I'm trying to install OpenSSH on HP-UX 11.11, so, first of all, I was going to install OpenSSL, but I get an error message during "make test"...
23324:error:24064064:random number generator:SSLEAY_RAND_BYTES:PRNG not seeded:md_rand.c:503:You need to read the OpenSSL FAQ, http://www.openssl.org/support/faq.html
23324:error:04088003:rsa routines:RSA_setup_blinding:BN lib:rsa_lib.c:417:
23324:error:04066044:rsa routines:RSA_EAY_PRIVATE_ENCRYPT:internal error:rsa_eay.c:409:
23324:error:0D0C3006:asn1 encoding routines:ASN1_item_sign:EVP lib:a_sign.c:276:
error using 'x509' to self sign a certificate request
make[1]: *** [test_ss] Error 1
make[1]: Leaving directory `/tmp/openssl-0.9.8g/test'
make: *** [tests] Error 2
This is because there isn't a "randomness device". How can I solve this problem?
porter
January 7, 2008, 10:51am
2
I run OpenSSH on both my HPUX 11.11 boxes but I can remember if I had to explicitly install them.
Did you install any GOLD update pack?
The installation from binaries (I found out them on Porting And Archive Centre For HP-UX ) now went successfully but...
bash# /usr/local/sbin/sshd
PRNG is not seeded
porter
January 7, 2008, 11:13am
4
Did you follow the installation instructions?
Neo
January 7, 2008, 11:41am
5
Did you read this?
OpenSSL: Support, Frequently Asked Questions
Why do I get a "PRNG not seeded" error message?
On other systems, applications have to call the RAND_add() or RAND_seed() function with appropriate data before generating keys or performing public key encryption. (These functions initialize the pseudo-random number generator, PRNG.) Some broken applications do not do this. As of version 0.9.5, the OpenSSL functions that need randomness report an error if the random number generator has not been seeded with at least 128 bits of randomness. If this error occurs and is not discussed in the documentation of the application you are using, please contact the author of that application; it is likely that it never worked correctly. OpenSSL 0.9.5 and later make the error visible by refusing to perform potentially insecure encryption.
If you are using Solaris 8, you can add /dev/urandom and /dev/random devices by installing patch 112438 (Sparc) or 112439 (x86), which are available via the Patchfinder at SunSolve Home Page (Solaris 9 includes these devices by default). For /dev/random support for earlier Solaris versions, see Sun's statement at SunSolve (the SUNWski package is available in patch 105710).
On systems without /dev/urandom and /dev/random, it is a good idea to use the Entropy Gathering Demon (EGD); see the RAND_egd() manpage for details. Starting with version 0.9.7, OpenSSL will automatically look for an EGD socket at /var/run/egd-pool, /dev/egd-pool, /etc/egd-pool and /etc/entropy.
Most components of the openssl command line utility automatically try to seed the random number generator from a file. The name of the default seeding file is determined as follows: If environment variable RANDFILE is set, then it names the seeding file. Otherwise if environment variable HOME is set, then the seeding file is $HOME/.rnd. If neither RANDFILE nor HOME is set, versions up to OpenSSL 0.9.6 will use file .rnd in the current directory while OpenSSL 0.9.6a uses no default seeding file at all. OpenSSL 0.9.6b and later will behave similarly to 0.9.6a, but will use a default of "C:\" for HOME on Windows systems if the environment variable has not been set.
If the default seeding file does not exist or is too short, the "PRNG not seeded" error message may occur.
The openssl command line utility will write back a new state to the default seeding file (and create this file if necessary) unless there was no sufficient seeding.
Pointing $RANDFILE to an Entropy Gathering Daemon socket does not work. Use the "-rand" option of the OpenSSL command line tools instead. The $RANDFILE environment variable and $HOME/.rnd are only used by the OpenSSL command line tools. Applications using the OpenSSL library provide their own configuration options to specify the entropy source, please check out the documentation coming the with application.
Neo
January 7, 2008, 12:26pm
7
porter:
"OpenSSH" != "OpenSSL".
Porter,
Did you read the original error message in the first post????
23324:error:24064064:random number generator:SSLEAY_RAND_BYTES:PRNG not seeded:md_rand.c:503:You need to read the OpenSSL FAQ, http://www.openssl.org/support/faq.html
Or did you read this part of the error message???
It directs the user:
Read the entire posts and error messages before putting the trigger... thanks.
Neo
porter:
"OpenSSH" != "OpenSSL".
They both use a random number generator device. So what Neo posted is relevant to both. PRNG Not Seeded errors indicate problems with randomness, a simple Google/Yahoo search will unearth mountains of tales for that error message. (if the FAQ is a little hard to chew, of course)
Take care,
Neo
January 7, 2008, 4:26pm
9
In this case, it should be obvious to everyone that the error is generated by OpenSSL. You can read it directly in the error message.
make[1]: Leaving directory `/tmp/openssl-0.9.8g/test'
I am amazed at how few people actual read the posts they reply to.
