OpenControls Logo

STIG Viewer

STIGViewer Support

RHEL 9 must have GPG signature verification enabled for all software repositories.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-257822RHEL-09-214025SV-257822r1044880_ruleCCI-003992high
Description
Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. All software packages must be signed with a cryptographic key recognized and approved by the organization. Verifying the authenticity of software prior to installation validates the integrity of the software package received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor.
STIGDate
Red Hat Enterprise Linux 9 Security Technical Implementation Guide2025-05-14

Related Frameworks

2 mappings across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CHG-04.2Signed Components
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (13) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(10)Shared and Group Account Credential Change
1.00
AU-4Audit Log Storage Capacity
1.00
CM-14Signed Components
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00
CM-5(3)Signed Components
1.00
CM-7Least Functionality
1.00
CM-7(5)Authorized Software — Allow-by-exception
1.00
IA-2(5)Individual Authentication with Group Authentication
1.00
SC-2Separation of System and User Functionality
1.00
SC-23Session Authenticity
1.00

+3 more (top 10 by confidence shown)

CCI2 mappings
CCI-001749
1.00
CCI-003992
1.00

Details

Check Text (C-257822r1044880_chk)

Verify that all software repositories defined in "/etc/yum.repos.d/" have been configured with "gpgcheck" enabled: $ grep -w gpgcheck /etc/yum.repos.d/*.repo | more gpgcheck = 1 If "gpgcheck" is not set to "1" for all returned lines, this is a finding.

Fix Text (F-61487r925452_fix)

Configure all software repositories defined in "/etc/yum.repos.d/" to have "gpgcheck" enabled: $ sudo sed -i 's/gpgcheck\s*=.*/gpgcheck=1/g' /etc/yum.repos.d/*