Re: SSH / SSH-KEYGEN / PRNGD SEED

Hi Noel,

this is Max from Milan, italy.....

I've seen your ssh installayion steps.... In Solaris 8 precompiled packaged, i think you've taken from sunfreeware website,
you have you install 112438-01 patch (/dev/random patch) BEFORE to create the keys.
Openssh 3.5p1 solaris 8 precompiled package is created for using /dev/random device and NOT for
using PRNGD daemon.
PRNGD daemon in NOT necessary.

After you installed the patch you've two choiches for creating /dev/random& urandom devices:

1. reboot the system
2. RUn this script (reboot is not necesary)
   #!/usr/bin/ksh
   # Set up Solaris random device from patch 112438-01 without reboot
   # Moderate error checking only since this should be straightforward.
   #
   # (c) 2002 Andrew J. Caines. Permission to modify and distribute is
   # granted on condition the copyright message is included and
   modifications
   # are clearly identified.
   #
   # Incoporating suggestions and changes from these SunManager list
   members:
   # Thomas Anders <anders@hmi.de>, Dan Astoorian
   <djast@cs.toronto.edu>,
   # Prümm Gerd <gerd.pruemm@alcatel.ch>, Adam Mazza
   <adam@68e.com>.
   # Script rewrite for functional changes and reliability improvement based
   # on contribution from from Jeff Bledsoe.
   

PATH=/usr/bin:/usr/sbin

Patch=${Patch:-112438} # Just in case it ever changes

# Set up tempfile

TmpFile=/tmp/.$$.$RANDOM ; rm -f $TmpFile ; touch $TmpFile; chmod 600 $TmpFile

function bailout
{ echo "$*. Exiting" >&2 ; exit 1
}

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

# Check patch is installed

echo "Checking for patch $Patch...\c"
if showrev -p | egrep -s "^Patch: ${Patch}-" then echo " installed."
else bailout " not installed. Install it and try again." fi

# Activate random kernel module with workaround for module dependency
problem
echo "Removing random device from name_to_major" name_to_major=$(</etc/name_to_major)
echo "$name_to_major" | sed '/random/d' > /etc/name_to_major

# Add driver to create device nodes and load module
echo "Adding driver to system"
add_drv -m '* 0644 root sys' random || bailout "Driver random failed to add"

# Report results

echo "Finished. You now have the following random devices:" ls -l /dev/*random /devices/pseudo/random@0:*random

# Test

echo "Do you want to test the new device? (y/n) \c" read yn
case $yn in

    [Yy]*) echo "Running: dd if=/dev/random of=$TmpFile bs=512 count=1"

           dd if=/dev/random of=$TmpFile bs=512 count=1    echo "Running: strings $TmpFile"
   echo "You should see a few lines of random garbage:"    ;;
    [Nn]*) echo "Your blind faith will be rewarded in the next life."

           echo "Your reward confiration code is:"    ;;
esac

Do you need more help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

strings $TmpFile
rm -f $TmpFile

exit 0

After you ran this script you can install the rest of the SSH packages end create the keys.

Let me give you an advice:
DON'T start SSHD daemon with inetd, but with a specific script or by /etc/inittab

Max

Massimiliano Gregis
Sun Microsystems Senior Consultant
Phone.: 035.697534
Mobile.: 347.1167790
Fax.....: 035.697590
E.mail: - mgregis@sorint.it

• massimiliano@sorint.it
• massimiliano.gregis@sorint.it

Sorint http://www.sorint.it