Re: Hundreds of crypto file descriptors for Apache httpd

[mlelstv%serpens.de@localhost (Michael van Elst)]

frank%phoenix.owl.de@localhost (Frank Wille) writes:

>> Something is using /dev/crypto. openssl would do that, but only if
>> you configure it.

>Yes, our web-server is also listening on port 443 for several virtual hosts,
>so SSL is configured.

It's not just SSL. openssl has its own crypto routines and you would only
use /dev/crypto when you want to use some accelerator hardware that can only
be accessed by a kernel driver.

The problem here seems to be that the devcrypto engine is builtin and openssl
just loads every builtin engine with no knob to control that behaviour.

I think the only option you have now is to prevent access to /dev/crypto.

-- 
-- 
                                Michael van Elst
Internet: mlelstv%serpens.de@localhost
                                "A potential Snark may lurk in every tree."