Yeah, /dev/random is enough. Using hardware rnd is enough. Using insecure pseudorandom generator or cryptographycaly secure, but predictably seeded pseudorandom number generator is not.