diff options
| author | riastradh <riastradh@NetBSD.org> | 2023-06-30 21:44:09 +0000 |
|---|---|---|
| committer | riastradh <riastradh@NetBSD.org> | 2023-06-30 21:44:09 +0000 |
| commit | 04d6489017a0b0f710fc2a3205ab92e4b769497d (patch) | |
| tree | 1f6bac3e5c37ed146c01548bcbdd078c6f1aa016 /etc | |
| parent | 0104db331cab86116357b7d66d95812c061c4086 (diff) | |
rc.conf(5): Set entropy=wait by default.
We no longer block indefinitely -- if nothing else, the hardclock
timer should yield enough samples to unblock /dev/random on all but
the most severely deterministic machines -- so it should be generally
safe for availability to set entropy=wait.
This doesn't guarantee that HWRNG/seed has been provided before you
run ssh-keygen or call getentropy(3) in a user application, but it
does raise the security above netbsd<=9.
PR security/55659
PR lib/56905
XXX pullup-10
Diffstat (limited to 'etc')
| -rw-r--r-- | etc/defaults/rc.conf | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/etc/defaults/rc.conf b/etc/defaults/rc.conf index a8d268067a7..3f992ed04a4 100644 --- a/etc/defaults/rc.conf +++ b/etc/defaults/rc.conf @@ -1,4 +1,4 @@ -# $NetBSD: rc.conf,v 1.163 2023/02/03 13:53:40 mlelstv Exp $ +# $NetBSD: rc.conf,v 1.164 2023/06/30 21:44:09 riastradh Exp $ # # /etc/defaults/rc.conf -- # default configuration of /etc/rc.conf @@ -388,9 +388,10 @@ veriexec_flags="-k" random_seed=YES # Set to `check' to abort multi-user boot if not enough entropy, or -# `wait' to wait until enough entropy. +# `wait' to wait until enough entropy, or `' (empty) to boot without +# waitingor checking. # -entropy="" +entropy="wait" # Creating / updating of man page index on boot makemandb=YES |
