Ensure repo_gpgcheck is globally activated

낮음레벨 2수동 검토azure-container-linux

설명

The repo_gpgcheck option, found in the main section of the /etc/dnf/dnf.conf and individual /etc/yum.repos.d/* files, will perform a GPG signature check on the repodata. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Global configuration Run the following command: grep ^repo_gpgcheck /etc/dnf/dnf.conf Verify that repo_gpgcheck is set to 1 Per repository configuration Configuration in /etc/yum.repos.d/ takes precedence over the global configuration. As an example, to list all the configured repositories, excluding "fedoraproject.org", that specifically disables repo_gpgcheck, run the following command: # REPO_URL="fedoraproject.org" # for repo in $(grep -l "repo_gpgcheck=0" /etc/yum.repos.d/* ); do if ! grep "${REPO_URL}" "${repo}" &>/dev/null; ...

조치 방법

조치 방식: 가이드 또는 인프라 패치

Global configuration Edit /etc/dnf/dnf.conf and set repo_gpgcheck=1 in the [main] section. Example: [main] repo_gpgcheck=1 Per repository configuration First check that the particular repository support GPG checking on the repodata. Edit any failing files in /etc/yum.repos.d/* and set all instances starting with repo_gpgcheck to 1.

속성

운영 체제: 모두
태그: azure-container-linuxmanual-review
참고 자료: CIS Azure Container Linux Benchmark v1.0.0 - 1.2.1.2 Ensure repo_gpgcheck is globally activated