The QEMU options later in this article are hypervisor administrator settings. You cannot apply them from inside an EDIS Global VPS. For a hosted VPS, start with the guest-side checks below and contact support if the evidence points to a missing virtual RNG device.
Check the cause before changing anything
A slow SSH connection is not necessarily an entropy problem. Separate a delay during boot or host-key generation from a delay during an ordinary login. On Debian/Ubuntu, inspect:How a host can provide an entropy device
Problem: OpenSSH delays system startup
Guest virtual machines (VMs) can experience delays when starting services likeOpenSSHd due to insufficient entropy. This is particularly noticeable during boot when services block while waiting for entropy from /dev/[u]random or getrandom() (in newer Linux releases). The lack of entropy results in delays, potentially extending boot time by up to a minute.
Solution overview
You can provide entropy to guest VMs directly from the host machine by using QEMU’s ability to pass an entropy source, such as/dev/urandom, to the guest. This method ensures a consistent supply of entropy without overloading the host system.
What is entropy?
In the context of computing, entropy refers to the randomness collected by an operating system to perform cryptographic or other operations that require random data. Sources of entropy include hardware events such as mouse movements, keyboard inputs, or system interrupts. Entropy is crucial for ensuring the security and unpredictability of cryptographic keys, secure communications, and random number generation. In virtualized environments, where physical input events are limited, the available entropy may be insufficient, leading to delays in operations that rely on it. By providing additional entropy sources, such as through VirtIO RNG or other methods, guest virtual machines can overcome these limitations and ensure smooth performance of services that depend on randomness.Implementation steps
1. Use VirtIO RNG (random number generator)
VirtIO provides an efficient way to supply entropy to a guest VM. Follow these steps to enable it: Edit the QEMU command line Add the following parameters to the QEMU command line for your VM:/dev/urandom) from the host.
virtio-rng-pci: Passes the entropy source to the guest using the VirtIO interface.
max-bytes and period: Apply rate-limiting to prevent excessive CPU consumption by the entropy provider.
See QEMU invocation documentation for RNG backends and virtual devices.
Ensure compatibility
Guest systems with Linux kernels as old as version 2.6.32 can automatically use the VirtIO entropy source after a reboot. For older kernels or other OS types, ensure the VirtIO RNG driver is supported and enabled.
2. Install a PRNG on the guest (optional)
For an older installation with a confirmed entropy-related problem, evaluatehaveged according to your distribution’s documentation. Do not install an extra entropy daemon solely because SSH feels slow. If you determine it is appropriate for your system:
Benefits of using VirtIO RNG
- Provides consistent and fast entropy from the host.
- Avoids significant delays for guest services dependent on random number generation.
- Rate limiting ensures host CPU resources are not overused.
Considerations
- Ensure the host has sufficient entropy available to meet the demands of all connected VMs.
-
For high-security use cases, evaluate whether entropy sourced from
/dev/urandommeets your requirements.
Conclusion
By configuring the VirtIO RNG or using a PRNG likehaveged, you can significantly reduce startup delays for services on your guest VM and improve overall system performance.