UCF STIG Viewer Logo

The system package management tool must cryptographically verify the authenticity of software packages during installation.


Overview

Finding ID Version Rule ID IA Controls Severity
V-22588 GEN008800 SV-63027r2_rule Low
Description
To prevent the installation of software from unauthorized sources, the system package management tool must use cryptographic algorithms to verify the packages are authentic.
STIG Date
Oracle Linux 5 Security Technical Implementation Guide 2020-02-25

Details

Check Text ( C-51821r2_chk )
Verify YUM signature validation is not disabled.
# grep gpgcheck /etc/yum.conf /etc/yum.repos.d/*

If no results are returned, or the returned “gpgcheck” settings are not equal to “1”, this is a finding.
Fix Text (F-53631r2_fix)
Edit the YUM configuration containing "gpgcheck=0" and set the value to "1".