openstack/ansible-hardening
Code Issues Proposed changes
Files
0e8feaf9eb5265dcef8682d596e62063f7120a92
ansible-hardening/doc/metadata/rhel7/RHEL-07-020150.rst
Major Hayden 8868011d4c Disable repo GPG checks by default 
Enable repo GPG checks causes some CentOS systems to become unable to
retrieve yum metadata. It also causes the security gate jobs to balloon
out to 12 minutes (normally 3-4 mins).

Closes-Bug: 1641729
Change-Id: I229b471bbd9fbe39776b9022671b03da0a659163
2016-11-14 15:20:04 -06:00

632 B
Raw Blame History

---id: RHEL-07-020150 status: implemented tag: packages ---

On Ubuntu systems, the tasks check for the AllowUnauthenticated string anywhere in the apt configuration files found within /etc/apt/apt.conf.d/. If the string is found, a warning is printed on the console.

On CentOS 7 systems, the tasks set the gpgcheck option to 1 in the /etc/yum.conf file. This enables GPG checks for all packages installed with yum.

Setting security_enable_gpgcheck_packages to no will skip the AllowUnauthenticated string check on Ubuntu and it will set gpgcheck=0 in /etc/yum.conf on CentOS systems.