Check: RHEL-06-000013
Red Hat Enterprise Linux 6 STIG:
RHEL-06-000013
(in versions v2 r2 through v1 r14)
Title
The system package management tool must cryptographically verify the authenticity of system software packages during installation. (Cat II impact)
Discussion
Ensuring the validity of packages' cryptographic signatures prior to installation ensures the provenance of the software and protects against malicious tampering.
Check Content
To determine whether "yum" is configured to use "gpgcheck", inspect "/etc/yum.conf" and ensure the following appears in the "[main]" section: gpgcheck=1 A value of "1" indicates that "gpgcheck" is enabled. Absence of a "gpgcheck" line or a setting of "0" indicates that it is disabled. If GPG checking is not enabled, this is a finding. If the "yum" system package management tool is not used to update the system, verify with the SA that installed packages are cryptographically signed.
Fix Text
The "gpgcheck" option should be used to ensure checking of an RPM package's signature always occurs prior to its installation. To configure yum to check package signatures before installing them, ensure the following line appears in "/etc/yum.conf" in the "[main]" section: gpgcheck=1
Additional Identifiers
Rule ID: SV-217855r603264_rule
Vulnerability ID: V-217855
Group Title: SRG-OS-000366
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000663 |
The organization (or information system) enforces explicit rules governing the installation of software by users. |
| CCI-001749 |
The information system prevents the installation of organization-defined software components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization. |
| CCI-002740 |
The information system implements cryptographic mechanisms to authenticate organization-defined software or firmware components prior to installation. |