UCF STIG Viewer Logo

The ESXi host must use sufficient entropy for cryptographic operations.


Overview

Finding ID Version Rule ID IA Controls Severity
V-258799 ESXI-80-000245 SV-258799r933458_rule Medium
Description
Starting in vSphere 8.0, the ESXi Entropy implementation supports the FIPS 140-3 and EAL4 certifications. Kernel boot options control which entropy sources to activate on an ESXi host. In computing, the term "entropy" refers to random characters and data that are collected for use in cryptography, such as generating encryption keys to secure data transmitted over a network. Entropy is required by security for generating keys and communicating securely over the network. Entropy is often collected from a variety of sources on a system. FIPS entropy handling is the default behavior if the following conditions are true: -The hardware supports RDSEED. -The disableHwrng VMkernel boot option is not present or is FALSE. -The entropySources VMkernel boot option is not present or is 0 (zero).
STIG Date
VMware vSphere 8.0 ESXi Security Technical Implementation Guide 2023-10-11

Details

Check Text ( C-62539r933456_chk )
From an ESXi shell, run the following commands:

# esxcli system settings kernel list -o disableHwrng
# esxcli system settings kernel list -o entropySources

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$esxcli.system.settings.kernel.list.invoke() | Where {$_.Name -eq "disableHwrng" -or $_.Name -eq "entropySources"}

If "disableHwrng" is not set to "false", this is a finding.
If "entropySources" is not set to "0", this is a finding.
Fix Text (F-62448r933457_fix)
From an ESXi shell, run the following commands:

# esxcli system settings kernel set -s disableHwrng -v FALSE
# esxcli system settings kernel set -s entropySources -v 0

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$arguments = $esxcli.system.settings.kernel.set.CreateArgs()
$arguments.setting = "disableHwrng"
$arguments.value = "FALSE"
$esxcli.system.settings.kernel.set.invoke($arguments)
$arguments.setting = "entropySources"
$arguments.value = "0"
$esxcli.system.settings.kernel.set.invoke($arguments)

Reboot the ESXi host after updating entropy settings.