freeipa

#6324 [RFE][tracker] use same source of random data in all FreeIPA dependencies
Opened by pvoborni. Modified

Open
Close Issue

Let's check IPA and all its dependencies (and possibly their dependencies) if they use the same source of random data, e.g. /dev/urandom

If they don't make it happen.

triage notes:

http://www.2uo.de/myths-about-urandom/
christian:  python will use the same syscall (we are fine)
https://www.python.org/dev/peps/pep-0524/
krb5 - Robbie is investigating
ab: gnutls uses getrandom
H: about getrandom: https://lwn.net/Articles/606141/
devmtg: put to 4.5 backlog

Related new from Robbie Harwood on Kerberos and getrandom:

Robbie Harwood <rharwood@redhat.com> writes:
...
krb5-1.14.4-2 is now available in rawhide.  It uses getrandom() for all
entropy requests (and I expect will be faster in all cases, not just
low-entropy ones, because there's no user-space PRNG anymore).  So as
long as the kernel is not in early boot, there won't be long delays on
setting up Kerberos.

The Kerberos call support is now also being considered for RHEL: https://bugzilla.redhat.com/show_bug.cgi?id=1330000

Metadata Update from @pvoborni:
- Issue assigned to someone
- Issue set to the milestone: FreeIPA 4.5 backlog
Metadata
None
None
None
Normal
enhancement
IPA
0
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.