Install the Haveged Package for Enhanced Entropy

低レベル 2自動bind

説明

Install the haveged package to provide enhanced entropy for generating cryptographic keys. Haveged is a user space entropy daemon which is not dependent upon the standard mechanisms for harvesting randomness for the system entropy pool. Haveged uses HAVEGE (HArdware Volatile Entropy Gathering and Expansion) to maintain a pool of 1 million random bytes used to fill /dev/random. The audit requires a running haveged process (pgrep -x haveged).

チェック方法

監査方法: シェルコマンド

shell

command -v pgrep >/dev/null 2>&1 || exit 1
pgrep -x haveged >/dev/null 2>&1 && echo compliant || echo 'haveged is not running'

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Install the haveged package with the appropriate package manager and configure it to start, as shown below. # yum install haveged # systemctl enable haveged # systemctl start haveged

プロパティ

オペレーティングシステム: すべて
タグ: binddnsdnssec
参照: CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0 - 8.1 Install the Haveged Package for Enhanced Entropy

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target bind --level 2