rndctl(8) - NetBSD Manual Pages

RNDCTL(8)               NetBSD System Manager's Manual               RNDCTL(8)


NAME

     rndctl -- kernel entropy pool management tool


SYNOPSIS

     rndctl [-CcEe] [-d devname | -t devtype]
     rndctl [-lsv] [-d devname | -t devtype]
     rndctl [-i] -L save-file
     rndctl -S save-file


DESCRIPTION

     The rndctl program displays statistics on the current state of the rnd(4)
     device, and controls which sources are allowed to contribute to the
     entropy pool maintained by rnd(4).

     The following options are available:

     -C      Disable collection of data for the given device name or device
             type.

     -c      Enable collection of data for the given device name or device
             type.

     -d      Only the device named devname is altered or displayed.  This is
             mutually exclusive with -t.

     -E      Ignore estimates of entropy from the drivers for the given device
             name or type.

             If collection is still enabled, data is still collected and mixed
             into the internal entropy pool, but no entropy is assumed to be
             present and data from the selected devices will not unblock
             /dev/random.

     -e      Accept estimates of entropy from the drivers for the given device
             name or type.

             rndctl -e does not change the estimate provided by the driver; if
             the driver's estimate is zero, as it generally is for devices of
             types other than rng, it remains zero after rndctl -e.

     -i      With the -L option to load a seed from a file, ignore any esti-
             mate in the file of the entropy of the seed.  This still loads
             the data into the kernel, but won't unblock /dev/random even if
             the file claims to have adequate entropy.  This is useful if the
             file is on a medium, such as an NFS share, that the operator does
             not know to be secret.

     -L      Load a seed from save-file generated by rndctl -S.  Overwrite it
             with a seed derived by hashing it together with output from
             /dev/urandom so that the new seed has at least as much entropy as
             either the old seed had or the system already has.  If inter-
             rupted, either the old seed or the new seed will be in place.

     -l      List all sources, or, if the -t or -d flags are specified, only
             those specified by the devtype or devname specified.

     -S      Generate a seed from the system entropy pool and save it to
             save-file for later use with rndctl -L.

             The file format is specific to rndctl and includes an estimate of
             the amount of saved entropy and a checksum.  The prior internal
             state of the system entropy pool cannot be recovered from
             save-file, so disclosure of save-file does not compromise past
             secrets drawn from /dev/urandom or equivalent.

     -s      Display statistics on the current state of the entropy pool.

     -t      All devices of type devtype are altered or displayed.  This is
             mutually exclusive with -d.

             The available types are:

             disk   Physical hard drives.

             net    Network interfaces.

             tape   Tape devices.

             tty    Terminal, mouse, or other user input devices.

             rng    Hardware random number generators.

     -v      Verbose output.


SEE ALSO

     rnd(4), entropy(7), rnd(9)


HISTORY

     The rndctl program was first made available in NetBSD 1.3.


AUTHORS

     The rndctl program was written by Michael Graff <explorer@flame.org>.

NetBSD 9.99                      April 2, 2021                     NetBSD 9.99