EKEYD.CONF(5)

🎀 NAME 🎀

ekeyd.conf — entropy key configuration 💖

(yes bestie, you've landed on EKEYD.CONF(5), the File Formats Manual page, and it's about to be a whole vibe 🦋)

✨ SYNOPSIS ✨

/etc/entropykey/resolv.conf

💅 DESCRIPTION 💅

okay so. The ekeyd daemon is the little legend that lets Entropy Keys transfer their random data over to the kernel's random pool 🌈. And the daemon config file? It's just a series of statements, each one controlling an aspect of the daemon's operation. That's it. That's the whole format. Iconic.

🚨 real talk, no cap: if this file does not exist, the daemon will not start. Not "start grumpily", not "start with defaults" — it simply does not start. So like. Keep the file. 💀

The different configuration options are:

• TCPControlSocket TCP port number to listen on. — this is how the daemon gets controlled over a TCP network connection 👑. The way that you can have any number of control connections? You just repeat this statement with differnt port numbers, one per connection. ⚠️ But heads up fr fr: there is no authentication or protection against clients which connet to this interface. None. Zero. The socket is always bound to localhost (127.0.0.1), which is the one tiny crumb of comfort here.
• UnixControlSocket UNIX domain socket to use. — the daemon is typically controlled using a unix domain socket (/var/run/ekeyd.sock) 🍓. Authentication is as for any file on a UNIX filesystem — so, y'know, filesystem perms, your usual situation.
• Keyring The keyring file to use. — the Entropy Key encrypts the data it sends to the host 🔐, and to successfully decrypt that data the host needs the current encryption key. The keyring is a file containing a list of serial numbers and encryption keys. It's generally updated using the ekey-lt-rekey(8) tool. Slay.
• SetOutputToKernel bits per byte to add to kernel pool. — the Kernel maintains an entropy pool, and ekeyd(8) injects the entropy gathered from the Entropy Keys into it 🌸. The data gathered from the Entropy Keys may be considered to have one shannon per bit, so technically every bit gathered from the devices may be injected into the kernel pool. However — and this is the part where they're being cute and careful — by default, to be conservative, only seven of eight bits are entered into the kernel pool.
• EGDUnixSocket UNIX domain socket to use — in this mode, which is mutually exclusive with the SetOutputToKernel output mode, ekeyd(8) gathers the entropy from the attached Entropy Keys and presents an EGD(8) compatible interface on the named UNIX domain socket to access the data 🧚. This may optionally take an octal mode string and username and group to chmod and chown the socket to. If you do not wish to change the user or group, use empty strings. You cannot change the user/group without also providing a mode string (the order matters, bestie). The default is to leave the user/group alone and set the socket to mode 0600 💜.
• EGDTCPSocket TCP port number to listen on. — in this mode, which is mutually exclusive with the SetOutputToKernel output mode, ekeyd(8) gathers the entropy from the attached Entropy Keys and presents an EGD(8) compatible interface on a socket on the specified port to access the data 🌟. The socket is bound to localhost (127.0.0.1) by default, but a second optional string parameter can be used to specify a different IP address, so that the EGD protocol is exported more widely (e.g. for egd-linux to read from another machine). Networking! 🌐
• AddEntropyKey Device node of entropy key. — add an Entropy key to be managed by the ekeyd(8) daemon 🔑. The encryption key for the added device should be available in the keyring.
• AddEntropyKeys Directory of device nodes of entropy keys. — adds one or more Entropy keys to be managed by the ekeyd(8) daemon 🔑🔑🔑. The encryption key for the added devices should be available in the keyring. This is generally set to /dev/entropykey, which is the location the default UDEV rules create symbolic links. Very "let the system do it for you" of them, and honestly? Respect.

📁 FILES 📁

• /etc/entropykey/resolv.conf
• /var/run/ekeyd.sock
• /dev/entropykey

👀 SEE ALSO 👀

• ekeyd(8)
• ekeydctl(8)
• ekey-lt-rekey(8)

👑 AUTHOR 👑

Copyright © 2009 Simtec Electronics. All rights reserved.

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

and that's the whole page, bestie 🫶 you just read EKEYD.CONF(5), the File Formats Manual classic, dated 2009-07-21 — go configure something and hydrate 💖✨