randy/entropy-in-ganeti-vm.md

Entropy in a Ganeti VM

For generating a GPG key or the like, one needs a source of entropy to feed the software random number generator. But in a VM, there are no real disk, mouse, keyboard, ... sources to provide entropy.

hak came to the recue. The piece one needs is at https://wiki.qemu.org/Features/VirtIORNG, and then a Ganeti config hack.

vm0.rg.net:/home/randy> sudo gnt-instance modify -H kvm_extra="-device virtio-rng-pci\,bus=pci.0\,addr=0x1e\,max-bytes=1024\,period=1000" guest.rg.net
Modified instance guest.rg.net
 - hv/kvm_extra -> -device virtio-rng-pci,bus=pci.0,addr=0x1e,max-bytes=1024,period=1000
Please don't forget that most parameters take effect only at the next (re)start of the instance initiated by ganeti; restarting from within the instance will not be enough.
Note that changing hypervisor parameters without performing a restart might lead to a crash while performing a live migration. This will be addressed in future Ganeti versions.

Confirm that the device was created

vm0.rg.net:/home/randy> sudo gnt-instance info guest.rg.net | grep rng
    kvm_extra: -device virtio-rng-pci,bus=pci.0,addr=0x1e,max-bytes=1024,period=1000

Reboot the puppy

vm0.rg.net:/home/randy> sudo gnt-instance reboot guest.rg.net
Waiting for job 147664 for guest.rg.net ...

On the Ganeti host node, one should see /dev/random serving. Make sure you are on the node which hosts the VM.

vm1.rg.net:/home/randy> sudo lsof /dev/random
COMMAND     PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
qemu-syst 32938 root   20r   CHR    1,8      0t0 1032 /dev/random

Log into the guest instance and see if you have

guest.rg.net:/home/randy> cat /sys/devices/virtual/misc/hw_random/rng_available
virtio_rng.0 

---

As a Bonus, Using GPG to Encrypt a Remote Dump

#!/bin/sh

BSYS="raid.rg.net"
USYS="backup@$BSYS"
BDIR="/backup"
HOST=`hostname`
DATE=`date "+%Y-%m-%d"`
DDIR="$BDIR/$HOST.$DATE"
DEST="$USYS:$DDIR"
SSH="/usr/bin/ssh -i /home/backup/.ssh/id_rsa"
KEY_ID=C6E7437452CD33FD1C1247A7EE84C28C1F64EAAF
GPG="/usr/bin/gpg --no-options --batch --no-greeting --no-secmem-warning --keyring /home/backup/.gnupg/pubring.gpg --secret-keyring /home/backup/.gnupg/secring.gpg --trustdb-name /home/backup/.gnupg/trustdb.gpg --digest-algo sha256 --cipher-algo aes256 --s2k-cipher-algo aes256 --s2k-digest-algo sha512 --encrypt --recipient $KEY_ID"

# Filesystem      Size  Used Avail Use% Mounted on
# /dev/vda1        61G  2.5G   56G   5% /

$SSH $USYS mkdir $DDIR
for F in base; do
   $SSH $USYS touch $DDIR/$F
   done

sudo /sbin/dump -0uab 64 -f - / | $GPG | $SSH $USYS "/bin/cat > $DDIR/base"

---

2019.10.30