>From 43c14d9a5474491d7241f105b496dafadf813403 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Mon, 3 Dec 2012 20:51:52 -0500 Subject: [PATCH] DISA FSO requested updates to RHEL6/input/system/software/updating.xml DISA FSO requested updates to RHEL6/input/system/software/updating.xml Thank you FSO for the copy editing! --- RHEL6/input/system/software/updating.xml | 22 +++++++++++----------- 1 files changed, 11 insertions(+), 11 deletions(-) diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml index 4ed4123..9bb8611 100644 --- a/RHEL6/input/system/software/updating.xml +++ b/RHEL6/input/system/software/updating.xml @@ -21,20 +21,20 @@ for this reason, their use is strongly encouraged. Ensure Red Hat GPG Key Installed -To ensure that the system can cryptographically verify base software +To ensure the system can cryptographically verify base software packages come from Red Hat (and to connect to the Red Hat Network to receive them if desired), the Red Hat GPG key must properly be installed. -To ensure that the GPG key is installed, run: +To ensure the GPG key is installed, run:
# rhn_register
-To ensure that the GPG key is installed, run: +To ensure the GPG key is installed, run:
$ rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey
-The command should return the string: +The command should return the string below:
gpg(Red Hat, Inc. (release key <security@redhat.com>)
-This key is necessary to cryptographically verify that packages +This key is necessary to cryptographically verify packages are from Red Hat. @@ -48,16 +48,16 @@ are from Red Hat. ensure they have configured an update source! --> Ensure gpgcheck Enabled In Main Yum Configuration -The gpgcheck option should be used to ensure that +The gpgcheck option should be used to ensure checking of an RPM package's signature always occurs prior to its installation. To configure yum to check package signatures before installing -them, ensure that the following line appears in /etc/yum.conf in +them, ensure the following line appears in /etc/yum.conf in the [main] section:
gpgcheck=1
To determine whether yum is configured to use gpgcheck, -inspect /etc/yum.conf and ensure that the following appears in the +inspect /etc/yum.conf and ensure the following appears in the [main] section:
gpgcheck=1
A value of 1 indicates that gpgcheck is enabled. Absence of a @@ -77,20 +77,20 @@ protects against malicious tampering. Ensure gpgcheck Enabled For All Yum Package Repositories -To ensure that signature checking is not disabled for +To ensure signature checking is not disabled for any repos, remove any lines from files in /etc/yum.repos.d of the form:
gpgcheck=0
To determine whether yum has been configured to disable gpgcheck for any repos, inspect all files in -/etc/yum.repos.d and ensure that the following does not appear in any +/etc/yum.repos.d and ensure the following does not appear in any sections:
gpgcheck=0
A value of 0 indicates that gpgcheck has been disabled for that repo.
-Ensuring that all packages' cryptographic signatures are valid prior to +Ensuring all packages' cryptographic signatures are valid prior to installation ensures the provenance of the software and protects against malicious tampering. -- 1.7.1