SV-221710r603260_rule
V-221710
SRG-OS-000366-GPOS-00153
OL07-00-020050
CAT I
10
Configure the operating system to verify the signature of packages from a repository prior to install by setting the following option in the "/etc/yum.conf" file:
gpgcheck=1
Verify the operating system prevents the installation of patches, service packs, device drivers, or operating system components from a repository without verification that they have been digitally signed using a certificate that is recognized and approved by the organization.
Check that yum verifies the signature of packages from a repository prior to install with the following command:
# grep gpgcheck /etc/yum.conf
gpgcheck=1
If "gpgcheck" is not set to "1", or if options are missing or commented out, ask the System Administrator how the certificates for patches and other operating system components are verified.
If there is no process to validate certificates that is approved by the organization, this is a finding.
V-221710
False
OL07-00-020050
Verify the operating system prevents the installation of patches, service packs, device drivers, or operating system components from a repository without verification that they have been digitally signed using a certificate that is recognized and approved by the organization.
Check that yum verifies the signature of packages from a repository prior to install with the following command:
# grep gpgcheck /etc/yum.conf
gpgcheck=1
If "gpgcheck" is not set to "1", or if options are missing or commented out, ask the System Administrator how the certificates for patches and other operating system components are verified.
If there is no process to validate certificates that is approved by the organization, this is a finding.
M
4089