Install rng-tools Package
Ensures the rng-tools package is installed so a hardware RNG can feed the kernel entropy pool.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
rng-tools provides the rngd daemon that feeds entropy from a hardware random number generator (or other entropy sources) into the kernel's random pool. A healthy entropy supply is essential for the quality of cryptographic operations, generating x509/PKI certificates, TLS session keys, SSH host keys and so on. On systems with low entropy, cryptographic operations can block or, worse, produce weak keys; rng-tools keeps the pool well-fed.
What Pavois checks
Pavois checks the effective package state with package('rng-tools') (resolved through rpm). Confirming the package is installed is more reliable than reading a service unit file: it verifies the rngd tooling actually exists rather than assuming a referenced unit implies a present binary.
describe package('rng-tools') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q rng-tools. Expected output is a versioned package name. Confirm the daemon with systemctl status rngd and check the entropy pool with cat /proc/sys/kernel/random/entropy_avail.
Inspect & investigate
Installation history is visible with dnf history and in /var/log/dnf.log. The rngd daemon's activity and entropy source selection are logged via journalctl -u rngd.
Remediation
Pavois's harden plan installs the rng-tools package via the package resource (action: install). It is applied with pavois harden apply. To actually feed the pool you should then enable and start the daemon (systemctl enable --now rngd); the install alone provides the tooling.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | rng-tools |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing rng-tools is low-risk. The caution is hardware-dependent: configuring rngd to trust a low-quality or absent hardware source can inject poor entropy, and on virtual machines without a proper RNG device rngd may have no usable source. - On VMs prefer a paravirtualized RNG (virtio-rng) and verify rngd selects a sound source. - Avoid forcing untrusted entropy sources; let rngd validate them, and monitor entropy_avail after enabling.