{"description": "<tt>apt_get</tt> should be configured to verify the signature(s) of local packages\nprior to installation. To configure <tt>apt_get</tt> to verify signatures of local\npackages, set the <tt>localpkg_gpgcheck</tt> to <tt>1</tt> in <tt>/etc/apt/apt.conf</tt>.", "rationale": "Changes to any software components can have significant effects to the overall security\nof the operating system. This requirement ensures the software has not been tampered and\nhas been provided by a trusted vendor.\n<br /><br />\nAccordingly, patches, service packs, device drivers, or operating system components must\nbe signed with a certificate recognized and approved by the organization.", "severity": "high", "references": {"cis-csc": ["11", "3", "9"], "cobit5": ["BAI10.01", "BAI10.02", "BAI10.03", "BAI10.05"], "cui": ["3.4.8"], "hipaa": ["164.308(a)(1)(ii)(D)", "164.312(b)", "164.312(c)(1)", "164.312(c)(2)", "164.312(e)(2)(i)"], "isa-62443-2009": ["4.3.4.3.2", "4.3.4.3.3"], "isa-62443-2013": ["SR 7.6"], "iso27001-2013": ["A.12.1.2", "A.12.5.1", "A.12.6.2", "A.14.2.2", "A.14.2.3", "A.14.2.4"], "nist": ["CM-11(a)", "CM-11(b)", "CM-6(a)", "CM-5(3)", "SA-12", "SA-12(10)"], "nist-csf": ["PR.IP-1"], "ospp": ["FPT_TUD_EXT.1", "FPT_TUD_EXT.2"], "srg": ["SRG-OS-000366-GPOS-00153"], "anssi": ["R59"], "ism": ["1493"]}, "control_references": {"anssi": ["R59"], "ism": ["1493"]}, "components": [], "identifiers": {}, "ocil_clause": "there is no process to validate certificates for local packages that is approved by the organization", "ocil": "Verify that apt_get verifies the signature of local packages prior to install with the following command:\n\n<pre>$ grep localpkg_gpgcheck /etc/apt/apt.conf</pre>\n\n<pre>localpkg_gpgcheck=1</pre>\n\nIf \"localpkg_gpgcheck\" is not set to \"1\", or if the option is missing or commented out, ask the System Administrator how the certificates for patches and other operating system components are verified.", "oval_external_content": null, "fixtext": "Configure Ubuntu 22.04 to always check package signatures before installation of local packages.\n\nAdd or update the following line in [main] section of the /etc/apt/apt.conf file:\n\nlocalpkg_gpgcheck=1", "checktext": "", "vuldiscussion": "", "srg_requirement": "Ubuntu 22.04 must check the GPG sign of locally installed packages.", "warnings": [], "conflicts": [], "requires": [], "policy_specific_content": {"stig": {"srg_requirement": "Ubuntu 22.04 must check the GPG signature of locally installed software packages before installation.", "vuldiscussion": "Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor.\n\nAll software packages must be signed with a cryptographic key recognized and approved by the organization.\n\nVerifying the authenticity of software prior to installation validates the integrity of the software package received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor.", "checktext": "Verify that dnf always checks the GPG signature of locally installed software packages before installation:\n\n$ grep localpkg_gpgcheck /etc/dnf/dnf.conf\n\nlocalpkg_gpgcheck=1\n\nIf \"localpkg_gpgcheck\" is not set to \"1\", or if the option is missing or commented out, ask the system administrator how the GPG signatures of local software packages are being verified.\n\nIf there is no process to verify GPG signatures that is approved by the organization, this is a finding.", "fixtext": "Configure dnf to always check the GPG signature of local software packages before installation.\n\nAdd or update the following line in the [main] section of the /etc/dnf/dnf.conf file:\n\nlocalpkg_gpgcheck=1"}}, "platform": "package[apt_get]", "platforms": ["package[apt_get]"], "sce_metadata": {}, "inherited_platforms": [], "cpe_platform_names": ["package_apt_get"], "inherited_cpe_platform_names": [], "bash_conditional": null, "fixes": {}, "title": "Ensure gpgcheck Enabled for Local Packages", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/system/software/updating/ensure_gpgcheck_local_packages/rule.yml", "template": null}