Detections
Analytics

1.2.1.3 Ensure repo_gpgcheck is configured

Information

The repo_gpgcheck option, found in the main section of the /etc/dnf/dnf.conf and individual /etc/yum.repos.d/* files, will perform a GPG signature check on the repodata.

It is important to ensure that the repository data signature is always checked prior to installation to ensure that the software is not tampered with in any way.

Solution

Global configuration:

Edit /etc/dnf/dnf.conf and set the following in the [main] section:

[main]
repo_gpgcheck=1

Per-repository exceptions:

For any repository that does not support signed repodata, override the global setting in that repository's definition file under /etc/yum.repos.d (or another repository drop-in directory) by setting repo_gpgcheck=0 for that repository. Per-repository settings take precedence over the global configuration. Limit exceptions to trusted repositories that genuinely do not support the option; their metadata will not be signature-verified.

Impact:

Not all repositories support repo_gpgcheck (for example, some Red Hat repositories do not). If repo_gpgcheck is enabled for a repository whose repodata is not signed, package installation or updates from that repository will fail.

Setting repo_gpgcheck=0 for a specific repository that does not support signed repodata is an acceptable exception and does not make the system non-compliant. Be aware, however, that the metadata for any repository with repo_gpgcheck=0 is not signature-verified, so limit this to trusted repositories that genuinely do not support the option. Determining which configured repositories support repo_gpgcheck requires review by the administrator.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|RA-5, 800-53|SI-2, 800-53|SI-2(2), CSCv7|3.4

Plugin: Unix

Control ID: 798447ecfcb187e03ea8034f76babfc2274b82bfab56c99fe13f3c704676290d