I've been playing with a project that uses /dev/urandom and have noticed some very unrandom strings

Here are some examples I generated just now using
cat /dev/urandom | tr -cd [:alnum:] | fold -w10 | head -n 1

I'm surprised that out of all the numbers and letters [:alnum:] that you'd get repeating charactors out of the 62 chars available.

bN4BwpGBH7
gPv18HzyaY
WCBWDKnX3R
MCbBCDACSJ
GWWFif54cW

As you can see the randomness factor here is very disappointing.

2.6.17-10-generic

I am not familiar with the test you are running there or how accurate that is, but it is well known that the kernel's "random" device node is a fairly poor source of entropy. It only has a limited amount of systems it can base it's random data on.

If you are seriously concerned with getting good random data, you should look into seeding it with audio or video input. Ideally you would be using a hardware RNG connected to the computer, but those are prohibitively expensive (at least the ones I have seen).

I am not familiar with the test you are running there or how accurate that is
Me neither. But I'll see your method and raise you a "I doubt what you do is valid". If you "cat -v /dev/urandom|head -1" you'll see what's going on better. So, if you "cat /dev/urandom | head -n 10 | sha1sum | awk '{print $1}'" you'll get a whole different idea.

I'm trying to generate random passwords, so having charactors repeat is bad.

~$ cat /proc/sys/kernel/random/entropy_avail
3607
~$ cat /dev/urandom | tr -cd [:alnum:][unct:] | fold -w10 | head -n 1
JWXszMrg[+
~$ cat /proc/sys/kernel/random/entropy_avail
263

Is that much of a drop for one call normal ?

I'm trying to generate random passwords
No, you're trying to reinvent the wheel.
Better search for tried 'n tested tools that do this already.
I know there are.

Next time I'll take the favor with rudeness not included.

Using /dev/urandom to get *random* data to create a *random* password is hardly reinventing the wheel.

I tested a few other "random" password generators and they had a lower level of entropy.

I'm kind of confused. If all you need is a random password, why use /dev/urandom at all? Doesn't /dev/random provide a higher level of entropy anyways? That only comes at the cost of extra time for generating random characters.

"I'm surprised that out of all the numbers and letters [:alnum:] that you'd get repeating charactors out of the 62 chars available."

Random data HAS REPEATING CHARACTERS. The chances of repeating characters in a random sample is usually actually more than you would think (humans are notoriously bad at judging two things - randomness and probability). Ask a human to "randomise" a deck of cards and you'll hardly ever find consecutive numbers, pairs of numbers, lots of the same suit. However, a truly random sample will almost always contain several examples of such "patterns" by sheer chance.

Just because it doesn't "look" random to you doesn't mean it isn't (however, I echo the reply above concerning the "real" random device, hardware RNG's, adding entropy via sound/video etc. if you're serious about getting random data... I'd just like to point out that that's TOTAL overkill for anything that isn't, e.g. SSH keys, military applications, drive encryption etc... using such "true" randomness for just a password is ridiculous).

To say that the data isn't random enough is ludicrous unless you spend months collecting data and analysing it statistically. The whole point of the matter is... could you guess those passwords? The answer is no.

Add on the randomness/probability front, next time you do the lottery, try to estimate the chances of two consecutive numbers coming up. Then see how many draws there have been where two consecutive numbers appear. Or look up something like the Monty Hall Problem. Those two examples should teach you just how bad you or any human is at judging randomness or simple probability.

In addition to what ledow is explaining, watch an episode of Mr. Wizard.

if you want to generate passwords, I suggest you look at apg: www.adel.nursat.kz/apg.

http://imgs.xkcd.com/comics/random_number.png