Some clarifications about $RANDFILE usage.

[openssl.git] / FAQ

diff --git a/FAQ b/FAQ
index 4702d6ac9b00950e7eb8a4ed96b633efc926dfe7..259ea4bc41bdc666a1a830904ce061293df7a74c 100644 (file)
--- a/FAQ
+++ b/FAQ
@@ -55,7 +55,7 @@ OpenSSL  -  Frequently Asked Questions
 * Which is the current version of OpenSSL?
 
 The current version is available from <URL: http://www.openssl.org>.
 * Which is the current version of OpenSSL?
 
 The current version is available from <URL: http://www.openssl.org>.

-OpenSSL 0.9.6 was released on September 24th, 2000.
+OpenSSL 0.9.6a was released on April 5th, 2001.

 
 In addition to the current stable release, you can also access daily
 snapshots of the OpenSSL development version at <URL:
 
 In addition to the current stable release, you can also access daily
 snapshots of the OpenSSL development version at <URL:


@@ -176,6 +176,12 @@ Most components of the openssl command line tool try to use the
 file $HOME/.rnd (or $RANDFILE, if this environment variable is set)
 for seeding the PRNG.  If this file does not exist or is too short,
 the "PRNG not seeded" error message may occur.
 file $HOME/.rnd (or $RANDFILE, if this environment variable is set)
 for seeding the PRNG.  If this file does not exist or is too short,
 the "PRNG not seeded" error message may occur.

+Pointing $RANDFILE to an Entropy Gathering Daemon socket does not work.
+Use the "-rand" option of the OpenSSL command line tools instead.
+The $RANDFILE environment variable and $HOME/.rnd are only used by the
+OpenSSL command line tools. Applications using the OpenSSL library
+provide their own configuration options to specify the entropy source,
+please check out the documentation coming the with application.

 
 [Note to OpenSSL 0.9.5 users: The command "openssl rsa" in version
 0.9.5 does not do this and will fail on systems without /dev/urandom
 
 [Note to OpenSSL 0.9.5 users: The command "openssl rsa" in version
 0.9.5 does not do this and will fail on systems without /dev/urandom


@@ -490,44 +496,16 @@ OpenSSL_add_all_algorithms(). See the manual page for more information.
 
 * Why can't the OpenSSH configure script detect OpenSSL?
 
 
 * Why can't the OpenSSH configure script detect OpenSSL?
 

-There is a problem with OpenSSH 1.2.2p1, in that the configure script
-can't find the installed OpenSSL libraries.  The problem is actually
-a small glitch that is easily solved with the following patch to be
-applied to the OpenSSH distribution:
-
------ snip:start -----
---- openssh-1.2.2p1/configure.in.orig  Thu Mar 23 18:56:58 2000
-+++ openssh-1.2.2p1/configure.in       Thu Mar 23 18:55:05 2000
-@@ -152,10 +152,10 @@
- AC_MSG_CHECKING([for OpenSSL/SSLeay directory])
- for ssldir in "" $tryssldir /usr /usr/local/openssl /usr/lib/openssl /usr/local/ssl /usr/lib/ssl /usr/local /usr/pkg /opt /opt/openssl ; do
-       if test ! -z "$ssldir" ; then
--              LIBS="$saved_LIBS -L$ssldir"
-+              LIBS="$saved_LIBS -L$ssldir/lib"
-               CFLAGS="$CFLAGS -I$ssldir/include"
-               if test "x$need_dash_r" = "x1" ; then
--                      LIBS="$LIBS -R$ssldir"
-+                      LIBS="$LIBS -R$ssldir/lib"
-               fi
-       fi
-       LIBS="$LIBS -lcrypto"
---- openssh-1.2.2p1/configure.orig     Thu Mar 23 18:55:02 2000
-+++ openssh-1.2.2p1/configure  Thu Mar 23 18:57:08 2000
-@@ -1890,10 +1890,10 @@
- echo "configure:1891: checking for OpenSSL/SSLeay directory" >&5
- for ssldir in "" $tryssldir /usr /usr/local/openssl /usr/lib/openssl /usr/local/ssl /usr/lib/ssl /usr/local /usr/pkg /opt /opt/openssl ; do
-       if test ! -z "$ssldir" ; then
--              LIBS="$saved_LIBS -L$ssldir"
-+              LIBS="$saved_LIBS -L$ssldir/lib"
-               CFLAGS="$CFLAGS -I$ssldir/include"
-               if test "x$need_dash_r" = "x1" ; then
--                      LIBS="$LIBS -R$ssldir"
-+                      LIBS="$LIBS -R$ssldir/lib"
-               fi
-       fi
-       LIBS="$LIBS -lcrypto"
------ snip:end -----
+Several reasons for problems with the automatic detection exist.
+OpenSSH requires at least version 0.9.5a of the OpenSSL libraries.
+Sometimes the distribution has installed an older version in the system
+locations that is detected instead of a new one installed. The OpenSSL
+library might have been compiled for another CPU or another mode (32/64 bits).
+Permissions might be wrong.

 
 

+The general answer is to check the config.log file generated when running
+the OpenSSH configure script. It should contain the detailed information
+on why the OpenSSL library was not detected or considered incompatible.

 
 * Can I use OpenSSL's SSL library with non-blocking I/O?
 
 
 * Can I use OpenSSL's SSL library with non-blocking I/O?