Host must use sufficient entropy for cryptographic operations

OrtaDüzey 1Otomatikvmware

Açıklama

Starting with vSphere 8.0, ESXi has enhanced its entropy implementation to align with FIPS 140-3 and EAL4 certifications, ensuring a robust foundation for cryptographic operations. Kernel boot options dictate the activation of entropy sources on an ESXi host. The parameter governing this behavior is disableHwrng = FALSE and entropySources = 0. The audit runs esxcli system settings kernel list -o disableHwrng and requires it to be absent or FALSE (configured and runtime). Runs in the ESXi Shell (busybox sh) as root.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

out=$(esxcli system settings kernel list -o disableHwrng 2>/dev/null) || exit 1
set -- $(printf '%s\n' "$out" | awk '$1=="disableHwrng" {print toupper($3), toupper($4); exit}')
[ $# -eq 0 ] && { echo compliant; exit 0; }
[ "$1" = FALSE ] && [ "$2" = FALSE ] && echo compliant || echo "disableHwrng configured=$1 runtime=$2"

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

1. Set the kernel option with: esxcli system settings kernel set -s disableHwrng -v FALSE 2. Reboot if required by the host/build and verify the configured and runtime values are FALSE.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: vmwareesxibase
Referans: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 2.11 Host must use sufficient entropy for cryptographic operations

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target vmware