From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
        Alvaro Herrera <alvherre@2ndquadrant.com>,
        David Steele <david@pgmasters.net>, Joe Conway <mail@joeconway.com>,
        Magnus Hagander <magnus@hagander.net>,
        Michael Paquier <michael@paquier.xyz>,
        Nico Williams <nico@cryptonector.com>,
        PostgreSQL-development <pgsql-hackers@postgresql.org>,
        Robbie Harwood <rharwood@redhat.com>
Subject: Re: [PATCH v20] GSSAPI encryption support
In-reply-to: <8476.1554391968@sss.pgh.pa.us>
References: <500b1be7-d0aa-96a2-9982-d748609faff5@joeconway.com>
 <CABUevEyuNNJv=19foa=ycTfTfBUYOEwM8_Uss5OVKrwBAy+Btw@mail.gmail.com>
 <20190403144332.GD6197@tamriel.snowman.net>
 <7b7035e0-3691-ca63-0957-25d17dc11514@2ndquadrant.com>
 <CAOuzzgrztzi+g5vfd-dtNxx+MByZcy9nMVzavYZTgvZGHx98Hg@mail.gmail.com>
 <5406.1554388830@sss.pgh.pa.us> <20190404144818.GI6197@tamriel.snowman.net>
 <5945.1554389568@sss.pgh.pa.us> <20190404150054.GJ6197@tamriel.snowman.net>
 <7566.1554391003@sss.pgh.pa.us> <20190404152439.GK6197@tamriel.snowman.net>
 <8476.1554391968@sss.pgh.pa.us>
Comments: In-reply-to Tom Lane <tgl@sss.pgh.pa.us>
	message dated "Thu, 04 Apr 2019 11:32:48 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <15826.1554394584.1@sss.pgh.pa.us>
Date: Thu, 04 Apr 2019 12:16:24 -0400
Message-ID: <15827.1554394584@sss.pgh.pa.us>
Precedence: bulk

I wrote:
> Stephen Frost <sfrost@snowman.net> writes:
>> So I'm a bit surprised that it's taking 4 minutes for you.  I wonder if
>> there might be an issue related to the KDC wanting to get some amount of
>> random data and the system you're on isn't producing random bytes very
>> fast..?

> Not sure.  This is my usual development box and it also does mail, DNS,
> etc for my household, so I'd expect it to have plenty of entropy.
> But it's running a pretty old kernel, and old Kerberos too, so maybe
> the explanation is in there somewhere.

Same test on a laptop running Fedora 28 takes a shade under 5 seconds.
The laptop has a somewhat better geekbench rating than my workstation,
but certainly not 50x better.  And I really doubt it's got more entropy
sources than the workstation.  Gotta be something about the kernel.

Watching the test logs, I see that essentially all the time on the RHEL6
machine is consumed by the two

# Running: /usr/sbin/kdb5_util create -s -P secret0

steps.  Is there a case for merging the two scripts so we only have to
do that once?  Maybe not, if nobody else sees this.

			regards, tom lane