Oracle Linux 6 Security Technical Implementation Guide

The Oracle Linux 6 Security Technical Implementation Guide (V2 R7) has 267 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

267STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R7

CurrentPublished Thu Jan 26 2023

Vendor-provided cryptographic certificates must be installed to verify the integrity of system software.

Oracle Linux 6 Security Technical Implementation Guide

Assessment Title

Rule Text

Vendor-provided cryptographic certificates must be installed to verify the integrity of system software.

Description

Discussion Text

This key is necessary to cryptographically verify packages that packages are from the operating system vendor.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-219543

Rule

SV-219543r854338_rule

Severity

high

Rule Version

OL6-00-000008

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

To ensure that the GPG key is installed, run:

# rpm -qi gpg-pubkey-ec551f03 | gpg --keyid-format long | grep oracle.com | cut -f3 -d" " |cut -f2 -d"/"

The command should return the string below:

72F97B74EC551F03

If the operating system vendor GPG Key is not installed, this is a finding.

Implementation Procedure

Fix Text

To ensure the system can cryptographically verify the software packages come from the operating system vendor (and connect to the vendor's network software repository to receive them if desired), the vendor GPG key must properly be installed. To ensure the GPG key is installed, run: 

# wget http://public-yum.oracle.com/RPM-GPG-KEY-oracle-ol6
# rpm --import RPM-GPG-KEY-oracle-ol6

STIG check 212 of 267 in the Oracle Linux 6 STIG checklist

← Previous · V-219542The audit system must alert designated staff members when the audit storage volume approaches capacity.Next · V-219544 →The system package management tool must cryptographically verify the authenticity of system software packages during installation.