← All rules
SOCLE-CLD-PKG-080// Packageslowinventory state

Install rng-tools Package

Ensures the rng-tools package is installed so a hardware RNG can feed the kernel entropy pool.

Checked against what is installed or registered, packages present/absent, account databases.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →
FedoraRHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0

Why this rule matters

rng-tools provides the rngd daemon that feeds entropy from a hardware random number generator (or other entropy sources) into the kernel's random pool. A healthy entropy supply is essential for the quality of cryptographic operations, generating x509/PKI certificates, TLS session keys, SSH host keys and so on. On systems with low entropy, cryptographic operations can block or, worse, produce weak keys; rng-tools keeps the pool well-fed.

What Pavois checks

Pavois checks the effective package state with package('rng-tools') (resolved through rpm). Confirming the package is installed is more reliable than reading a service unit file: it verifies the rngd tooling actually exists rather than assuming a referenced unit implies a present binary.

describe package('rng-tools') do
  it { should be_installed }
end

How to verify it is applied

Run rpm -q rng-tools. Expected output is a versioned package name. Confirm the daemon with systemctl status rngd and check the entropy pool with cat /proc/sys/kernel/random/entropy_avail.

Inspect & investigate

Installation history is visible with dnf history and in /var/log/dnf.log. The rngd daemon's activity and entropy source selection are logged via journalctl -u rngd.

Remediation

Pavois's harden plan installs the rng-tools package via the package resource (action: install). It is applied with pavois harden apply. To actually feed the pool you should then enable and start the daemon (systemctl enable --now rngd); the install alone provides the tooling.

Pavois applies this with its own harden engine, the plan below, not a shell script:

actioninstall
namerng-tools
resourcepackage
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

Installing rng-tools is low-risk. The caution is hardware-dependent: configuring rngd to trust a low-quality or absent hardware source can inject poor entropy, and on virtual machines without a proper RNG device rngd may have no usable source. - On VMs prefer a paravirtualized RNG (virtio-rng) and verify rngd selects a sound source. - Avoid forcing untrusted entropy sources; let rngd validate them, and monitor entropy_avail after enabling.

Sources & references