Openvz: haveged, dnssec and dkim

Hi there,
i've found a big problem running ispconfig on openvz.
I've tried to gnerate dkim and dnssec for configuration and i've found that the process stop in waiting for something.
After a bit of debug i've read that it uses haveged for random number generation, so i've gone to check if demon was running and found...

Code:

/etc/init.d/haveged status
● haveged.service - Entropy daemon using the HAVEGE algorithm
   Loaded: loaded (/lib/systemd/system/haveged.service; enabled)
   Active: failed (Result: exit-code) since mar 2016-10-04 14:42:50 CEST; 9s ago
     Docs: man:haveged(8)
           http://www.issihosts.com/haveged/
Main PID: 8742 (code=exited, status=1/FAILURE)

I've started debug the problem, and found that openvz has low entropy, and probably for that service will not start. This is only my problem, or can be fixed in some ways?

 

I've no errors on haveged, nor in syslog, simply seems not starting...

Code:

root@dns1:~# /etc/init.d/haveged start
[ ok ] Starting haveged (via systemctl): haveged.service.
root@dns1:~# /etc/init.d/haveged status
● haveged.service - Entropy daemon using the HAVEGE algorithm
   Loaded: loaded (/lib/systemd/system/haveged.service; enabled)
   Active: failed (Result: exit-code) since mar 2016-10-04 16:27:59 CEST; 3s ago
     Docs: man:haveged(8)
           http://www.issihosts.com/haveged/
  Process: 16340 ExecStart=/usr/sbin/haveged --Foreground --verbose=1 --write=1024 (code=exited, status=1/FAILURE)
Main PID: 16340 (code=exited, status=1/FAILURE)
root@dns1:~#

Seems a problem on openvz, Ubuntu machine has same problem.

 

Mmmm panel is completing blocked, adding task in queue...

 

Ok, the server.sh was freezed, i've to kill and all seems to go well now.
I've found the error from wich dnsssec will not be generated:

Code:

DNSSEC ERROR: We are low on entropy. Not generating new Keys for domain.tld. Please consider installing package haveged.

Obviouslly haveged is installed, but not starting

 

I've investigated a bit... so...
- /etc/init.d/haveged start is not wokring
- entropy is very low
then i've done this test
- lunched simply havenged binary
- havenged is running
- entropy is high
as result of this, DNSSEC is working in ispconfig....

 

I've tried to restart server, but haveged not starting up.
I've tried to restart with both

Code:

service haveged restart

and

Code:

/etc/init.d/haveged restart

In both cases service won't come up.
Here some logs..

Code:

● haveged.service - Entropy daemon using the HAVEGE algorithm
   Loaded: loaded (/lib/systemd/system/haveged.service; enabled)
   Active: failed (Result: exit-code) since mer 2016-10-05 09:33:29 CEST; 1s ago
     Docs: man:haveged(8)
           http://www.issihosts.com/haveged/
  Process: 8525 ExecStart=/usr/sbin/haveged --Foreground --verbose=1 --write=1024 (code=exited, status=1/FAILURE)
Main PID: 8525 (code=exited, status=1/FAILURE)

ott 05 09:33:28 dns1 systemd[1]: Started Entropy daemon using the HAVEGE algorithm.
ott 05 09:33:29 dns1 haveged[8525]: haveged: ver: 1.9.1; arch: x86; vend: GenuineIntel; build: (gcc 4.8.2 ITV); collect: 128K
ott 05 09:33:29 dns1 haveged[8525]: haveged: cpu: (L4 VC); data: 32K (L4 V); inst: 32K (L4 V); idx: 21/40; sz: 32709/60538
ott 05 09:33:29 dns1 haveged[8525]: haveged: tot tests(BA8): A:1/1 B:1/1 continuous tests(B):  last entropy estimate 7.99795
ott 05 09:33:29 dns1 haveged[8525]: haveged: fills: 0, generated: 0
ott 05 09:33:29 dns1 systemd[1]: haveged.service: main process exited, code=exited, status=1/FAILURE
ott 05 09:33:29 dns1 systemd[1]: Unit haveged.service entered failed state.
ott 05 09:33:29 dns1 haveged[8525]: haveged: Fail:set_watermark()!
ott 05 09:33:29 dns1 haveged[8525]: haveged starting up

 

I have the same problem and not sure what to do.
I am on debian Wheezy
Thanks

 

@ganewbie try simply to run binary

Code:

havenged

temporary fix but i think will work.

 

Also me i've found this article, the strange thing is that launching directly the binary haveged all works right, dunno why...

 

Thanks all

 

I have ISPConfig in a LXC container running Debian 9 and i have the same problem with haveged.
I have added in bind_plugin.inc.php a call to /usr/sbin/haveged before dnssec-keygen and dnssec-signzone execution

Code:

    exec('cd '.escapeshellcmd($dns_config['bind_zonefiles_dir']).';'.
        '/usr/sbin/haveged;'.
        'dnssec-keygen -a NSEC3RSASHA1 -b 2048 -n ZONE '.escapeshellcmd($domain).';'.
        'dnssec-keygen -f KSK -a NSEC3RSASHA1 -b 4096 -n ZONE '.escapeshellcmd($domain));

Code:

    exec('cd '.escapeshellcmd($dns_config['bind_zonefiles_dir']).';'.
             '/usr/sbin/haveged;'.
             'dnssec-signzone -A -e +1382400 -3 $(head -c 1000 /dev/random | sha1sum | cut -b 1-16) -N increment -o '.escapeshellcmd($domain).' -t '.$filespre.escapeshellcmd($domain));
    

I think this haveged call will be needed when ISPConfig run in a virtualization environment because haveged service is not working in these cases.
This work fine for me.

 

It is indeed a better solution and seems to work well.
Thanks.