Ensure repo_gpgcheck is globally activated

BajaNivel 2Revisión manualazure-container-linux

Descripción

The repo_gpgcheck option, found in the main section of the /etc/dnf/dnf.conf and individual /etc/yum.repos.d/* files, will perform a GPG signature check on the repodata. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Global configuration Run the following command: grep ^repo_gpgcheck /etc/dnf/dnf.conf Verify that repo_gpgcheck is set to 1 Per repository configuration Configuration in /etc/yum.repos.d/ takes precedence over the global configuration. As an example, to list all the configured repositories, excluding "fedoraproject.org", that specifically disables repo_gpgcheck, run the following command: # REPO_URL="fedoraproject.org" # for repo in $(grep -l "repo_gpgcheck=0" /etc/yum.repos.d/* ); do if ! grep "${REPO_URL}" "${repo}" &>/dev/null; ...

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Global configuration Edit /etc/dnf/dnf.conf and set repo_gpgcheck=1 in the [main] section. Example: [main] repo_gpgcheck=1 Per repository configuration First check that the particular repository support GPG checking on the repodata. Edit any failing files in /etc/yum.repos.d/* and set all instances starting with repo_gpgcheck to 1.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: azure-container-linuxmanual-review
Referencia: CIS Azure Container Linux Benchmark v1.0.0 - 1.2.1.2 Ensure repo_gpgcheck is globally activated