-
Notifications
You must be signed in to change notification settings - Fork 0
/
RHEL-06-000013.sh
executable file
·89 lines (77 loc) · 2.97 KB
/
RHEL-06-000013.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
#!/bin/bash
#
##########################################################################
#Red Hat Enterprise Linux 6 - DISA STIG Compliance Remediation Content
#Copyright (C) 2013
#Vincent C. Passaro ([email protected])
#
##########################################################################
#
###################### Buddha Labs LLC ################################
# By Vincent C. Passaro #
# Buddha Labs LLC. #
# vince[@]buddhalabs[.]com #
# www.buddhalabs.com #
###################### Buddha Labs LLC ################################
#_________________________________________________________________________
# Version | Change Information | Author | Date
#-------------------------------------------------------------------------
# 1.0 | Initial Script Creation | Vincent Passaro | 1-JUNE-2013
#
#
#######################DISA INFORMATION##################################
# Group ID (Vulid): RHEL-06-000013
# Group Title: SRG-OS-000103
#
# Rule ID: RHEL-06-000013_rule
# Severity: medium
# Rule Version (STIG-ID): RHEL-06-000013
# Rule Title: The system package management tool must cryptographically
# verify the authenticity of system software packages during installation.
#
# Vulnerability Discussion: Ensuring the validity of packages'
# cryptographic signatures prior to installation ensures the provenance of
# the software and protects against malicious tampering.
#
# Responsibility:
# IAControls:
#
# Check Content:
#
# To determine whether "yum" is configured to use "gpgcheck", inspect
# "/etc/yum.conf" and ensure the following appears in the "[main]" section:
# gpgcheck=1
# A value of "1" indicates that "gpgcheck" is enabled. Absence of a
# "gpgcheck" line or a setting of "0" indicates that it is disabled.
# If GPG checking is not enabled, this is a finding.
# If the "yum" system package management tool is not used to update the
# system, verify with the SA that installed packages are cryptographically
# signed.
#
# Fix Text:
#
# The "gpgcheck" option should be used to ensure checking of an RPM
# package's signature always occurs prior to its installation. To configure
# yum to check package signatures before installing them, ensure the
# following line appears in "/etc/yum.conf" in the "[main]" section:
# gpgcheck=1
#######################DISA INFORMATION##################################
#
# Global Variables
PDI=RHEL-06-000013
SEVERITY=medium
#
#BEGIN_CHECK
. ./aqueduct_functions
if grep -q gpgcheck=1 /etc/yum.conf; then
show_message $PDI "/etc/yum.conf gpgcheck" pass
else
show_message $PDI "/etc/yum.conf gpgcheck" $SEVERITY
fi
#END_CHECK
#BEGIN_REMEDY
if [ -f /etc/yum.conf ]
then
sed -i "s/gpgcheck=0/gpgcheck=1/g" /etc/yum.conf
fi
#END_REMEDY