Details

Ensuring all packages’ cryptographic signatures are valid prior to installation ensures the provenance of the software and protects against malicious tampering.

Solution

To ensure signature checking is not disabled for any repos, remove any lines from files in ‘/etc/yum.repos.d’ of the form:

gpgcheck=0

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_6_V1R18_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Unix.

References

• 800-53|CM-5(3)
• CAT|III
• CCI|CCI-001749
• Group-ID|V-50709
• Rule-ID|SV-219545r603263_rule
• STIG-ID|OL6-00-000015
• STIG-Legacy|SV-64915
• STIG-Legacy|V-50709
• Vuln-ID|V-219545

Source

• Tenable.com/audits