From: Robbie Harwood <rharwood@redhat.com>
To: Tom Lane <tgl@sss.pgh.pa.us>, Stephen Frost <sfrost@snowman.net>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
 Alvaro Herrera <alvherre@2ndquadrant.com>,
 David Steele <david@pgmasters.net>, Joe Conway <mail@joeconway.com>,
 Magnus Hagander <magnus@hagander.net>, Michael Paquier <michael@paquier.xyz>,
 Nico Williams <nico@cryptonector.com>,
 PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH v20] GSSAPI encryption support
In-Reply-To: <15827.1554394584@sss.pgh.pa.us>
References: <500b1be7-d0aa-96a2-9982-d748609faff5@joeconway.com>
 <CABUevEyuNNJv=19foa=ycTfTfBUYOEwM8_Uss5OVKrwBAy+Btw@mail.gmail.com>
 <20190403144332.GD6197@tamriel.snowman.net>
 <7b7035e0-3691-ca63-0957-25d17dc11514@2ndquadrant.com>
 <CAOuzzgrztzi+g5vfd-dtNxx+MByZcy9nMVzavYZTgvZGHx98Hg@mail.gmail.com>
 <5406.1554388830@sss.pgh.pa.us> <20190404144818.GI6197@tamriel.snowman.net>
 <5945.1554389568@sss.pgh.pa.us> <20190404150054.GJ6197@tamriel.snowman.net>
 <7566.1554391003@sss.pgh.pa.us> <20190404152439.GK6197@tamriel.snowman.net>
 <8476.1554391968@sss.pgh.pa.us> <15827.1554394584@sss.pgh.pa.us>
Date: Thu, 04 Apr 2019 13:15:48 -0400
Message-ID: <jlgsguxr8sb.fsf@redhat.com>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
	micalg=pgp-sha512; protocol="application/pgp-signature"
Precedence: bulk

--=-=-=
Content-Type: text/plain

Tom Lane <tgl@sss.pgh.pa.us> writes:

> I wrote:
>> Stephen Frost <sfrost@snowman.net> writes:
>>> So I'm a bit surprised that it's taking 4 minutes for you.  I wonder if
>>> there might be an issue related to the KDC wanting to get some amount of
>>> random data and the system you're on isn't producing random bytes very
>>> fast..?
>
>> Not sure.  This is my usual development box and it also does mail, DNS,
>> etc for my household, so I'd expect it to have plenty of entropy.
>> But it's running a pretty old kernel, and old Kerberos too, so maybe
>> the explanation is in there somewhere.
>
> Same test on a laptop running Fedora 28 takes a shade under 5 seconds.
> The laptop has a somewhat better geekbench rating than my workstation,
> but certainly not 50x better.  And I really doubt it's got more entropy
> sources than the workstation.  Gotta be something about the kernel.
>
> Watching the test logs, I see that essentially all the time on the RHEL6
> machine is consumed by the two
>
> # Running: /usr/sbin/kdb5_util create -s -P secret0
>
> steps.  Is there a case for merging the two scripts so we only have to
> do that once?  Maybe not, if nobody else sees this.

I think that would be a good idea!  Unfortunately I don't speak perl
well enough to do that, so I'd just copied-and-modified.

Thanks,
--Robbie

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEA5qc6hnelQjDaHWqJTL5F2qVpEIFAlymO8UACgkQJTL5F2qV
pEJaNg//QTWkmIwe3yUPoy38HukQcY3nJBsSVadxCrVi/UMUJrFrRK4Uf9lGPk3R
uEftJrREOj5hUGOUv5CoVi5aUcjYuH8v6gJbpBYYFpXVhhs9SpF4qsSzyb8qS07h
+8hIwwt+9sde6inDccIMj4CCLPjQywMRQPy7c3LTNLFE6xfy/OL3j4KyikaNkwpx
nhJoSXokxYpms/JYjIBWX3rr4zrssQpCf7p+3x0DnHcCkaup8321e3oxSUd1f7s0
JSsDve6Mg64b8b7R7IDl6FX04ddIuzX1Q3jIgjA2WvRXFbSBtgPNnEa98+vvhUh0
D8f3KRnD+kzjNKG3vVJ5kQrh/5QWL1/HoG8xsmNXaVCSBPttJ/q3Nb8mmea5Els8
nOfhCS8BQRs2KwZtdTsVqFjpEIYRAyqZS2NRGjYSIohfYxpDydZVkCAaLDwR+Ao6
jxrNZ9P1Yz4BwVKcIfDC5LOc1ywzlbx3CxC8rZQU69SaGn4s+xnwUfG3Ds3rLWV0
pvuQ/o/pDcnYw57vu8rrfyKBjUxN4KdZR0FlJxqGeVrBLaq+GBlaJ8o9Pc1FExvP
Wg5tcPiDlcuKuQ/cqeCMimdVdte3MNBs4PGjDgeVUaE5R4NV+yeGDrRYj4gBgdBa
ebFtNBerS/SrwBUhuGt5Zw7+UK6YAJaFy84o3Mvwb2FMTNxHlCw=
=pZNi
-----END PGP SIGNATURE-----
--=-=-=--