Added CRYP-8002

CHANGELOG.md

@@ -69,6 +69,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - AUTH-9266 - skip .pam-old files in /etc/pam.d
 - AUTH-9408 - added support for pam_tally2 to log failed logins
 - CONT-8106 - support newer 'docker info' output
+- CRYP-8002 - gather kernel entropy on Linux systems
 - FILE-7524 - optimized file permissions testing
 - FINT-4328 - corrected text in log
 - FINT-4334 - improved process detection for lfd

db/tests.db

@@ -85,6 +85,7 @@ CONT-8108:test:security:containers::Check file permissions for Docker files:
 CORE-1000:test:performance:system_integrity::Check all system binaries:
 CRYP-7902:test:security:crypto::Check expire date of SSL certificates:
 CRYP-7930:test:security:crypto:Linux:Determine if system uses LUKS encryption:
+CRYP-8002:test:security:crypto:Linux:Gather kernel entropy:
 DNS-1600:test:security:dns::Validating that the DNSSEC signatures are checked:
 DBS-1804:test:security:databases::Checking active MySQL process:
 DBS-1816:test:security:databases::Checking MySQL root password:

include/tests_crypto

@@ -149,6 +149,7 @@
                 fi
             done
             unset BLOCK_DEV
+
         # This will enable us to do a test for forensics or when crypsetup/lsblk are not available
         elif [ -f ${CRYPTTABFILE} ]; then
             LogText "Result: crypttab (${CRYPTTABFILE}) exists"
@@ -172,6 +173,28 @@
     fi
 #
 #################################################################################
+#
+    # Test        : CRYP-8002
+    # Description : Gather available kernel entropy
+    Register --test-no CRYP-8002 --os Linux --weight L --network NO --root-only NO --category security --description "Gather available kernel entropy"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        if [ -f ${ROOTDIR}proc/sys/kernel/random/entropy_avail ]; then
+            DATA=$(${AWKBINARY} '$1 ~ /^[0-9]+$/ {print $1}' ${ROOTDIR}proc/sys/kernel/random/entropy_avail)
+            if [ -n "${DATA}" ]; then
+                LogText "Result: found kernel entropy value of ${DATA}"
+                Report "kernel_entropy=${DATA}"
+                if [ ${DATA} -gt 200 ]; then
+                    Display --indent 2 --text "- Kernel entropy is sufficient" --result "${STATUS_YES}" --color GREEN
+                else
+                    Display --indent 2 --text "- Kernel entropy is sufficient" --result "${STATUS_NO}" --color YELLOW
+                    # TODO - enable suggestion when information on website is available
+                fi
+            fi
+        fi
+    fi
+#
+#################################################################################
+#
 
 WaitForKeyPress