lowsystemverified ✓

Ensure APT does not allow unauthenticated packages

apt-no-unauthenticated · UBUNTU ≥ 22 · 1 impl

Description

APT must not be configured with AllowUnauthenticated set to true, so that packages without a valid digital signature cannot be installed.

Rationale

Installing unsigned or unverifiable packages allows malicious or tampered software onto the system. Requiring authenticated packages ensures only content signed by a trusted key is installed.

Check → Remediate

Checkcommand

bad=$(grep -riE 'AllowUnauthenticated[[:space:]]*"?true"?' /etc/apt/apt.conf.d/ 2>/dev/null)
[ -z "$bad" ] || { echo "FAIL: APT AllowUnauthenticated is true:"; printf '%s\n' "$bad"; exit 1; }
echo "OK: no APT AllowUnauthenticated=true"; exit 0

expected_exit:: 0

Remediatemanual

note:: Remove any 'AllowUnauthenticated "true"' entry from files under /etc/apt/apt.conf.d/, or set it to "false".

Framework references

STIG

V-270695 / UBTU-24-300001V-260476 / UBTU-22-214010

NIST 800-53

CM-5(3)SI-7(15)

Live verification

ubuntu22:checkubuntu24:check

#apt#package-verification#supply-chain#stig