Install the Haveged Package for Enhanced Entropy

BajaNivel 2Automatizadabind

Descripción

Install the haveged package to provide enhanced entropy for generating cryptographic keys. Haveged is a user space entropy daemon which is not dependent upon the standard mechanisms for harvesting randomness for the system entropy pool. Haveged uses HAVEGE (HArdware Volatile Entropy Gathering and Expansion) to maintain a pool of 1 million random bytes used to fill /dev/random. The audit requires a running haveged process (pgrep -x haveged).

Cómo se verifica

Método de auditoría: Comando de shell

shell

command -v pgrep >/dev/null 2>&1 || exit 1
pgrep -x haveged >/dev/null 2>&1 && echo compliant || echo 'haveged is not running'

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Install the haveged package with the appropriate package manager and configure it to start, as shown below. # yum install haveged # systemctl enable haveged # systemctl start haveged

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: binddnsdnssec
Referencia: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 8.1 Install the Haveged Package for Enhanced Entropy

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target bind --level 2