UCF STIG Viewer Logo

The system package management tool must cryptographically verify the authenticity of system software packages during installation.


Overview

Finding ID Version Rule ID IA Controls Severity
V-38483 RHEL-06-000013 SV-50283r1_rule Medium
Description
Ensuring the validity of packages' cryptographic signatures prior to installation ensures the provenance of the software and protects against malicious tampering.
STIG Date
Red Hat Enterprise Linux 6 Security Technical Implementation Guide 2014-06-10

Details

Check Text ( None )
None
Fix Text (F-43429r1_fix)
The "gpgcheck" option should be used to ensure checking of an RPM package's signature always occurs prior to its installation. To configure yum to check package signatures before installing them, ensure the following line appears in "/etc/yum.conf" in the "[main]" section:

gpgcheck=1