[Fedora-directory-commits] mod_nss/docs mod_nss.html,1.9,1.10

[Robert Crittenden (rcritten)]

Author: rcritten

Update of /cvs/dirsec/mod_nss/docs
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv11437/docs

Modified Files:
	mod_nss.html 
Log Message:
Add support for seeding the NSS Random Number Generator. This adds
a new directive, NSSRandomSeed based on the mod_ssl SSLRandomSeed
directive.



Index: mod_nss.html
===================================================================
RCS file: /cvs/dirsec/mod_nss/docs/mod_nss.html,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -r1.9 -r1.10
--- mod_nss.html	29 Sep 2005 19:35:44 -0000	1.9
+++ mod_nss.html	3 Oct 2005 14:59:26 -0000	1.10
@@ -249,7 +249,6 @@
 <h1><a name="Directives"></a>Configuration Directives</h1>
 The following mod_ssl Directives are not applicable to mod_nss:<br>
 <ul>
-  <li>SSLRandomSeed</li>
   <li>SSLSessionCache</li>
   <li>SSLMutex</li>
   <li>SSLCertificateChainFile</li>
@@ -371,6 +370,35 @@
 <br>
 <code>NSSSession3CacheTimeout 86400</code><br>
 <br>
+<big><big>NSSRandomSeed</big></big><br>
+<br>
+Configures sources to seed the NSS Random Number Generator (RNG) at
+startup.&nbsp; Currently this only supports seeding the RNG at startup.
+<br>
+<br>
+The following sources are available:<br>
+<ul>
+  <li><code>builtin:</code> Combines the current system time, the
+current process id
+and a randomly choosen 128-byte extract of the process stack. This is
+not a particularly strong source of entropy.</li>
+  <li><code>file:/path/to/source:</code> Reads from the specified file.
+If the number of bytes to read is specified it just reads that amount.
+Be aware that some operating systems block on /dev/random if not enough
+entropy is available. This means that the server will wait until that
+data is available to continue startup. These systems generally offer a
+non-blocking device as well, /dev/urandom.</li>
+  <li><code>exec:/path/to/program: Executes the given program and takes
+the stdout of it as the entryop. If the bytes argument is included it
+reads that many bytes, otherwise it reads until the program exits.</code><br>
+  </li>
+</ul>
+<span style="font-weight: bold;">Example</span><br>
+<br>
+<code>NSSRandomSeed startup builtin<br>
+NSSRandomSeed startup /dev/urandom 512<br>
+NSSRandomSeed startup /usr/bin/makerandom</code><br>
+<br>
 <big><big>NSSEngine</big></big><br>
 <br>
 Enables or disables the SSL protocol. This is usually used within a