Detections
Analytics

1.2.1.1 Ensure GPG keys are configured

Information

The RPM Package Manager implements GPG key signing to verify package integrity during and after installation.

It is important to ensure that updates are obtained from a valid source to protect against spoofing that could lead to the inadvertent installation of malware on the system. To this end, verify that GPG keys are configured correctly for your system.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Update your package manager GPG keys in accordance with site policy.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|RA-5, 800-53|SI-2, 800-53|SI-2(2), CSCv7|3.4, CSCv7|3.5

Plugin: Unix

Control ID: 18ecb42f301cde12aa06d4742e76ed4cc2d0067f8e5742b605ec4f76060ed2db