>From 5ed6dc228bde585ab95b52db161e8dbb3aa3da68 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Fri, 24 May 2013 18:49:45 -0400 Subject: [PATCH] Created OVAL for ensure_gpgcheck_never_disabled XCCDF rule called nonexisting OVAL, created it. Testing: [shawn@rhel6 checks]$ grep -rin gpgcheck=0 /etc/yum.repos.d/epel-6-openscap.repo 8:gpgcheck=0 15:gpgcheck=0 [shawn@rhel6 checks]$ ./testcheck.py ensure_gpgcheck_never_disabled.xml Evaluating with OVAL tempfile : /tmp/ensure_gpgcheck_never_disabledWx0NNA.xml Definition oval:scap-security-guide.testing:def:100: false Evaluation done. [shawn@rhel6 checks]$ sudo sh -c "sed -i -e 's/gpgcheck=0/gpgcheck=1/g' /etc/yum.repos.d/epel-6-openscap.repo" [shawn@rhel6 checks]$ ./testcheck.py ensure_gpgcheck_never_disabled.xml Evaluating with OVAL tempfile : /tmp/ensure_gpgcheck_never_disabled1vRO1h.xml Definition oval:scap-security-guide.testing:def:100: true Evaluation done. --- .../checks/ensure_gpgcheck_never_disabled.xml | 30 ++++++++++++++++++++ 1 files changed, 30 insertions(+), 0 deletions(-) create mode 100644 RHEL6/input/checks/ensure_gpgcheck_never_disabled.xml diff --git a/RHEL6/input/checks/ensure_gpgcheck_never_disabled.xml b/RHEL6/input/checks/ensure_gpgcheck_never_disabled.xml new file mode 100644 index 0000000..a155cb9 --- /dev/null +++ b/RHEL6/input/checks/ensure_gpgcheck_never_disabled.xml @@ -0,0 +1,30 @@ + + + + Ensure gpgcheck Enabled For All Yum Package Repositories + + Red Hat Enterprise Linux 6 + + Ensure all yum repositories utilize signature checking. + + + + + + + + + + + /etc/yum.repos.d + .* + ^\s*gpgcheck\s*=\s*0\s*$ + 1 + + -- 1.7.1