Re: [gentoo-hardened] Bought an "entropy-key" - very happy

[Ed W <lists@wildgooses.com>]

On 26/03/2010 14:15, Brian Kroth wrote:
> Here's another graphing tool I started using since whoever started this
> thread got me hooked on the subject :)
> http://collectd.org/wiki/index.php/Plugin:Entropy
>    

Nice

For those using snmpd (eg cacti) all I did was add this line to my 
/etc/snmp/snmpd.conf file:
exec .1.3.6.1.4.1.2021.60 entropy /bin/cat 
/proc/sys/kernel/random/entropy_avail

Then I used a template from the cacti mailing list to easily pull that 
into a graph in cacti and plot it

> Things are much worse, even for physical machines, than I originally
> suspected, so I'm now thinking about trying to setup something like this
> in conjunction with both the entropy key and the timer_entropyd so that
> I can provide an entropy service to various clients.
> http://www.vanheusden.com/entropybroker/
>    

I don't have audio, video or builtin hw rand on my servers, so I could 
only user timer_entropyd.  This chewed about 2-5% CPU on one very 
lightly loaded quad core intel board and kept the entropy at about 
80-100%.  On my other AMD dual core live server, it chewed more like 
5-15% cpu (not sure why) and mostly it keeps entropy at 70-100%, but 
with regular dips to zero (server is pretty lightly loaded, load average 
around 0.2).  Unless you are a complete tinfoil hatter then this is 
probably plenty

The ekeyd keeps the machine at 100% entropy (actually it keeps it at 
slightly *over* 15,000 bytes which is the pool size - I'm not quite sure 
how/why it's keeping the pool at 101% filled, but there you go).  CPU 
load is zero

For distributing entropy around, the entropykey comes with a basic egd 
compatible socket and you simply setup an egd client (also supplied) to 
read from that socket.  I don't believe this is encrypted, so 
entropybroker looks better over a real network, but it's also not yet in 
portage (anyone got some time to contribute an ebuild?)

So from a "it's done" point of view, the entropy key really is a very 
simple and low CPU solution.

Ed W