Install the Haveged Package for Enhanced Entropy

LowLevel 2Automatedbind

Description

Install the haveged package to provide enhanced entropy for generating cryptographic keys. Haveged is a user space entropy daemon which is not dependent upon the standard mechanisms for harvesting randomness for the system entropy pool. Haveged uses HAVEGE (HArdware Volatile Entropy Gathering and Expansion) to maintain a pool of 1 million random bytes used to fill /dev/random. The audit requires a running haveged process (pgrep -x haveged).

How it is checked

Audit method: Shell command

shell

command -v pgrep >/dev/null 2>&1 || exit 1
pgrep -x haveged >/dev/null 2>&1 && echo compliant || echo 'haveged is not running'

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Install the haveged package with the appropriate package manager and configure it to start, as shown below. # yum install haveged # systemctl enable haveged # systemctl start haveged

Properties

Operating systems: Any
Tags: binddnsdnssec
Reference: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 8.1 Install the Haveged Package for Enhanced Entropy

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target bind --level 2