<Group id="updating">
<title>Updating Software</title>
<description>The <tt>yum</tt> command line tool is used to install and
update software packages. The system also provides a graphical
software update tool in the <b>System</b> menu, in the <b>Administration</b> submenu,
called <b>Software Update</b>.
<br /><br />
Red Hat Enterprise Linux systems contain an installed software catalog called
the RPM database, which records metadata of installed packages. Consistently using
<tt>yum</tt> or the graphical <b>Software Update</b> for all software installation
allows for insight into the current inventory of installed software on the system.
</description>

<Rule id="ensure_gpgcheck_never_disabled" severity="low">
<title>Ensure gpgcheck Enabled For All Yum Package Repositories</title>
<description>To ensure signature checking is not disabled for
any repos, remove any lines from files in <tt>/etc/yum.repos.d</tt> of the form:
<pre>gpgcheck=0</pre>
</description>
<ocil clause="GPG checking is disabled">
To determine whether <tt>yum</tt> has been configured to disable
<tt>gpgcheck</tt> for any repos,  inspect all files in
<tt>/etc/yum.repos.d</tt> and ensure the following does not appear in any
sections:
<pre>gpgcheck=0</pre>
A value of <tt>0</tt> indicates that <tt>gpgcheck</tt> has been disabled for that repo. 
</ocil>
<rationale>
Ensuring all packages' cryptographic signatures are valid prior to
installation ensures the authenticity of the software and
protects against malicious tampering.
</rationale>
<ident stig="GEN008800" />
<oval id="ensure_gpgcheck_never_disabled" />
<ref nist="ECSC-1" disa="351" />
</Rule>

<Rule id="security_patches_up_to_date" severity="medium">
<title>Ensure Software Patches Installed</title>
<description>If the system is joined to the Red Hat Network, a Red Hat Satellite Server,
or a yum server, run the following command to install updates:
<pre># yum update</pre>
If the system is not configured to use one of these sources, updates (in the form of RPM packages)
can be manually downloaded from the Red Hat Network and installed using <tt>rpm</tt>.
</description>
<ocil clause="updates are not installed">
If the system is joined to the Red Hat Network, a Red Hat Satellite Server, or
a yum server which provides updates, invoking the following command will
indicate if updates are available:
<pre># yum check-update</pre>
If the system is not configured to update from one of these sources,
run the following command to list when each package was last updated:
<pre>$ rpm -qa -last</pre>
Compare this to Red Hat Security Advisories (RHSA) listed at 
https://access.redhat.com/security/updates/active/
to determine if the system is missing applicable updates.
</ocil>
<rationale>
Installing software updates is a fundamental mitigation against
the exploitation of publicly-known vulnerabilities.
</rationale>
<oval id="security_patches_up_to_date" />
<ref nist="VIVM-1" disa="1227" />
<ident stig="GEN000120" />
</Rule>
</Group>
