← Back to Oracle Linux 9 Security Technical Implementation Guide

V-271457

CAT II (Medium)

OL 9 must not install packages from the Extra Packages for Enterprise Linux (EPEL) repository.

Rule ID

SV-271457r1134853_rule

STIG

Oracle Linux 9 Security Technical Implementation Guide

Version

V1R5

CCIs

CCI-000381

Discussion

The EPEL is a repository of high-quality open-source packages for enterprise-class Linux distributions such as RHEL, CentOS, AlmaLinux, Rocky Linux, and Oracle Linux. These packages are not part of the official distribution but are built using the same Fedora build system to ensure compatibility and maintain quality standards.

Check Content

Verify that OL 9 is not able to install packages from the EPEL with the following command:

$ dnf repolist
repo id                                               repo name
ol9_UEKR7                                             Oracle Linux 9 UEK Release 7 (x86_64)
ol9_appstream                                         Oracle Linux 9 Application Stream Packages (x86_64)
ol9_baseos_latest                                     Oracle Linux 9 BaseOS Latest (x86_64)
ol9_oraclelinuxmanager210_client                      Oracle Linux Manager Client 2.10 for Oracle Linux 9 (x86_64)

If any repositories containing the word "epel" in the name exist, this is a finding.

Fix Text

The repo package can be manually removed with the following command:

$ sudo dnf remove epel-release

Configure the operating system to disable use of the EPEL repository with the following command:

$ sudo dnf config-manager --set-disabled epel