← Back to SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

V-22588

CAT III (Low)

The system package management tool must cryptographically verify the authenticity of software packages during installation.

Rule ID

SV-46080r2_rule

STIG

SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

Version

V1R12

CCIs

CCI-000351

Discussion

To prevent the installation of software from unauthorized sources, the system package management tool must use cryptographic algorithms to verify the packages are authentic.

Check Content

Ensure that the suse-build-key package is installed and the build-key file exists:
# rpm –ql suse-build-key
# ls –l /usr/lib/rpm/gnupg/suse-build-key.gpg

Ensure that the value of the CHECK_SIGNATURES variable is set to “yes”
# grep –i check_signature /etc/sysconfig/security
If the /usr/lib/rpm/gnupg/suse-build-key.gpg file does not exist or CHECK_SIGNATURES is not set to “yes”, this is a finding.

Fix Text

Install the suse-build-key package from the vendor repository
# rpm –Uvh suse-build-key-<current version>.noarch.rpm && SuSEconfig

Use the YaST System > “/etc/sysconfig Editor” module to set the value of the CHECK_SIGNATURES variable to “yes”.  It can be found by expanding the plus signs for System > Security > PolicyKit