Install the Haveged Package for Enhanced Entropy

FaibleNiveau 2Automatiséebind

Description

Install the haveged package to provide enhanced entropy for generating cryptographic keys. Haveged is a user space entropy daemon which is not dependent upon the standard mechanisms for harvesting randomness for the system entropy pool. Haveged uses HAVEGE (HArdware Volatile Entropy Gathering and Expansion) to maintain a pool of 1 million random bytes used to fill /dev/random. The audit requires a running haveged process (pgrep -x haveged).

Méthode de vérification

Méthode d'audit: Commande shell

shell

command -v pgrep >/dev/null 2>&1 || exit 1
pgrep -x haveged >/dev/null 2>&1 && echo compliant || echo 'haveged is not running'

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Install the haveged package with the appropriate package manager and configure it to start, as shown below. # yum install haveged # systemctl enable haveged # systemctl start haveged

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: binddnsdnssec
Référence: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 8.1 Install the Haveged Package for Enhanced Entropy

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target bind --level 2