RE: openSSL Key generation

Hi Leland,

> nohup time /usr/bin/openssl genrsa -rand /dev/urandom
> 1024 > /tmp/server.key &

Two things occur to me; it's waiting for you to enter a password to protect the key, as the process is bg it's blocked. The other thing that can occur (very rarely) on linux is that the urandom system is not getting enough entropy to generate random numbers needed by OpenSSL. This can be tested by using:

        dd if=/dev/urandom of=/tmp/rand bs=2k count=1

This should return almost immediately and generate a 2k file /tmp/urandom.bin, if it does not return but blocks, then you have an entropy gathering problem. I doubt it will be a prob. but this is the way to check.

Several suggestions:

1. remove the '-rand /dev/urandom' statement, it reads this by default (under Linux). On SUN machines there is no /dev/urandom, PRNGd is used instead. Unless you need an alternate random source, you don't to specify and scripts transport easily between OS's.
2. Use '-out /tmp/server.key' instead of piping the key, it's easier to separate the key from any errors.
3. The keygen process requires you to enter a passwd for the key, which is why it is never completes. if you 'fg' the process and then type in the passwd+ENTER, repeated twice, the process will complete.
4. If you are unsure of the syntax, run openssl in interactive mode and use '?' to get help:

	# openssl
	OpenSSL> ?
	OpenSSL> genrsa ?

The docs are often outdated, this is the only sure way to know what is compiled in.   

Rgds,   

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Simon Thornton