Yii2: yii\base\Security.php -> generateRandomKey() in 2.0.7-dev throws "Unable to generate a random key"

[nadar]

As i could see there is a new Implementation of generateRandomKey(). We end up in base Exception:

Message: Unable to generate a random key
File: vendor/yiisoft/yii2/base/Security.php
Line: 542

Environment:

• PHP Version 5.5.9-1ubuntu4.9
• CGI/FastCGI

OpenSSL is enabled:

OpenSSL support enabled
OpenSSL Library Version OpenSSL 1.0.1f 6 Jan 2014
OpenSSL Header Version  OpenSSL 1.0.1f 6 Jan 2014

[samdark]

@tom-- any idea?

[tom--]

One: Relative to <= 2.0.6, OpenSSL was removed for non-Windows platforms owing to https://bugs.php.net/bug.php?id=70014 and the general OpenSSL concerns.

Two: I don't understand why this system cannot read /dev/urandom. @nadar would you put phpinfo() into a gist please? That might have clues.

[nadar]

@tom-- i just wrote you in gitter.

[tom--]

@nadar in what now?

[nadar]

i just wrote you a private message on Gitter (https://gitter.im/tom--), as there is sensitive data.

[tom--]

@nadar please try this test script and paste the results here.

[nadar]

 1  function_exists('random_bytes')
    false

 2  defined('OPENSSL_VERSION_TEXT') ? OPENSSL_VERSION_TEXT : null
    'OpenSSL 1.0.1f 6 Jan 2014'

 3  PHP_VERSION_ID
    50509

 4  function_exists('mcrypt_create_iv')
    false

 5  DIRECTORY_SEPARATOR
    '/'

 6  sprintf('%o', lstat('/dev/urandom')['mode'])
    '0'

 7  sprintf('%o', lstat('/dev/urandom')['mode'] & 0170000)
    '0'

 8  bin2hex(@file_get_contents('/dev/urandom', false, null, 0, 16))
    ''

[tom--]

@nadar thanks. i added another test to the script. please update your output

[nadar]

 1  function_exists('random_bytes')
    false

 2  defined('OPENSSL_VERSION_TEXT') ? OPENSSL_VERSION_TEXT : null
    'OpenSSL 1.0.1f 6 Jan 2014'

 3  PHP_VERSION_ID
    50509

 4  function_exists('mcrypt_create_iv')
    false

 5  DIRECTORY_SEPARATOR
    '/'

 6  sprintf('%o', lstat('/dev/urandom')['mode'])
    '0'

 7  sprintf('%o', lstat('/dev/urandom')['mode'] & 0170000)
    '0'

 8  bin2hex(@file_get_contents('/dev/urandom', false, null, 0, 16))
    ''

 9  ini_get('open_basedir')
    '/var/www/vhosts/MY_EXAMPLE_HOST_DOT_COM/:/tmp/'

_MY_EXAMPLE_HOST_DOT_COM_ represents the current domain

[tom--]

Looks like shared hosting in which the provider has denied access to /dev/urandom and doesn't have mcrypt. This leaves you in a tough position because problems with OpenSSL's RNG arose last year: It was discovered that PHP was using it in an unsafe way that didn't get fixed until 5.6.10 and OpenSSL's RNG fell out of favor in general. This is why Yii stopped using openssl_random_pseudo_bytes() in 2.0.7 except on Windows.

I can think of two options for you:

• Get your hosting provider to install the PHP mcrypt extension. This reads internally from /dev/urandom but not in a way that the open_basedir setting inhibits. I just tested with PHP 5.4 and restrictive open_basedir and mcrypt_create_iv() appeared to work.

On this Ubuntu system it would be (for a sysop as simple as) apt-get install php5-mcrypt and restart FPM

• Get your hosting provider to append ":/dev/urandom" to the open_basedir INI setting and restart FPM

I don't know how to configure an Ubuntu LTS to use LibreSSL instead of OpenSSL. This would be a nice option.

I don't think it would be fair to the community of Yii users to reintroduce unconditional OpenSSL. Part of the idea with this update was tighten Yii's use of available RNGs.

[tom--]

Actually, a couple more options:

• extend Security::generateRandomKey() something like this and configure Yii to use your component instead of the base component. NOTE: I have not tested this
• stay on 2.0.6

[nadar]

Thanks for you reply and your effort regarding this problem! It would be nice to know how many Yii users would have the same issue on their hosting providers, but for me its not a problem to avoid this problem as i can partially manage those servers by our selfs since i know what has to be changed. So i guess, the issue can be closed and other users will find this topic trough googling.

[tom--]

I'm keeping the diagnostic script here for anyone else experiencing issues.

[linslin]

For everybody who did not install php-mcrypt right now (thats why the exception was thrown in my case), http://php.net/manual/de/mcrypt.installation.php:

Linux

apt-get install php5-mcrypt
mv -i /etc/php5/conf.d/mcrypt.ini /etc/php5/mods-available/
php5enmod mcrypt
service apache2 restart

[tom--]

Hi @linslin Would you please run the platform diagnostic script? I am curious why your PHP cannot read /dev/urandom.

[mcki0127]

Here are my results prior to installing mcrypt.

 1  function_exists('random_bytes')
    false

 2  defined('OPENSSL_VERSION_TEXT') ? OPENSSL_VERSION_TEXT : null
    'OpenSSL 1.0.1f 6 Jan 2014'

 3  PHP_VERSION_ID
    50509

 4  function_exists('mcrypt_create_iv') ? bin2hex(mcrypt_create_iv(8, MCRYPT_DEV_URANDOM)) : null
    NULL

 5  DIRECTORY_SEPARATOR
    '/'

 6  sprintf('%o', lstat('/dev/urandom')['mode'])
    '20666'

 7  sprintf('%o', lstat('/dev/urandom')['mode'] & 0170000)
    '20000'

 8  bin2hex(file_get_contents('/dev/urandom', false, null, 0, 8))
    'bddd76d88fdc02ae'

 9  ini_get('open_basedir')
    ''

[tom--]

@mcki0127 Couple of bits of info that could be in the diag script but unfortunately are not:

• os?
• yii version? this issue's title mentions 2.0.7

[riyaskp]

Here are my result before installing mycrypt

1 function_exists('random_bytes')
 false 
2 defined('OPENSSL_VERSION_TEXT') ? OPENSSL_VERSION_TEXT : null 
'OpenSSL 1.0.1f 6 Jan 2014'
3 PHP_VERSION_ID 
50509 
4 function_exists('mcrypt_create_iv') ? bin2hex(mcrypt_create_iv(8, MCRYPT_DEV_URANDOM)) : null NULL 
5 DIRECTORY_SEPARATOR 
'/' 
6 sprintf('%o', lstat('/dev/urandom')['mode']) 
'0' 
7 sprintf('%o', lstat('/dev/urandom')['mode'] & 0170000) 
'0' 
8 bin2hex(file_get_contents('/dev/urandom', false, null, 0, 8)) 
'' 
9 ini_get('open_basedir') 
'/var/www/clients/client1/web4/web:/var/www/clients/client1/web4/private:/var/www/clients/client1/web4/tmp:/var/www/MY_EXAMPLE_HOST_DOT_COM/web:/srv/www/MY_EXAMPLE_HOST_DOT_COM/web:/usr/share/php5:/usr/share/php:/tmp:/usr/share/phpmyadmin:/etc/phpmyadmin:/var/lib/phpmyadmin'

OS: Ubuntu 14.04.4 LTS (GNU/Linux 3.13.0-74-generic x86_64)
Yii version 2.0.7.

When I tried apt-get install php5-mcrypt

Here is the response I am getting

Reading package lists... Done
Building dependency tree       
Reading state information... Done
php5-mcrypt is already the newest version.
0 upgraded, 0 newly installed, 0 to remove and 5 not upgraded.

[tom--]

@riyaskp your open_basedir prevents reading anything in /dev

php7 is also a good option. (it's also very fast)

[mcki0127]

@tom--
OS: Ubuntu 14.04.4 LTS
Yii version: 2.08

php5enmod mcrypt fixed the problem for me.

[tom--]

@mcki0127 thanks.

i do not understand why generateRandomKey() could not read /dev/urandom on your system.

[cebe]

i do not understand why generateRandomKey() could not read /dev/urandom on your system.

open_basedir.

[professor93]

OS: Ubuntu 14.04.4 LTS
Yii version: 2.08

php5enmod mcrypt fixed the problem for me too.

[tom--]

@cebe open_basedir was empty in the output from mcki0127. you were probably looking at riyaskp's.

[cebe]

Oh yeah right. For mcki0127 it could be a difference in web and console PHP?