summaryrefslogtreecommitdiff
path: root/etc
diff options
context:
space:
mode:
authorriastradh <riastradh@NetBSD.org>2023-06-30 21:44:09 +0000
committerriastradh <riastradh@NetBSD.org>2023-06-30 21:44:09 +0000
commit04d6489017a0b0f710fc2a3205ab92e4b769497d (patch)
tree1f6bac3e5c37ed146c01548bcbdd078c6f1aa016 /etc
parent0104db331cab86116357b7d66d95812c061c4086 (diff)
rc.conf(5): Set entropy=wait by default.
We no longer block indefinitely -- if nothing else, the hardclock timer should yield enough samples to unblock /dev/random on all but the most severely deterministic machines -- so it should be generally safe for availability to set entropy=wait. This doesn't guarantee that HWRNG/seed has been provided before you run ssh-keygen or call getentropy(3) in a user application, but it does raise the security above netbsd<=9. PR security/55659 PR lib/56905 XXX pullup-10
Diffstat (limited to 'etc')
-rw-r--r--etc/defaults/rc.conf7
1 files changed, 4 insertions, 3 deletions
diff --git a/etc/defaults/rc.conf b/etc/defaults/rc.conf
index a8d268067a7..3f992ed04a4 100644
--- a/etc/defaults/rc.conf
+++ b/etc/defaults/rc.conf
@@ -1,4 +1,4 @@
-# $NetBSD: rc.conf,v 1.163 2023/02/03 13:53:40 mlelstv Exp $
+# $NetBSD: rc.conf,v 1.164 2023/06/30 21:44:09 riastradh Exp $
#
# /etc/defaults/rc.conf --
# default configuration of /etc/rc.conf
@@ -388,9 +388,10 @@ veriexec_flags="-k"
random_seed=YES
# Set to `check' to abort multi-user boot if not enough entropy, or
-# `wait' to wait until enough entropy.
+# `wait' to wait until enough entropy, or `' (empty) to boot without
+# waitingor checking.
#
-entropy=""
+entropy="wait"
# Creating / updating of man page index on boot
makemandb=YES