OL6-00-000013 - The system package management tool must cryptographically verify the authenticity of system software packages during installation.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Ensuring the validity of packages' cryptographic signatures prior to installation ensures the provenance of the software and protects against malicious tampering.

Solution

The 'gpgcheck' option should be used to ensure checking of an RPM package's signature always occurs prior to its installation. To configure yum to check package signatures before installing them, ensure the following line appears in '/etc/yum.conf' in the '[main]' section:

gpgcheck=1

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_6_V2R6_STIG.zip

Item Details

References: CAT|II, CCI|CCI-001749, Rule-ID|SV-219544r793801_rule, STIG-ID|OL6-00-000013, STIG-Legacy|SV-64907, STIG-Legacy|V-50701, Vuln-ID|V-219544

Plugin: Unix

Control ID: e635f397405d97d91d16332a83b8addf4977e0d685a4f70c446185350258e424