Getting more entropy for virtual servers

It is not uncommon for people to have performance problems with the their virtual servers and chalk it up to virtualization as the problem instead of insufficient entropy.  Running a mail server or SSL web server are particularly vulnerable to virtual servers without much entropy.  I have noticed that my virtual servers have had a lot less entropy in the past 6 months or so.  I decided to revisit what simple and effective solutions exist to solve this problem.

I decided I would do a search for debian and ubuntu packages that could be used without much modification or configuration.

  • reseed – this pulls random data from random.org.  However, it does this over HTTP so this package should be avoided unless one wanted to rewrite it to use HTTPS.
  • randomsound – this pulls random bits from a soundcard.  This is good for a host system with a soundcard but not useful for a virtual server.
  • rng-tools – this is supposed to pull from a hardware true random number generator however some people have used /dev/urandom as the source.  This is probably not a good solution.
  • haveged – this basically uses interrupt timing to generate random numbers. Not a lot has been written about haveged but it seems like the best easily available solution.  It would be nice to review the quality of the random numbers though.

Other options:

  • KVM supposedly has a virtio-rng device which can pull entropy from the host into the guest.  This would still potentially create a need for entropy creation on the host but could be a simpler setup for those using KVM.
  • It would be pretty easy to write a script to download random bits from random.org using HTTPS.

Leave a Reply

Your email address will not be published. Required fields are marked *