{"description": "The gpgcheck option controls whether\nRPM packages' signatures are always checked prior to installation.\nTo configure apt_get to check package signatures before installing\nthem, ensure the following line appears in /etc/apt/apt.conf in\nthe [main] section:\n
gpgcheck=1
", "rationale": "Changes to any software components can have significant effects on the\noverall security of the operating system. This requirement ensures the\nsoftware has not been tampered with and that it has been provided by a\ntrusted vendor.\n
\nAccordingly, patches, service packs, device drivers, or operating system\ncomponents must be signed with a certificate recognized and approved by the\norganization.\n
Verifying the authenticity of the software prior to installation\nvalidates the integrity of the patch or upgrade received from a vendor.\nThis ensures the software has not been tampered with and that it has been\nprovided by a trusted vendor. Self-signed certificates are disallowed by\nthis requirement. Certificates used to verify the software must be from an\napproved Certificate Authority (CA).", "severity": "high", "references": {"cis-csc": ["11", "2", "3", "9"], "cjis": ["5.10.4.1"], "cobit5": ["APO01.06", "BAI03.05", "BAI06.01", "BAI10.01", "BAI10.02", "BAI10.03", "BAI10.05", "DSS06.02"], "cui": ["3.4.8"], "hipaa": ["164.308(a)(1)(ii)(D)", "164.312(b)", "164.312(c)(1)", "164.312(c)(2)", "164.312(e)(2)(i)"], "isa-62443-2009": ["4.3.4.3.2", "4.3.4.3.3", "4.3.4.4.4"], "isa-62443-2013": ["SR 3.1", "SR 3.3", "SR 3.4", "SR 3.8", "SR 7.6"], "iso27001-2013": ["A.11.2.4", "A.12.1.2", "A.12.2.1", "A.12.5.1", "A.12.6.2", "A.14.1.2", "A.14.1.3", "A.14.2.2", "A.14.2.3", "A.14.2.4"], "nist": ["CM-5(3)", "SI-7", "SC-12", "SC-12(3)", "CM-6(a)", "SA-12", "SA-12(10)", "CM-11(a)", "CM-11(b)"], "nist-csf": ["PR.DS-6", "PR.DS-8", "PR.IP-1"], "ospp": ["FPT_TUD_EXT.1", "FPT_TUD_EXT.2"], "pcidss": ["Req-6.2"], "srg": ["SRG-OS-000366-GPOS-00153"], "anssi": ["R59"], "ism": ["1493"], "pcidss4": ["6.3.3", "6.3"]}, "control_references": {"anssi": ["R59"], "ism": ["1493"], "pcidss4": ["6.3.3", "6.3"]}, "components": [], "identifiers": {}, "ocil_clause": "there is no process to validate certificates that is approved by the organization", "ocil": "Verify that apt_get verifies the signature of packages from a repository prior to install with the following command:\n\n
$ grep gpgcheck /etc/apt/apt.conf
\n\n
gpgcheck=1
\n\nIf \"gpgcheck\" is not set to \"1\", or if the option is missing or commented out, ask the System Administrator how the certificates for patches and other operating system components are verified.", "oval_external_content": null, "fixtext": "Configure Ubuntu 22.04 to always check package signatures before installation.\n\nAdd or update the following line in [main] section of the /etc/apt/apt.conf file:\n\ngpgcheck=1", "checktext": "", "vuldiscussion": "", "srg_requirement": "Ubuntu 22.04 must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization.", "warnings": [], "conflicts": [], "requires": [], "policy_specific_content": {"stig": {"srg_requirement": "Ubuntu 22.04 must check the GPG signature of software packages originating from external software repositories before installation.", "vuldiscussion": "Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor.\n\nAll software packages must be signed with a cryptographic key recognized and approved by the organization.\n\nVerifying the authenticity of software prior to installation validates the integrity of the software package received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor.", "checktext": "Verify that dnf always checks the GPG signature of software packages originating from external software repositories before installation:\n\n$ grep -w gpgcheck /etc/dnf/dnf.conf\n\ngpgcheck=1\n\nIf \"gpgcheck\" is not set to \"1\", or if the option is missing or commented out, ask the system administrator how the GPG signatures of software packages are being verified.\n\nIf there is no process to verify GPG signatures that is approved by the organization, this is a finding.", "fixtext": "Configure dnf to always check the GPG signature of software packages originating from external software repositories before installation.\n\nAdd or update the following line in the [main] section of the /etc/dnf/dnf.conf file:\n\ngpgcheck=1"}}, "platform": "package[apt_get]", "platforms": ["package[apt_get]"], "sce_metadata": {}, "inherited_platforms": [], "cpe_platform_names": ["package_apt_get"], "inherited_cpe_platform_names": [], "bash_conditional": null, "fixes": {}, "title": "Ensure gpgcheck Enabled In Main apt_get Configuration", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/rule.yml", "template": null}