The ESXi host must use sufficient entropy for cryptographic operations.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-258799	ESXI-80-000245	SV-258799r933458_rule		Medium

Description
Starting in vSphere 8.0, the ESXi Entropy implementation supports the FIPS 140-3 and EAL4 certifications. Kernel boot options control which entropy sources to activate on an ESXi host. In computing, the term "entropy" refers to random characters and data that are collected for use in cryptography, such as generating encryption keys to secure data transmitted over a network. Entropy is required by security for generating keys and communicating securely over the network. Entropy is often collected from a variety of sources on a system. FIPS entropy handling is the default behavior if the following conditions are true: -The hardware supports RDSEED. -The disableHwrng VMkernel boot option is not present or is FALSE. -The entropySources VMkernel boot option is not present or is 0 (zero).

Description

Starting in vSphere 8.0, the ESXi Entropy implementation supports the FIPS 140-3 and EAL4 certifications. Kernel boot options control which entropy sources to activate on an ESXi host. In computing, the term "entropy" refers to random characters and data that are collected for use in cryptography, such as generating encryption keys to secure data transmitted over a network. Entropy is required by security for generating keys and communicating securely over the network. Entropy is often collected from a variety of sources on a system. FIPS entropy handling is the default behavior if the following conditions are true: -The hardware supports RDSEED. -The disableHwrng VMkernel boot option is not present or is FALSE. -The entropySources VMkernel boot option is not present or is 0 (zero).

STIG	Date
VMware vSphere 8.0 ESXi Security Technical Implementation Guide	2023-10-11

Details

Check Text ( C-62539r933456_chk )
From an ESXi shell, run the following commands: # esxcli system settings kernel list -o disableHwrng # esxcli system settings kernel list -o entropySources or From a PowerCLI command prompt while connected to the ESXi host, run the following commands: $esxcli = Get-EsxCli -v2 $esxcli.system.settings.kernel.list.invoke() \| Where {$_.Name -eq "disableHwrng" -or $_.Name -eq "entropySources"} If "disableHwrng" is not set to "false", this is a finding. If "entropySources" is not set to "0", this is a finding.

Check Text ( C-62539r933456_chk )

From an ESXi shell, run the following commands:

# esxcli system settings kernel list -o disableHwrng
# esxcli system settings kernel list -o entropySources

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$esxcli.system.settings.kernel.list.invoke() | Where {$_.Name -eq "disableHwrng" -or $_.Name -eq "entropySources"}

If "disableHwrng" is not set to "false", this is a finding.
If "entropySources" is not set to "0", this is a finding.

Fix Text (F-62448r933457_fix)
From an ESXi shell, run the following commands: # esxcli system settings kernel set -s disableHwrng -v FALSE # esxcli system settings kernel set -s entropySources -v 0 or From a PowerCLI command prompt while connected to the ESXi host, run the following commands: $esxcli = Get-EsxCli -v2 $arguments = $esxcli.system.settings.kernel.set.CreateArgs() $arguments.setting = "disableHwrng" $arguments.value = "FALSE" $esxcli.system.settings.kernel.set.invoke($arguments) $arguments.setting = "entropySources" $arguments.value = "0" $esxcli.system.settings.kernel.set.invoke($arguments) Reboot the ESXi host after updating entropy settings.

Fix Text (F-62448r933457_fix)

From an ESXi shell, run the following commands:

# esxcli system settings kernel set -s disableHwrng -v FALSE
# esxcli system settings kernel set -s entropySources -v 0

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$arguments = $esxcli.system.settings.kernel.set.CreateArgs()
$arguments.setting = "disableHwrng"
$arguments.value = "FALSE"
$esxcli.system.settings.kernel.set.invoke($arguments)
$arguments.setting = "entropySources"
$arguments.value = "0"
$esxcli.system.settings.kernel.set.invoke($arguments)

Reboot the ESXi host after updating entropy settings.