Ensure SUSE GPG Key Installed

An XCCDF Rule

Description

To ensure the system can cryptographically verify base software packages come from SUSE (and to connect to the SUSE to receive them), the SUSE GPG key must properly be installed. To install the SUSE GPG key, run:

$ sudo zypper install suse-build-key

If the system is not connected to the Internet or an RHN Satellite, then install the SUSE GPG key from trusted media such as the SUSE installation CD-ROM or DVD. Assuming the disc is mounted in /media/cdrom, use the following command as the root user to import it into the keyring:

$ sudo rpm --import /media/cdrom/content.key

$ sudo rpm --import /media/cdrom/repodata/repomd.xml.key

Alternatively, the key may be pre-loaded during the SUSE installation. In such cases, one can use the repository cache files to install the key, for example by running the following command:

sudo rpm --import /var/cache/zypp/raw/Basesystem_Module_15_SP2_x86_64:SLE-Module-Basesystem15-SP2-Pool/repodata/repomd.xml.key

Rationale

Changes to software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. The SUSE GPG key is necessary to cryptographically verify packages are from SUSE.

ID: xccdf_org.ssgproject.content_rule_ensure_suse_gpgkey_installed
Severity: High
References: BP28(R15)

11 2 3 9

5.10.4.1

APO01.06 BAI03.05 BAI06.01 BAI10.01 BAI10.02 BAI10.03 BAI10.05 DSS06.02

3.4.8

CCI-001749

164.308(a)(1)(ii)(D) 164.312(b) 164.312(c)(1) 164.312(c)(2) 164.312(e)(2)(i)

4.3.4.3.2 4.3.4.3.3 4.3.4.4.4

SR 3.1 SR 3.3 SR 3.4 SR 3.8 SR 7.6

A.11.2.4 A.12.1.2 A.12.2.1 A.12.5.1 A.12.6.2 A.14.1.2 A.14.1.3 A.14.2.2 A.14.2.3 A.14.2.4

CIP-003-8 R4.2 CIP-003-8 R6 CIP-007-3 R4 CIP-007-3 R4.1 CIP-007-3 R4.2 CIP-007-3 R5.1

CM-5(3) CM-6(a) SC-12 SC-12(3) SI-7

PR.DS-6 PR.DS-8 PR.IP-1

FPT_TUD_EXT.1 FPT_TUD_EXT.2

Req-6.2

6.3.3

SRG-OS-000366-GPOS-00153

CCE-85796-1
Updated: about 1 year ago

- name: Read permission of GPG key directory
  stat:
    path: /usr/lib/rpm/gnupg/keys
  register: suse_gpg_key_directory_permission
  check_mode: false
  tags:  - CCE-85796-1
  - CJIS-5.10.4.1
  - NIST-800-171-3.4.8
  - NIST-800-53-CM-5(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SI-7
  - PCI-DSS-Req-6.2
  - PCI-DSSv4-6.3.3
  - ensure_suse_gpgkey_installed
  - high_severity
  - medium_complexity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy

- name: Set Valid fingerprint
  set_fact:
    suse_gpg_valid_fingerprints: FEAB502539D846DB2C0961CA70AF9E8139DB7C82
  tags:
  - CCE-85796-1
  - CJIS-5.10.4.1
  - NIST-800-171-3.4.8
  - NIST-800-53-CM-5(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SI-7
  - PCI-DSS-Req-6.2
  - PCI-DSSv4-6.3.3
  - ensure_suse_gpgkey_installed
  - high_severity
  - medium_complexity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy

- name: Read signatures in GPG key
  shell: |-
    set -o pipefail
    gpg --with-fingerprint --with-colons "{{ item }}" | grep -A1 "^pub" | grep "^fpr" | cut -d ":" -f 10
  changed_when: false
  register: suse_gpg_fingerprints
  check_mode: false
  with_fileglob: /usr/lib/rpm/gnupg/keys/*.asc
  tags:
  - CCE-85796-1
  - CJIS-5.10.4.1
  - NIST-800-171-3.4.8
  - NIST-800-53-CM-5(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SI-7
  - PCI-DSS-Req-6.2
  - PCI-DSSv4-6.3.3
  - ensure_suse_gpgkey_installed
  - high_severity
  - medium_complexity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy

- name: Import SUSE GPG key
  rpm_key:
    state: present
    key: '{{ item.item }}'
  when:
  - suse_gpg_key_directory_permission.stat.mode <= '0755'
  - item.stdout == suse_gpg_valid_fingerprints
  - suse_gpg_fingerprints | length > 0
  with_items: '{{ suse_gpg_fingerprints.results }}'
  tags:
  - CCE-85796-1
  - CJIS-5.10.4.1
  - NIST-800-171-3.4.8
  - NIST-800-53-CM-5(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SI-7
  - PCI-DSS-Req-6.2
  - PCI-DSSv4-6.3.3
  - ensure_suse_gpgkey_installed
  - high_severity
  - medium_complexity
  - medium_disruption
  - no_reboot_needed
  - restrict_strategy

# The fingerprint below is retrieved from https://www.suse.com/support/security/keys/
readonly SUSE_RELEASE_FINGERPRINT="FEAB502539D846DB2C0961CA70AF9E8139DB7C82"


# Location of the key we would like to import (once it's integrity verified)
readonly SUSE_RELEASE_KEY_PATTERN="/usr/lib/rpm/gnupg/keys/*.asc"
RPM_GPG_DIR_PERMS=$(stat -c %a /usr/lib/rpm/gnupg/keys)

# Verify keys directory permissions are safe
if [ "${RPM_GPG_DIR_PERMS}" -le "755" ]
then

  for KEYFILE in $SUSE_RELEASE_KEY_PATTERN; do
  # If they are safe, try to obtain fingerprints from the key file
  # (to ensure there won't be e.g. CRC error).
      readarray -t GPG_OUT < <(gpg --with-fingerprint --with-colons "$KEYFILE" | grep -A1 "^pub" | grep "^fpr" | cut -d ":" -f 10)
      GPG_RESULT=$?
      # No CRC error, safe to proceed
      if [ "${GPG_RESULT}" -eq "0" ]
      then
          echo "${GPG_OUT[*]}" | grep -vE "${SUSE_RELEASE_FINGERPRINT}" || {
              # In this rule we care on of release build key so we will skip possible keys for backports, etc
              rpm --import "${KEYFILE}"
              break;
          }
      fi
  done
fi

Ensure SUSE GPG Key Installed

Description

Rationale

Remediation - Ansible

Remediation - Shell Script