crowdsecurity/crowdsec · error

error generating password

Error message

error generating password

What it means

In authTLS, when a machine authenticating by client certificate exists in the database only by CN, crowdsec auto-provisions it by generating a dummy API-key password via GenerateAPIKey. It returns "error generating password" when that crypto/rand-backed generation fails, aborting the TLS machine login.

Source

Thrown at pkg/apiserver/middlewares/v1/jwt.go:90

	}

	logger := log.WithField("ip", c.ClientIP())

	ret.machineID = fmt.Sprintf("%s@%s", extractedCN, c.ClientIP())

	ret.clientMachine, err = j.DbClient.Ent.Machine.Query().
		Where(machine.MachineId(ret.machineID)).
		First(ctx)
	if ent.IsNotFound(err) {
		// Machine was not found, let's create it
		logger.Infof("machine %s not found, create it", ret.machineID)
		// let's use an apikey as the password, doesn't matter in this case (generatePassword is only available in cscli)
		pwd, err := GenerateAPIKey(dummyAPIKeySize)
		if err != nil {
			logger.WithField("cn", extractedCN).
				Errorf("error generating password: %s", err)

			return nil, errors.New("error generating password")
		}

		password := strfmt.Password(pwd)

		ret.clientMachine, err = j.DbClient.CreateMachine(ctx, &ret.machineID, &password, "", true, true, types.TlsAuthType)
		if err != nil {
			return nil, fmt.Errorf("while creating machine entry for %s: %w", ret.machineID, err)
		}
	} else if err != nil {
		return nil, fmt.Errorf("while selecting machine entry for %s: %w", ret.machineID, err)
	} else {
		if ret.clientMachine.AuthType != types.TlsAuthType {
			return nil, fmt.Errorf("machine %s attempted to auth with TLS cert but it is configured to use %s", ret.machineID, ret.clientMachine.AuthType)
		}

		ret.machineID = ret.clientMachine.MachineId
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the host allows the getrandom(2) syscall for the crowdsec process (check seccomp/apparmor profiles)
2. Check /dev/urandom is accessible inside the container
3. Pre-register the machine with `cscli machines add` so the auto-provision path (and GenerateAPIKey) is not needed
4. Inspect the accompanying log line (it includes the underlying err) for the root cause

// pre-register TLS machines so auto-provisioning is skipped:
// cscli machines add mymachine --machine mymachine

authInput, err := j.authTLS(c)
if err != nil {
    log.WithError(err).Error("TLS machine auth failed")
    c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{"message": "authentication failed"})
    return
}

When it happens

Trigger: A client-cert-authenticated machine hits LAPI and GenerateAPIKey fails during auto-registration — practically only when the system's random source is unavailable (e.g. blocked crypto/rand, sandboxed container without proper /dev/urandom access).

Common situations: Extremely rare: hardened containers seccomp-blocking getrandom, or a Go runtime crypto/rand failure on an unusual platform. If you see it repeatedly, the environment's entropy/syscall setup is broken.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• generate PoW salt: %w
• missing TLS key file
• missing TLS cert file
• server_cert is required
• server_key is required

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/073603b8233558ae. Report an issue: GitHub.