Detections
Analytics

1.39 SOL-11.1-020080

Information

System packages must be configured with the vendor-provided files, permissions, and ownerships.

GROUP ID: V-216285
RULE ID: SV-216285r958634

Failure to maintain system configurations may result in privilege escalation.

Solution

The Software Installation Profile is required.

Configure the package system to ensure that digital signatures are verified.

# pfexec pkg set-property signature-policy verify

Check that package permissions are configured per vendor requirements.

# pfexec pkg verify

If any errors are reported unrelated to STIG changes, use:

# pfexec pkg fix

to bring configuration settings and permissions into factory compliance.

See Also

https://workbench.cisecurity.org/benchmarks/23765

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-9(3), CAT|II, CCI|CCI-001496, Rule-ID|SV-216285r958634_rule, STIG-ID|SOL-11.1-020080, Vuln-ID|V-216285

Plugin: Unix

Control ID: 06bc81ed2a6160e12771d6a1698cc73d6e7b22a42a5335c1f994c717f11f52ae