documentation_complete: true

prodtype: rhel7

title: 'Ensure gpgcheck Enabled for Local Packages'

description: |-
    <tt>Yum</tt> should be configured to verify the signature(s) of local packages
    prior to installation. To configure <tt>yum</tt> to verify signatures of local
    packages, set the <tt>localpkg_gpgcheck</tt> to <tt>1</tt> in <tt>/etc/yum.conf</tt>.

rationale: |-
    Changes to any software components can have significant effects to the overall security
    of the operating system. This requirement ensures the software has not been tampered and
    has been provided by a trusted vendor.
    <br /><br />
    Accordingly, patches, service packs, device drivers, or operating system components must
    be signed with a certificate recognized and approved by the organization.

severity: high

identifiers:
    cce@rhel7: CCE-80347-8

references:
    cui: 3.4.8
    disa: 1749
    hipaa: 164.308(a)(1)(ii)(D),164.312(b),164.312(c)(1),164.312(c)(2),164.312(e)(2)(i)
    nist: CM-5(3)
    ospp@rhel7: FAU_GEN.1.1.c
    srg: SRG-OS-000366-GPOS-00153
    stigid@rhel7: "020060"

ocil_clause: 'gpgcheck is not enabled or configured correctly to verify local packages'

ocil: |-
    To verify that <tt>localpkg_gpgcheck</tt> is configured properly, run the following
    command:
    <pre>$ grep localpkg_gpgcheck /etc/yum.conf</pre>
    The output should return something similar to:
    <pre>localpkg_gpgcheck=1</pre>
