Cis Bind V100 8 1

CIS 8.1 — Install the Haveged Package for Enhanced Entropy

Profile Applicability

• Authoritative Name Server Level 2

Description

Install the haveged package to provide enhanced entropy for generating cryptographic keys. Haveged is a user space entropy daemon which is not dependent upon the standard mechanisms for harvesting randomness for the system entropy pool. Haveged uses HAVEGE (HArdware Volatile Entropy Gathering and Expansion) to maintain a pool of 1 million random bytes used to fill /dev/random.

Rationale

It is important for authoritative DNS servers deploying DNSSEC domains to have a good source of entropy to generate secure cryptographic keys. DNS servers are typically not multi-user systems and generally deployed as headless servers. In such situations generating keys without enhanced entropy can be painfully time-consuming, or may lack sufficient entropy. The haveged daemon ensures that keys can be generated timely and securely.

Impact

Not specified.

Audit Procedure

To verify compliance, run the following pgrep command to ensure the haveged process is running.

$ pgrep -f $(which haveged)
2948

Output with any process ID is compliant. No output indicates the haveged process is not running.

Remediation

Install the haveged package with the appropriate package manager and configure it to start, as shown below.

# yum install haveged
# systemctl enable haveged
# systemctl start haveged

Default Value

The haveged package is not installed or enabled by default.

References

None listed in benchmark.

CIS Controls

MITRE ATT&CK Mappings

Profile

• Level 2 - Authoritative Name Server