STIGQter: STIG Summary: Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

Ubuntu 22.04 LTS must be configured so that the Advance Package Tool (APT) prevents the installation of patches, service packs, device drivers, or operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.

DISA Rule

SV-260476r1015003_rule

Vulnerability Number

V-260476

Group Title

SRG-OS-000366-GPOS-00153

Rule Version

UBTU-22-214010

Severity

CAT III

CCI(s)

• CCI-003992 - Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

Weight

10

Fix Recommendation

Configure APT to prevent the installation of patches, service packs, device drivers, or Ubuntu operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.

Add or modify the following line in any file under the "/etc/apt/apt.conf.d/" directory:

APT::Get::AllowUnauthenticated "false";

Check Contents

Verify that APT is configured to prevent the installation of patches, service packs, device drivers, or Ubuntu operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization by using the following command:

$ grep -i allowunauthenticated /etc/apt/apt.conf.d/*
/etc/apt/apt.conf.d/01-vendor-ubuntu:APT::Get::AllowUnauthenticated "false";

If "APT::Get::AllowUnauthenticated" is not set to "false", is commented out, or is missing, this is a finding.

Vulnerability Number

V-260476

Documentable

False

Rule Version

UBTU-22-214010

Severity Override Guidance

Verify that APT is configured to prevent the installation of patches, service packs, device drivers, or Ubuntu operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization by using the following command:

$ grep -i allowunauthenticated /etc/apt/apt.conf.d/*
/etc/apt/apt.conf.d/01-vendor-ubuntu:APT::Get::AllowUnauthenticated "false";

If "APT::Get::AllowUnauthenticated" is not set to "false", is commented out, or is missing, this is a finding.

Check Content Reference

M

Target Key

5594