Skip to content
ATO Pathways
  Log In

Enable the Hardware RNG Entropy Gatherer Service

An XCCDF Rule

Description

The Hardware RNG Entropy Gatherer service should be enabled. The rngd service can be enabled with the following command: 

$ sudo systemctl enable rngd.service

Rationale

The rngd service feeds random data from hardware device to kernel random device.

ID
xccdf_org.ssgproject.content_rule_service_rngd_enabled
Severity
Low
References
Updated



Remediation - OS Build Blueprint


[customizations.services]
enabled = ["rngd"]

Remediation - Ansible

- name: Enable service rngd
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

Remediation - Puppet

include enable_rngd

class enable_rngd {
  service {'rngd':
    enable => true,
    ensure => 'running',

Remediation - Shell Script

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { ( grep -qP "^ID=[\"']?ol[\"']?$" "/etc/os-release" && { real="$(grep -P "^VERSION_ID=[\"']?[\w.]+[\"']?$" /etc/os-release | sed "s/^VERSION_ID=[\"']\?\([^\"']\+\)[\"']\?$/\1/")"; expected="8.4"; [[ "$real" != "$expected" ]] && printf "%s\n%s" "$real" "$expected" | sort -VC; } || ! ( [ "$(sysctl -a | grep -c 'fips_enabled.*1')" -eq 1 ] ) ); }; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'rngd.service'
"$SYSTEMCTL_EXEC" start 'rngd.service'