A question about the ensure_redhat_gpgkey_installed test

Kenneth Stailey kstailey.lists at gmail.com
Tue Sep 11 17:17:26 UTC 2012


On Mon, Sep 10, 2012 at 5:39 PM, Jeffrey Blank <blank at eclipse.ncsc.mil> wrote:
> [...]
> Regarding what the actual check should be: it's not just that a package
> is installed with that name, it's that it's a Red Hat release key (as
> indicated in the Rule).  Perhaps there is a way to get at the particular
> package summary name using the rpminfo test. [...]

The OVAL 5.10.1 Linux definition does not provide a means to examine
an RPM package summary.

The OVAL checks provided as USGCB 1.0.5.0 content do not examine the
Red Hat release key RPM summary.  Instead they confirm that there is a
package installed with the name gpg-pubkey and with the version string
set to the 32-bits of the Red Hat release key ID and with the release
string set to the 32-bits of the Red Hat release key signature date.

Unlike RHEL 5, RHEL 6 comes with an auxiliary key that is used for
disaster recovery.  For details:

http://www.awe.com/mark/blog/20101111.html
https://access.redhat.com/security/team/key/

It seems important to verify that the auxiliary key package is is also
installed.

Are there issues with continuing to use the (package name, key ID,
signature date) combination to specify the release key RPM?

Regards,

Kenneth


More information about the scap-security-guide mailing list