Re: [PATCH v20] GSSAPI encryption support - Mailing list pgsql-hackers

From Tom Lane
Subject Re: [PATCH v20] GSSAPI encryption support
Date
Msg-id 15827.1554394584@sss.pgh.pa.us
Whole thread Raw
In response to Re: [PATCH v20] GSSAPI encryption support  (Tom Lane <tgl@sss.pgh.pa.us>)
Responses Re: [PATCH v20] GSSAPI encryption support
Re: [PATCH v20] GSSAPI encryption support
List pgsql-hackers
I wrote:
> Stephen Frost <sfrost@snowman.net> writes:
>> So I'm a bit surprised that it's taking 4 minutes for you.  I wonder if
>> there might be an issue related to the KDC wanting to get some amount of
>> random data and the system you're on isn't producing random bytes very
>> fast..?

> Not sure.  This is my usual development box and it also does mail, DNS,
> etc for my household, so I'd expect it to have plenty of entropy.
> But it's running a pretty old kernel, and old Kerberos too, so maybe
> the explanation is in there somewhere.

Same test on a laptop running Fedora 28 takes a shade under 5 seconds.
The laptop has a somewhat better geekbench rating than my workstation,
but certainly not 50x better.  And I really doubt it's got more entropy
sources than the workstation.  Gotta be something about the kernel.

Watching the test logs, I see that essentially all the time on the RHEL6
machine is consumed by the two

# Running: /usr/sbin/kdb5_util create -s -P secret0

steps.  Is there a case for merging the two scripts so we only have to
do that once?  Maybe not, if nobody else sees this.

            regards, tom lane



pgsql-hackers by date:

Previous
From: Antonin Houska
Date:
Subject: Re: "WIP: Data at rest encryption" patch and, PostgreSQL 11-beta3
Next
From: Stephen Frost
Date:
Subject: Re: [PATCH v20] GSSAPI encryption support