The system package management tool must cryptographically verify the authenticity of software packages during installation.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22588	GEN008800	SV-46080r2_rule		Low

Description
To prevent the installation of software from unauthorized sources, the system package management tool must use cryptographic algorithms to verify the packages are authentic.

STIG	Date
SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide	2018-09-19

Details

Check Text ( C-43338r2_chk )
Ensure that the suse-build-key package is installed and the build-key file exists: # rpm –ql suse-build-key # ls –l /usr/lib/rpm/gnupg/suse-build-key.gpg Ensure that the value of the CHECK_SIGNATURES variable is set to “yes” # grep –i check_signature /etc/sysconfig/security If the /usr/lib/rpm/gnupg/suse-build-key.gpg file does not exist or CHECK_SIGNATURES is not set to “yes”, this is a finding.

Check Text ( C-43338r2_chk )

Ensure that the suse-build-key package is installed and the build-key file exists:
# rpm –ql suse-build-key
# ls –l /usr/lib/rpm/gnupg/suse-build-key.gpg

Ensure that the value of the CHECK_SIGNATURES variable is set to “yes”
# grep –i check_signature /etc/sysconfig/security
If the /usr/lib/rpm/gnupg/suse-build-key.gpg file does not exist or CHECK_SIGNATURES is not set to “yes”, this is a finding.

Fix Text (F-39426r2_fix)
Install the suse-build-key package from the vendor repository # rpm –Uvh suse-build-key-.noarch.rpm && SuSEconfig Use the YaST System > “/etc/sysconfig Editor” module to set the value of the CHECK_SIGNATURES variable to “yes”. It can be found by expanding the plus signs for System > Security > PolicyKit