haveged

Table of Contents

1. Overview
2. Module Description - What does the module do?
3. Setup - The basics of getting started with haveged
   • What haveged affects
   • Setup requirements
   • Beginning with haveged
4. Usage - Configuration options and additional functionality
5. Reference - An under-the-hood peek at what the module is doing and how
6. Limitations - OS compatibility, etc.
7. Development - Guide for contributing to the module

Overview

Install and manage the HAVEGE daemon, haveged.

Module Description

The HAVEGE daemon provides a random number generator based on the HAVEGE (HArdware Volatile Entropy Gathering and Expansion) algorithm. This module provides a way of installing and setting up the daemon in your environment.

See REFERENCE.md for API documentation.

Setup

What haveged affects

Package, service and configuration files for haveged.

• On Debian based systems this includes the /etc/default/haveged file if an init based startup system is used. For systems using systemd the configuration is stored in the /etc/systemd/system/haveged.service.d/opts.conf file.

• The configuration is stored in the /etc/systemd/system/haveged.service.d/opts.conf file.

Setup Requirements

The haveged package is part of the EPEL yum repository, so this repository must be enabled on Enterprise Linux to be able to install the package.

Beginning with haveged

Declare the haveged class to run the haveged daemon with the default parameters.

include 'haveged'

This installs the haveged package and starts the service using default parameters.

See the following sections for a detailed description of the available configuration options.

Usage

Use a higher threshold of available entropy

---
haveged::write_wakeup_threshold: 2048

Reference

• Public Classes
  • Class: haveged
• Private Classes
  • Class: haveged::config
  • Class: haveged::package
  • Class: haveged::params
  • Class: haveged::service
• Facts
  • Fact: haveged_startup_provider

Public Classes

Class: haveged

Main class, includes all other classes.

Parameters for the haveged class:

buffer_size

Configure the collection buffer size. The value must be a string with a numeric value. It is interpreted as size in KB. Default: 128

data_cache_size

Set the data cache size. The value must be string with a numeric value. It is interpreted as size in KB. The default is 16

instruction_cache_size

Set the instruction cache size. The value must be string with a numeric value. It is interpreted as size in KB. The default is 16 or as determined by the CPUID.

write_wakeup_threshold

Configure the threshold of available entropy. The daemon tries to keep the amount of available entropy above this amount of bits. The value must be a string with a numeric value. Default: 1024

service_name

The name of the service to manage. Normally provided by the haveged::params class.

service_enable

Whether the haveged service should be enabled to start at boot. Valid options: true, false. Default: true

service_ensure

Whether the haveged service should be running. Valid options: stopped, false, running, true. Default: running

package_name

The name of the package to manage. Normally provided by the haveged::params class.

package_ensure

The state of the haveged package. Valid options: present, installed, absent, purged, held, latest or a specific package version number. Default: present

Private Classes

Class: haveged::config

Configures the haveged daemon by updating the run time parameters for the daemon.

Class: haveged::package

Installs the package.

Class: haveged::params

Manages operating system specific parameters.

Class: haveged::service

Manages the haveged daemon.

Facts

This module provides the following facts.

Fact: haveged_startup_provider

The startup system used on the node. The implementation uses the process name of PID 1 to resolve the fact. The value is either systemd or init.

Limitations

The haveged module has been tested on

• Debian 6 (Squeeze)
• Debian 7 (Wheezy)
• Debian 8 (Jessie)
• Ubuntu 12.04 (Precise Pangolin)
• Ubuntu 14.04 (Trusty Tahr)
• Ubuntu 15.10 (Wily Werewolf)
• Ubuntu 16.04 (Xenial Xerus)
• CentOS 6
• CentOS 7

Unfortunately the configuration is hardcoded on RHEL 6 systems. Using class parameters to set specific options will have no effect.

Development

Feel free to send pull requests for new features and other operating systems.

Reference

Table of Contents

Classes

• haveged: Manage HAVEGEd == Sample Usage: class { 'haveged': write_wakeup_threshold => 1024, }
• haveged::config: Manage the HAVEGEd configuration file
• haveged::package: Manage the haveged package
• haveged::service: Manage the HAVEGEd service

Classes

haveged

Manage HAVEGEd

== Sample Usage:

class { 'haveged': write_wakeup_threshold => 1024, }

Parameters

The following parameters are available in the haveged class:

• buffer_size
• data_cache_size
• instruction_cache_size
• write_wakeup_threshold
• service_name
• service_ensure
• service_enable
• package_name
• package_ensure

buffer_size

Data type: Optional[Variant[String,Integer]]

The size of the collection buffer in KB

Default value: undef

data_cache_size

Data type: Optional[Variant[String,Integer]]

The data cache size in KB

Default value: undef

instruction_cache_size

Data type: Optional[Variant[String,Integer]]

The instruction cache size in KB. Default is 16 or as determined by cpuid

Default value: undef

write_wakeup_threshold

Data type: Optional[Variant[String,Integer]]

The haveged daemon generates more data if the number of entropy bits falls below this value

Default value: 1024

service_name

Data type: String[1]

The name of the service to manage

Default value: 'haveged'

service_ensure

Data type: Variant[Boolean,String[1]]

Whether the service should be running

Default value: 'running'

service_enable

Data type: Boolean

Whether the service should be enabled to start at boot time

Default value: true

package_name

Data type: String[1]

The name of the package to manage

Default value: 'haveged'

package_ensure

Data type: Variant[Boolean,Simplib::PackageEnsure]

Ensure parameter passed onto Package resources. Default: 'present'

Default value: simplib::lookup('simp_options::package_ensure', { 'default_value' => 'installed' })

haveged::config

Manage the HAVEGEd configuration file

Parameters

The following parameters are available in the haveged::config class:

• buffer_size
• data_cache_size
• instruction_cache_size
• write_wakeup_threshold

buffer_size

Data type: Optional[Variant[Pattern['^[0-9]+$'],Integer]]

The size of the collection buffer in KB

Default value: defined('$haveged::buffer_size')

data_cache_size

Data type: Optional[Variant[Pattern['^[0-9]+$'],Integer]]

The data cache size in KB

Default value: defined('$haveged::data_cache_size')

instruction_cache_size

Data type: Optional[Variant[Pattern['^[0-9]+$'],Integer]]

The instruction cache size in KB

Default value: defined('$haveged::instruction_cache_size')

write_wakeup_threshold

Data type: Optional[Variant[Pattern['^[0-9]+$'],Integer]]

The haveged daemon generates more data if the number of entropy bits falls below this value

Default value: defined('$haveged::write_wakeup_threshold')

haveged::package

Manage the haveged package

Parameters

The following parameters are available in the haveged::package class:

• package_name
• package_ensure

package_name

Data type: String[1]

The name of the package to manage

Default value: defined('$haveged::package_name')

package_ensure

Data type: Simplib::PackageEnsure

Ensure parameter passed onto Package resources

Default value: defined('$haveged::_package_ensure')

haveged::service

Manage the HAVEGEd service

Parameters

The following parameters are available in the haveged::service class:

• service_name
• service_ensure
• service_enable
• force_if_rngd_running

service_name

Data type: String[1]

The name of the service to manage

Default value: defined('$haveged::service_name')

service_ensure

Data type: String[1]

Whether the service should be running

Default value: defined('$haveged::_service_ensure')

service_enable

Data type: Boolean

Whether the service should be enabled to start at boot time

Default value: defined('$haveged::_service_enable')

force_if_rngd_running

Data type: Boolean

Will force haveged to start even though RNGD is already running

• While this should not harm your system in most cases, it is also adding an unnecessary process running on the system

Default value: false

• Wed May 26 2021 Trevor Vaughan tvaughan@onyxpoint.com - 0.7.1

• Fixed

  • Mask the service when disabling for rngd compatibility so that it is not restarted on reboot

• Changed

  • Support puppetlabs/stdlib 7.X
  • Updated REFERENCE.md

• Wed Feb 03 2021 Trevor Vaughan tvaughan@onyxpoint.com - 0.7.0

• Ensure that haveged does not start by default if rngd is running
• Add haveged__rngd_enabled fact
• Remove all remaining EL6 code
• Migrate all capabilities to systemd
• Update parameter documentation and generate REFERENCE.md
• Add support for Puppet 7
• Fix spec tests

• Thu Dec 17 2020 Chris Tessmer chris.tessmer@onyxpoint.com - 0.7.0

• Removed EL6 support

• Mon Dec 16 2019 Trevor Vaughan tvaughan@onyxpoint.com - 0.6.0-0

• Add EL 8 support

• Fri Aug 02 2019 Liz Nemsick lnemsick.simp@gmail.com - 0.5.0-0

• Remove Puppet 4 support
• Add Puppet 6 support
• Add puppetlabs-stdlib 6 support
• Maintenance: removed OBE build/rpm_metadata/requires

• Thu Mar 07 2019 Liz Nemsick lnemsick.simp@gmail.com - 0.4.7-0

• Update the upper bound of stdlib to < 6.0.0

• Thu Nov 01 2018 Jeanne Greulich jeanne.greulich@onyxpoint.com - 0.4.6-0

• static asset updates for puppet 5

• Thu Mar 08 2018 Trevor Vaughan tvaughan@onyxpoint.com - 0.4.5-0

• Add support for OracleLinux 6 and 7
• Test against Puppet 5

• Thu Aug 17 2017 Trevor Vaughan tvaughan@onyxpoint.com - 0.4.4-0

• Update the README with the new badges and improve formatting

• Thu Jul 20 2017 Liz Nemsick lnemsick.simp@gmail.com - 0.4.3-0

• Fix bad 0.4.2 tag. In that tag, the metadata.json was incorrect.

• Thu Jul 20 2017 Liz Nemsick lnemsick.simp@gmail.com - 0.4.2-0

• Fix bad tag. simp-0.4.1 tag was made off of master branch.

• Thu Jul 06 2017 Liz Nemsick lnemsick.simp@gmail.com - 0.4.1-0

• Update puppet dependency in metadata.json
• Remove OBE pe dependency in metadata.json

• Wed Dec 21 2016 Nick Markowski nmarkowski@keywcorp.com - 0.4.0-0

• Updated global catalysts

• Mon Nov 21 2016 Chris Tessmer chris.tessmer@onyxpoint.com - 0.3.3-0

• Updated to compliance_markup version 2

• Thu Sep 29 2016 Chris Tessmer chris.tessmer@onyxpoint.com - 0.3.2-0

• Fixed malformed pe dependency in metadata.json
• Fixed syntax to enable publishing to the Forge

• Thu Jul 07 2016 Nick Markowski nmarkowski@keywcorp.com - 0.3.1-0

• Updated module for auto lua spec generation
• Added missing requires file and added dependency on simplib
• Modified module to auto-generate lua spec

• Wed Jun 01 2016 Trevor Vaughan tvaughan@onyxpoint.com

• Massive Refactor
• Refactored the module to use the latest best practices and eliminate issues with doing an 'include' of the individual sub-classes.
• Worked around a bug with the yum provider and the 'purged' parameter
• Fixed some class ordering
• Added acceptance tests for EL6 and EL7
• Updated the rspec tests to properly work around OEL issues with facts