Detections
Analytics

1.2.1.2 Ensure gpgcheck is configured

Information

The gpgcheck option controls verifying package signatures after download. This option is configurable as a global option in the main section of /etc/dnf/dnf.conf and a per repository option in individual files in the /etc/yum.repos.d/* directory.

The option is enabled if gpgcheck is set to 1, true, or yes . The option is disabled if gpgcheck is set to 0, false, or no . If an invalid option is set, e.g. gpgcheck=2, the global option will be used.

Settings in files in the /etc/yum.repos.d/ directory take precedence over the global configuration.

It is important to ensure that an RPM's package signature is always checked prior to installation to ensure that the software is obtained from a trusted source.

Solution

Set gpgcheck=1 in the [main] section of /etc/dnf/dnf.conf :

[main]
gpgcheck=1

Ensure no repository overrides this with gpgcheck=0 . In any repository definition file under /etc/yum.repos.d (or another configured reposdir directory) that sets gpgcheck=0, change it to gpgcheck=1 (or remove the line so the repository inherits the global setting).

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: CONFIGURATION MANAGEMENT, RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|CM-5(3), 800-53|RA-5, 800-53|SI-2, 800-53|SI-2(2), CSCv7|3.4

Plugin: Unix

Control ID: 47f4aed29cbee4fb78d66b13709e3d46917fbf55b080d8524f52382905643cd3