rndctl(8)
- NetBSD Manual Pages
RNDCTL(8) NetBSD System Manager's Manual RNDCTL(8)
NAME
rndctl -- kernel entropy pool management tool
SYNOPSIS
rndctl [-CcEe] [-d devname | -t devtype]
rndctl [-lsv] [-d devname | -t devtype]
rndctl [-i] -L save-file
rndctl -S save-file
DESCRIPTION
The rndctl program displays statistics on the current state of the rnd(4)
device, and controls which sources are allowed to contribute to the
entropy pool maintained by rnd(4).
The following options are available:
-C Disable collection of data for the given device name or device
type.
-c Enable collection of data for the given device name or device
type.
-d Only the device named devname is altered or displayed. This is
mutually exclusive with -t.
-E Ignore estimates of entropy from the drivers for the given device
name or type.
If collection is still enabled, data is still collected and mixed
into the internal entropy pool, but no entropy is assumed to be
present and data from the selected devices will not unblock
/dev/random.
-e Accept estimates of entropy from the drivers for the given device
name or type.
rndctl -e does not change the estimate provided by the driver; if
the driver's estimate is zero, as it generally is for devices of
types other than rng, it remains zero after rndctl -e.
-i With the -L option to load a seed from a file, ignore any esti-
mate in the file of the entropy of the seed. This still loads
the data into the kernel, but won't unblock /dev/random even if
the file claims to have adequate entropy. This is useful if the
file is on a medium, such as an NFS share, that the operator does
not know to be secret.
-L Load a seed from save-file generated by rndctl -S. Overwrite it
with a seed derived by hashing it together with output from
/dev/urandom so that the new seed has at least as much entropy as
either the old seed had or the system already has. If inter-
rupted, either the old seed or the new seed will be in place.
-l List all sources, or, if the -t or -d flags are specified, only
those specified by the devtype or devname specified.
-S Generate a seed from the system entropy pool and save it to
save-file for later use with rndctl -L.
The file format is specific to rndctl and includes an estimate of
the amount of saved entropy and a checksum. The prior internal
state of the system entropy pool cannot be recovered from
save-file, so disclosure of save-file does not compromise past
secrets drawn from /dev/urandom or equivalent.
-s Display statistics on the current state of the entropy pool.
-t All devices of type devtype are altered or displayed. This is
mutually exclusive with -d.
The available types are:
disk Physical hard drives.
net Network interfaces.
tape Tape devices.
tty Terminal, mouse, or other user input devices.
rng Hardware random number generators.
-v Verbose output.
SEE ALSO
rnd(4), entropy(7), rnd(9)
HISTORY
The rndctl program was first made available in NetBSD 1.3.
AUTHORS
The rndctl program was written by Michael Graff <explorer@flame.org>.
NetBSD 10.99 April 2, 2021 NetBSD 10.99
Powered by man-cgi (2021-06-01).
Maintained for NetBSD
by Kimmo Suominen.
Based on man-cgi by Panagiotis Christias.