EKEYD.CONF - reference manual online
Entropy key configuration.
EKEYD.CONF(5) File Formats Manual EKEYD.CONF(5)
NAME ekeyd.conf - entropy key configuration SYNOPSIS /etc/entropykey/resolv.conf DESCRIPTION The ekeyd daemon allows Entropy Keys to transfer their random data to the kernels random pool. The daemon configuration file is a series of statements each controlling an aspect of the daemons operation. If this file does not exist the daemon will not start. The different configuration options are: TCPControlSocket TCP port number to listen on. The daemon can be controlled using a TCP network connection. Any number of control connections may be made by repeating this statement with differnt port numbers, there is no authentication or protection against clients which connet to this interface. The socket is always bound to localhost (127.0.0.1). UnixControlSocket UNIX domain socket to use. The daemon is typically controlled using a unix domain socket (/var/run/ekeyd.sock). Authentication is as for any file on a UNIX filesystem. Keyring The keyring file to use. The Entropy Key encrypts the data it sends to the host. To successfully decrypt this data the host requires the current encryption key. The keyring is a file con‐ taining a list of serial numbers and encryption keys. The keyring is generally updated using the ekey-lt-rekey(8) tool. SetOutputToKernel bits per byte to add to kernel pool. The Kernel maintains an entropy pool into which the ekeyd(8) injects the entropy gathered from the Entropy Keys. The data gathered from the Entropy Keys may be con‐ sidered to have one shannon per bit so every bit gathered from the devices may be injected into the kernel pool. However, by default, to be conservative only seven of eight bits are entered into the kernel pool. EGDUnixSocket UNIX domain socket to use In this mode, which is mutually exclusive with the SetOutputToKernel output mode, ekeyd(8) gathers the entropy from the attached Entropy Keys and presents an EGD(8) compatible interface on the named UNIX domain socket to access the data. This may optionally take an octal mode string and username and group to chmod and chown the socket to. If you do not wish to change the user or group, use empty strings. You cannot change the user/group without also providing a mode string. The default is to leave the user/group alone and set the socket to mode 0600 EGDTCPSocket TCP port number to listen on. In this mode, which is mutually exclusive with the SetOutputToKernel output mode, ekeyd(8) gathers the entropy from the attached Entropy Keys and presents an EGD(8) compatible interface on a socket on the specified port to access the data. The socket is bound to localhost (127.0.0.1) by default, but a second optional string parameter can be used to specify a different IP address, so that the EGD protocol is exported more widely (e.g. for egd-linux to read from another machine). AddEntropyKey Device node of entropy key. Add an Entropy key to be managed by the ekeyd(8) daemon. The encryption key for the added device should be available in the keyring. AddEntropyKeys Directory of device nodes of entropy keys. Adds one or more Entropy keys to be managed by the ekeyd(8) daemon. The encryption key for the added devices should be available in the keyring. This is generally set to /dev/entropykey which is the location the default UDEV rules create symbolic links. FILES /etc/entropykey/resolv.conf, /var/run/ekeyd.sock, /dev/entropykey SEE ALSO ekeyd(8), ekeydctl(8), ekey-lt-rekey(8)2009-07-21 EKEYD.CONF(5)
|This manual||Reference||Other manuals|
|refer to||ekeyd(8) | ekeydctl(8)|