Enable the Hardware RNG Entropy Gatherer Service
Ensures the rngd.service (hardware RNG entropy gatherer) is enabled at boot and running, feeding hardware randomness into the kernel entropy pool.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
rngd transfers randomness from a hardware source (CPU RDRAND, a TPM, or a dedicated HWRNG) into the kernel's random device. Adequate entropy is the foundation of all cryptography: TLS session keys, SSH host keys, password hashing salts and token generation all draw from it. On servers and especially in VMs, the entropy pool can starve at boot, causing slow or blocking key generation and, in the worst case, predictable random values that weaken keys. Running rngd keeps the pool healthy so cryptographic operations are both fast and strong.
What Pavois checks
Pavois asserts the effective state of rngd.service via systemd (service('rngd.service')), checking it is both enabled and running. This catches a daemon that is installed but never started or has crashed, a file or package check would report success while the entropy pool actually receives nothing.
describe service('rngd.service') do
it { should be_enabled }
it { should be_running }
endHow to verify it is applied
Run systemctl is-enabled rngd.service and systemctl is-active rngd.service; expect enabled and active. Confirm the pool is healthy with cat /proc/sys/kernel/random/entropy_avail (should stay comfortably high, hundreds+).
Inspect & investigate
Check journalctl -u rngd.service for the entropy source it selected and any errors (e.g. no hardware RNG found). systemctl show rngd.service -p ActiveState -p UnitFileState gives the state Pavois reads. The live entropy level is visible in /proc/sys/kernel/random/entropy_avail.
Remediation
Pavois's harden plan acts on the service resource named rngd with actions enable then start: it enables the unit at boot and starts it now. Applied with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | enable, start |
|---|---|
| name | rngd.service |
| resource | service |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Enabling rngd is very low-risk and generally improves availability of cryptographic operations. The one caveat: on hardware or VMs without a usable RNG source, rngd may fail to start (no source), this is harmless but will leave the rule non-compliant; in that case rely on the kernel's built-in jitterentropy/CRNG instead, or pass a virtualized RNG to the guest (virtio-rng). Before applying: on bare metal confirm a HWRNG exists; in VMs ensure the hypervisor exposes virtio-rng so the daemon has a source to read from.