Check: OL6-00-000015
Oracle Linux 6 STIG:
OL6-00-000015
(in versions v2 r7 through v1 r9)
Title
The system package management tool must cryptographically verify the authenticity of all software packages during installation. (Cat III impact)
Discussion
Ensuring all packages' cryptographic signatures are valid prior to installation ensures the provenance of the software and protects against malicious tampering.
Check Content
To determine whether "yum" has been configured to disable "gpgcheck" for any repos, inspect all files in "/etc/yum.repos.d" and ensure the following does not appear in any sections: gpgcheck=0 A value of "0" indicates that "gpgcheck" has been disabled for that repo. If GPG checking is disabled, this is a finding. If the "yum" system package management tool is not used to update the system, verify with the SA that installed packages are cryptographically signed.
Fix Text
To ensure signature checking is not disabled for any repos, remove any lines from files in "/etc/yum.repos.d" of the form: gpgcheck=0
Additional Identifiers
Rule ID: SV-219545r854340_rule
Vulnerability ID: V-219545
Group Title: SRG-OS-000366
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000663 |
The organization (or information system) enforces explicit rules governing the installation of software by users. |
CCI-001749 |
The information system prevents the installation of organization-defined software components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization. |
Controls
Number | Title |
---|---|
CM-5 (3) |
Signed Components |