<html dir="ltr"><head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style title="owaParaStyle">P {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
</style>
<meta content="MSHTML 6.00.6000.16825" name="GENERATOR">
</head>
<body ocsi="x">
<div dir="ltr"><font face="Lucida Console" color="#000000" size="2">One other thing:</font></div>
<div dir="ltr"><font face="lucida console" size="2">when I remove /dev/random from the chroot, bind just uses the</font></div>
<div dir="ltr"><font face="lucida console" size="2">pre-chroot /dev/random</font></div>
<div dir="ltr"><font face="lucida console" size="2">14-May-2009 14:09:51.065 could not open entropy source /dev/random: file not found<br>
14-May-2009 14:09:51.065 using pre-chroot entropy source /dev/random<br>
</font></div>
<div dir="ltr"><font face="lucida console" size="2"><font face="lucida console">which is groovy.</font></font></div>
<div dir="ltr"><font face="lucida console" size="2">So I guess I dont need the chroot random, but I would still like</font></div>
<div dir="ltr"><font face="lucida console" size="2">to know why using the chrooted /dev/random causes this problem.</font></div>
<div dir="ltr"><font face="lucida console" size="2"></font><font face="lucida console"> </div>
</font>
<div>
<div><font face="Tahoma" size="2">
<div dir="ltr" align="left"><font face="Lucida Console" size="2">--</font></div>
<div dir="ltr" align="left"><font face="Lucida Console" size="2">Jack Tavares</font></div>
<div dir="ltr" align="left"><font face="Lucida Console" size="2">AIM: jacktavares</font></div>
<div dir="ltr" align="left"><font face="Lucida Console" size="2">SKYPE: jackandkaddee</font></div>
<div dir="ltr" align="left"><font face="Lucida Console" size="2">Reminder: I am at GMT+2, 10 hours AHEAD of Seattle.</font></div>
<div dir="ltr" align="left"><font face="Lucida Console" size="2">My workweek is Sunday-Thursday.</font></div>
<div dir="ltr" align="left"><font face="Lucida Console" size="2">Email sent to me Thursday afternoon (PST) may not be viewed until Sunday morning (GMT+2).</font></div>
</font></div>
<div><font face="Lucida Console" size="2"></font> </div>
<div><font face="Lucida Console"></font> </div>
</div>
<div id="divRpF475849" style="DIRECTION: ltr">
<hr tabindex="-1">
<font face="Tahoma" size="2"><b>From:</b> bind-users-bounces@lists.isc.org [bind-users-bounces@lists.isc.org] On Behalf Of Jack Tavares [j.tavares@F5.com]<br>
<b>Sent:</b> Thursday, May 14, 2009 09:50<br>
<b>To:</b> bind-users@lists.isc.org<br>
<b>Subject:</b> /dev/random in chroot jail causing errors with nsupdate of dnssec signed zone<br>
</font><br>
</div>
<div></div>
<div>
<div dir="ltr"><font face="Lucida Console" color="#000000" size="2">So I posted a couple of message about how my nsupdates</font></div>
<div dir="ltr"><font face="lucida console" size="2">were failing intermittenly when attempting to update a signed zone.</font></div>
<div dir="ltr"><font face="lucida console" size="2"></font> </div>
<div dir="ltr"><font face="lucida console" size="2">The only error I get in the log is:</font></div>
<div dir="ltr">14-May-2009 13:17:09.077 client 127.0.0.1#10277: view external: updating zone 'test.net/IN': prerequisites are OK<br>
14-May-2009 13:17:09.077 client 127.0.0.1#10277: view external: signer "update.test.net" approved<br>
14-May-2009 13:17:09.077 client 127.0.0.1#10277: view external: update 'test.net/IN' approved<br>
14-May-2009 13:17:09.077 client 127.0.0.1#10277: view external: updating zone 'test.net/IN': update section prescan OK<br>
14-May-2009 13:17:09.077 client 127.0.0.1#10277: view external: updating zone 'test.net/IN': adding an RR at 'newest4.test.net' A<br>
14-May-2009 13:17:09.084 client 127.0.0.1#10277: view external: updating zone 'test.net/IN': RRSIG/NSEC/NSEC3 update failed: failure<br>
14-May-2009 13:17:09.084 client 127.0.0.1#10277: view external: updating zone 'test.net/IN': rolling back<br>
</div>
<div dir="ltr"><font face="times new roman">The keys are generated with RSASHA1 and use -r /dev/urandom
</font></div>
<div dir="ltr"><font face="times new roman"></font> </div>
<div dir="ltr"><font face="times new roman">I run named in chroot jail, at /var/named</font></div>
<div dir="ltr"><font face="times new roman">I created /var/named/dev/random with </font>
</div>
<div dir="ltr"><font face="times new roman"></font> </div>
mknod -m644 /var/named/dev/random c 1 8<br>
<div dir="ltr"><font face="times new roman"></font> </div>
<div dir="ltr"><font face="times new roman">which mimics the major and minor number from the system</font></div>
<div dir="ltr"><font face="times new roman">ls -lL /dev/random</font></div>
<div dir="ltr"><font face="times new roman"></font> </div>
<div dir="ltr"><font face="times new roman">crw-r--r-- 1 root root 1, 8 May 13 03:27 /dev/random<br>
</font></div>
<div dir="ltr"><font face="times new roman"><font face="times new roman">The nsupdates fail, seemingly randomly.</font></font></div>
<div dir="ltr"><font face="times new roman"><font face="times new roman"></font></font> </div>
<div dir="ltr"><font face="times new roman"><font face="times new roman">When I delete this /dev/random from the chroot, they work.
</font></font></div>
<div dir="ltr"><font face="times new roman"><font face="times new roman"></font></font> </div>
<div dir="ltr"><font face="times new roman"><font face="times new roman">So my question is:</font></font></div>
<div dir="ltr"><font face="times new roman"><font face="times new roman">am I setting up the /dev/random incorrectly?</font></font></div>
<div dir="ltr"><font face="times new roman">should I not be creating /dev/random? (the how-tos I have seen all talk about</font></div>
<div dir="ltr"><font face="times new roman">re-creating /dev/null and /dev/random etc)</font></div>
<div dir="ltr"><font face="times new roman"></font> </div>
<div dir="ltr"><font face="times new roman">Note:</font></div>
<div dir="ltr"><font face="times new roman">I also tried generating the keys not using /dev/urandom, and have the same</font></div>
<div dir="ltr"><font face="times new roman">inconsistent behavior with the chroot /dev/random present.</font></div>
<div dir="ltr"><font face="times new roman"></font> </div>
<div dir="ltr"><font face="times new roman"><font face="times new roman"></font> </div>
</font>
<div dir="ltr"><font face="times new roman"></font> </div>
<div><font face="Tahoma" size="2">
<div dir="ltr" align="left"><font face="Lucida Console" size="2">--</font></div>
<div dir="ltr" align="left"><font face="Lucida Console" size="2">Jack Tavares</font></div>
<div dir="ltr" align="left"><font face="Lucida Console" size="2"></font> </div>
</font></div>
<div><font face="Lucida Console" size="2"></font> </div>
<div><font face="Lucida Console"></font> </div>
</div>
</body>
</html>