Oracle Linux 6 Security Technical Implementation Guide

The Oracle Linux 6 Security Technical Implementation Guide (V2 R7) has 267 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

267STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R7

CurrentPublished Thu Jan 26 2023

The system package management tool must cryptographically verify the authenticity of all software packages during installation.

Oracle Linux 6 Security Technical Implementation Guide

Assessment Title

Rule Text

The system package management tool must cryptographically verify the authenticity of all software packages during installation.

Description

Discussion Text

Ensuring all packages' cryptographic signatures are valid prior to installation ensures the provenance of the software and protects against malicious tampering.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-219545

Rule

SV-219545r854340_rule

Severity

low

Rule Version

OL6-00-000015

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

To determine whether "yum" has been configured to disable "gpgcheck" for any repos, inspect all files in "/etc/yum.repos.d" and ensure the following does not appear in any sections: 

gpgcheck=0

A value of "0" indicates that "gpgcheck" has been disabled for that repo. 
If GPG checking is disabled, this is a finding.

If the "yum" system package management tool is not used to update the system, verify with the SA that installed packages are cryptographically signed.

Implementation Procedure

Fix Text

To ensure signature checking is not disabled for any repos, remove any lines from files in "/etc/yum.repos.d" of the form: 

gpgcheck=0

STIG check 214 of 267 in the Oracle Linux 6 STIG checklist

← Previous · V-219544The system package management tool must cryptographically verify the authenticity of system software packages during installation.Next · V-219546 →A file integrity tool must be installed.