html
It's required to seed PRNG.

I had this problem too with a systemd unit running as nobody.
Since nobody had no home folder, there was no .rnd file found, thus snail failed to start TLS.

My solution: I switched my systemd unit to a user with a writeable home folder.

Better way, untested:
Seems there is an option for s-nail to set the location of ssl-rand-file, read/write required.
http://manpages.ubuntu.com/manpages/bio … ail.1.html

ford prefect · 2019-01-21 17:08:20

I have actually come across this and tried setting another entropy file, but smh did not succeed. Your suggestion with the read/writable ~/.rnd did the job.
Is this entropy actually consumed, e.g. do I need to refill? Or is this done by automatically?

Thanks anyways for the help!

ua4000 · 2019-01-21 17:15:12

My first links suggests to set:

 On all systems, if the environment variable RANDFILE is set, its value will be used as the
       seed file name.  Otherwise, the file is called ".rnd", found in platform dependent
       locations:

did you try this ? I'm curious about your test, to make my setup also better :-)

In the 2nd link is stated

 If this variable is not set, or set to the empty string, or if the Filename
           transformations fail, then RAND_file_name(3) will be used to create the filename.  If
           the SSL PRNG was seeded successfully The file will be updated (RAND_write_file(3)) if
           and only if seeding and buffer stirring succeeds.

This sounds like openssl (?) will take care of the file.

ford prefect · 2019-01-21 17:20:06

ua4000 wrote:

My first links suggests to set:
 On all systems, if the environment variable RANDFILE is set, its value will be used as the
       seed file name.  Otherwise, the file is called ".rnd", found in platform dependent
       locations:
did you try this ? I'm curious about your test, to make my setup also better :-)

Tried, but it did not work for me.

ua4000 wrote:

In the 2nd link is stated

 If this variable is not set, or set to the empty string, or if the Filename
           transformations fail, then RAND_file_name(3) will be used to create the filename.  If
           the SSL PRNG was seeded successfully The file will be updated (RAND_write_file(3)) if
           and only if seeding and buffer stirring succeeds.

This sounds like openssl (?) will take care of the file.

You are right, sounds alot like it. Thanks for reading more carefully than me.

ua4000 · 2019-01-21 17:31:53

ford prefect wrote:

Tried, but it did not work for me.

My first idea would be to set RANDFILE=/tmp/foo.rnd - which should work also for "nobody" in my case - I assume.
May I ask which location did you try for RANDFILE ?

ford prefect · 2019-01-21 21:11:28

May I ask which location did you try for RANDFILE ?

I tried

/etc/mail.entropy

to keep things somehow structured.

ua4000 · 2019-04-26 12:28:12

I stumbled over this problem today as user nobody

mail: Panic: Cannot seed the *TLS PseudoRandomNumberGenerator, RAND_status() is 0!
Please set *tls-rand-file* to a file with sufficient entropy.
On a machine with entropy: "$ dd if=/dev/urandom of=FILE bs=1024 count=1"

and tried my suggested solution now for myself,

RANDFILE="/tmp/mail.entropy" mail -s ...

... and it worked.

/etc/mail.entropy will not work out-of-the-box for a restricted user, because he maybe can't read/write to this location.

loqs · 2019-04-26 16:38:02

#include <openssl/rand.h>

int main(void)
{
  return RAND_status();
}

gcc test.c -lcrypto
./a.out
echo $?
1

Seems to show RAND_status() returning 1.

Arch Linux

#1 2019-01-21 09:55:13

[solved]s-nail has no access to sufficient entropy for restricted user

#2 2019-01-21 13:46:55

Re: [solved]s-nail has no access to sufficient entropy for restricted user

#3 2019-01-21 13:51:39

Re: [solved]s-nail has no access to sufficient entropy for restricted user

#4 2019-01-21 14:00:43

Re: [solved]s-nail has no access to sufficient entropy for restricted user

#5 2019-01-21 16:31:30

Re: [solved]s-nail has no access to sufficient entropy for restricted user

#6 2019-01-21 17:08:20

Re: [solved]s-nail has no access to sufficient entropy for restricted user

#7 2019-01-21 17:15:12

Re: [solved]s-nail has no access to sufficient entropy for restricted user

#8 2019-01-21 17:20:06

Re: [solved]s-nail has no access to sufficient entropy for restricted user

#9 2019-01-21 17:31:53

Re: [solved]s-nail has no access to sufficient entropy for restricted user

#10 2019-01-21 21:11:28

Re: [solved]s-nail has no access to sufficient entropy for restricted user

#11 2019-04-26 12:28:12

Re: [solved]s-nail has no access to sufficient entropy for restricted user

#12 2019-04-26 16:38:02

Re: [solved]s-nail has no access to sufficient entropy for restricted user

Board footer