Detections
Analytics

1.2.1.3 Ensure access to gpg key files are configured

Information

GPG key files are cryptographic keys used by APT to verify the authenticity and integrity of software packages. Each key ensures that packages come from a trusted source and have not been tampered with. These keys are typically stored in keyring directories /etc/apt/trusted.gpg.d or /usr/share/keyrings and referenced in repository configuration files using the signed-by option for secure package verification.

GPG key files are the trust anchors APT relies on to verify that downloaded packages and repository metadata have not been tampered with. If a non-root user can write to these key files, they could replace or add a key that vouches for a malicious or spoofed repository, causing APT to accept and install compromised packages as if they were legitimate. Restricting access to root ensures only trusted administrative processes can change the keys accepted for package verification.

Solution

Run the following commands to update the access to any file(s) returned in the audit steps above:

# chown root:root "/absolute/path/to/file"
# chmod u-x,go-wx "/absolute/path/to/file"

Example

# chown root:root /usr/share/keyrings/debian-archive-trixie-security-automatic.gpg
# chmod u-x,go-wx /usr/share/keyrings/debian-archive-trixie-security-automatic.gpg

Note : APT first checks keys specified with the signed-by option in a repository's .sources or .list files. If no key is specified there, it falls back to administrator-managed keyrings in /etc/apt/trusted.gpg.d, then system-wide keyrings in /usr/share/keyrings.

Impact:

The apt-key command is deprecated, and you should manage keyring files individually in the trusted.gpg.d directory instead. This change is due to security concerns with the way apt-key works, as it adds keys to the /etc/apt/trusted.gpg file, which can lead to potential security issues.

See Also

https://workbench.cisecurity.org/benchmarks/27797

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: e8c567c4672f427a8796b79771c694fad80ebbecd2f9e2d4aad8780b8330981f