Detections
Analytics

2.11 Host must use sufficient entropy for cryptographic operations

Information

Starting with vSphere 8.0, ESXi has enhanced its entropy implementation to align with FIPS 140-3 and EAL4 certifications, ensuring a robust foundation for cryptographic operations. Kernel boot options dictate the activation of entropy sources on an ESXi host. The parameter governing this behavior is disableHwrng = FALSE and entropySources = 0.

Employing adequate entropy is crucial for ensuring the strength of cryptographic operations.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

-

Set the kernel option with:

esxcli system settings kernel set -s disableHwrng -v FALSE

 -

Reboot if required by the host/build and verify the configured and runtime values are FALSE.

Impact:

There is no functional impact noted.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: CONFIGURATION MANAGEMENT, MAINTENANCE

References: 800-53|CM-7, 800-53|MA-4, CSCv7|5.1

Plugin: Unix

Control ID: 24251a462368cdb84763e38982fcd4cbf79dd6da299c3af727985d27b95da0b0