Skip to content

Enable the Hardware RNG Entropy Gatherer Service

An XCCDF Rule

Description

The Hardware RNG Entropy Gatherer service should be enabled. The rngd service can be enabled with the following manifest:

---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: master
  name: 75-master-rngd-enable
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: rngd.service
        enabled: true

This will enable the rngd service in all the nodes labeled with the "master" role.

Note that this needs to be done for each MachineConfigPool

For more information on how to configure nodes with the Machine Config Operator see the relevant documentation.

Rationale

The rngd service feeds random data from hardware device to kernel random device.

ID
xccdf_org.ssgproject.content_rule_service_rngd_enabled
Severity
Low
References
Updated