Dhis2 random source and JAVA_OPTS

Stephan_Mestach · 20 January 2023 11:02

I’ve seen this article https://www.baeldung.com/java-security-egd
I’m still hosting older version (java 8 based) and sometimes get stuck.

Since I can’t find the manual of this older version, was there recommendation in these installation to switch the random source to a non blocking one like bellow ?

-Djava.security.egd=file:/dev/./urandom

also found on these recommendation garbage collection

are they still relevant ?

Stephan_Mestach · 20 January 2023 11:16

Trying to answer from the github repo content

Only found this

github.com

dhis2/dhis2-server-tools/blob/14f2179d2c04d53ec6dbdf12dc8ea8ed6284c532/deploy/roles/dhis2/templates/tomcat_default.j2#L7-L23


      
          # Mitigating log4j vulnerability
          JAVA_OPTS="${JAVA_OPTS} -Dlog4j2.formatMsgNoLookups=true"
          
          
# Important to give the jvm a reliable, non-blocking, source of
          # randomness.  See eg https://stackoverflow.com/questions/58991966/what-java-security-egd-option-is-for
          JAVA_OPTS="${JAVA_OPTS} -Djava.security.egd=file:/dev/./urandom"
          
          

          
# Pick a garbage collector
          # G1GC should be best, though sometimes heavy on CPU when a lot of GC is
          # happening.  Under those circumstances, you might want to try ParallelGC
          JAVA_OPTS="${JAVA_OPTS} -XX:+UseG1GC"
          #JAVA_OPTS="${JAVA_OPTS} -XX:+UseParallelGC"
          
          
# In case of excessive GC requirements you might want to allow GC more time
          # to do its work
          JAVA_OPTS="${JAVA_OPTS} -XX:MaxGCPauseMillis=1500 -XX:GCTimeRatio=9"

bobj · 23 January 2023 09:17

Hi Stephen.

Like you, I was seeing occasional problems of slow startup of the jvm, which is why I added that alternative source of randomness some years ago. It cured the problem. To be honest I have not followed up how relevant it still is today, but it doesnt seem tio do any harm :-). What has been your experience?

Sorry I had mised that earlier post regarding the memory problems. It sound like his postgres was probably over allocating memory.

To be honest I have not reviewed JAVA_OPTs as used in dhis2 server tools for some time, but rather left well alone. We will review this week.

Cheers
Bob

alanivey · 13 February 2023 14:26

@Stephan_Mestach I can’t speak to officially recommended practice, but we sometimes make use of setting java.security.egd to file:/dev/./urandom; it can even be required in some operation system/[virtual] hardware configurations for obtaining an entropy value. Debates about the “true randonmess” of /dev/urandom aside, it is an acceptable workaround.