Detections
Analytics

2.11 Host must use sufficient entropy for cryptographic operations

Information

Starting with vSphere 8.0, ESXi has enhanced its entropy implementation to align with FIPS 140-3 and EAL4 certifications, ensuring a robust foundation for cryptographic operations. Kernel boot options dictate the activation of entropy sources on an ESXi host. The parameter governing this behavior is disableHwrng = FALSE and entropySources = 0.

Employing adequate entropy is crucial for ensuring the strength of cryptographic operations.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

-

Set the kernel option with:

esxcli system settings kernel set -s disableHwrng -v FALSE

 -

Reboot if required by the host/build and verify the configured and runtime values are FALSE.

Impact:

There is no functional impact noted.

See Also

https://workbench.cisecurity.org/benchmarks/28124

Item Details

Category: CONFIGURATION MANAGEMENT, MAINTENANCE

References: 800-53|CM-7, 800-53|MA-4, CSCv7|5.1

Plugin: Unix

Control ID: dbdcdccb69bce4b83438217c7769a5291e695bd9ac47826079d5d8672b064521