Detections
Analytics

1.2.1.2 Ensure gpgcheck is globally activated

Information

The gpgcheck option, found in the main section of the /etc/dnf/dnf.conf and individual /etc/yum.repos.d/* files, determines if an RPM package's signature is checked prior to its installation.

It is important to ensure that an RPM's package signature is always checked prior to installation to ensure that the software is obtained from a trusted source.

Solution

Edit /etc/dnf/dnf.conf and set gpgcheck=1 :

Example

# sed -i 's/^gpgcheck\s*=\s*.*/gpgcheck=1/' /etc/dnf/dnf.conf

Edit any failing files in /etc/yum.repos.d/* and set all instances starting with gpgcheck to 1.

Example:

# find /etc/yum.repos.d/ -name "*.repo" -exec echo "Checking:" {} \; -exec sed -i 's/^gpgcheck\s*=\s*.*/gpgcheck=1/' {} \;

See Also

https://workbench.cisecurity.org/benchmarks/19886

Item Details

Category: RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|RA-5, 800-53|SI-2, 800-53|SI-2(2), CAT|II, CSCv7|3.4, Rule-ID|SV-230264r880711_rule, STIG-ID|RHEL-08-010370, Vuln-ID|V-230264

Plugin: Unix

Control ID: f104c0c96f256fc5a5d049fc7cd4a3eb0dd8f178df9ed663a37c88bd3b2c0879