{"record":{"id":"073603b8233558ae","repo":"crowdsecurity/crowdsec","slug":"error-generating-password","errorCode":null,"errorMessage":"error generating password","messagePattern":"error generating password","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"pkg/apiserver/middlewares/v1/jwt.go","lineNumber":90,"sourceCode":"\t}\n\n\tlogger := log.WithField(\"ip\", c.ClientIP())\n\n\tret.machineID = fmt.Sprintf(\"%s@%s\", extractedCN, c.ClientIP())\n\n\tret.clientMachine, err = j.DbClient.Ent.Machine.Query().\n\t\tWhere(machine.MachineId(ret.machineID)).\n\t\tFirst(ctx)\n\tif ent.IsNotFound(err) {\n\t\t// Machine was not found, let's create it\n\t\tlogger.Infof(\"machine %s not found, create it\", ret.machineID)\n\t\t// let's use an apikey as the password, doesn't matter in this case (generatePassword is only available in cscli)\n\t\tpwd, err := GenerateAPIKey(dummyAPIKeySize)\n\t\tif err != nil {\n\t\t\tlogger.WithField(\"cn\", extractedCN).\n\t\t\t\tErrorf(\"error generating password: %s\", err)\n\n\t\t\treturn nil, errors.New(\"error generating password\")\n\t\t}\n\n\t\tpassword := strfmt.Password(pwd)\n\n\t\tret.clientMachine, err = j.DbClient.CreateMachine(ctx, &ret.machineID, &password, \"\", true, true, types.TlsAuthType)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"while creating machine entry for %s: %w\", ret.machineID, err)\n\t\t}\n\t} else if err != nil {\n\t\treturn nil, fmt.Errorf(\"while selecting machine entry for %s: %w\", ret.machineID, err)\n\t} else {\n\t\tif ret.clientMachine.AuthType != types.TlsAuthType {\n\t\t\treturn nil, fmt.Errorf(\"machine %s attempted to auth with TLS cert but it is configured to use %s\", ret.machineID, ret.clientMachine.AuthType)\n\t\t}\n\n\t\tret.machineID = ret.clientMachine.MachineId\n\t}\n","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/apiserver/middlewares/v1/jwt.go#L72-L108","documentation":"In authTLS, when a machine authenticating by client certificate exists in the database only by CN, crowdsec auto-provisions it by generating a dummy API-key password via GenerateAPIKey. It returns \"error generating password\" when that crypto/rand-backed generation fails, aborting the TLS machine login.","triggerScenarios":"A client-cert-authenticated machine hits LAPI and GenerateAPIKey fails during auto-registration — practically only when the system's random source is unavailable (e.g. blocked crypto/rand, sandboxed container without proper /dev/urandom access).","commonSituations":"Extremely rare: hardened containers seccomp-blocking getrandom, or a Go runtime crypto/rand failure on an unusual platform. If you see it repeatedly, the environment's entropy/syscall setup is broken.","solutions":["Verify the host allows the getrandom(2) syscall for the crowdsec process (check seccomp/apparmor profiles)","Check /dev/urandom is accessible inside the container","Pre-register the machine with `cscli machines add` so the auto-provision path (and GenerateAPIKey) is not needed","Inspect the accompanying log line (it includes the underlying err) for the root cause"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// pre-register TLS machines so auto-provisioning is skipped:\n// cscli machines add mymachine --machine mymachine\n","typeGuard":null,"tryCatchPattern":"authInput, err := j.authTLS(c)\nif err != nil {\n    log.WithError(err).Error(\"TLS machine auth failed\")\n    c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{\"message\": \"authentication failed\"})\n    return\n}","preventionTips":["Pre-register machines with cscli machines add so GenerateAPIKey is never on the hot path","Keep seccomp/apparmor profiles permissive for getrandom(2) in containers running crowdsec","Monitor logs for repeated 'error generating password' — it signals a broken random source"],"tags":["tls","crypto","random","machine-provisioning"],"backgroundTag":"internal-invariant-violation","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}