STIGQter: STIG Summary: HYCU Protege Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Jul 2026:

The HYCU virtual appliance must prevent the installation of patches, service packs, or application components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.

DISA Rule

SV-268283r1038766_rule

Vulnerability Number

V-268283

Group Title

SRG-APP-000131-NDM-000243

Rule Version

HYCU-ND-000760

Severity

CAT II

CCI(s)

• CCI-003992 - Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

Weight

10

Fix Recommendation

Configure the operating system to verify the signature of packages from a repository prior to install by setting the following option in every repo file in /etc/yum.repos.d/:
gpgcheck=1

Check the output of "sudo /opt/grizzly/bin/hycu-selftest.sh".

Investigate each file listed in the error output to determine a fix.

Check Contents

Verify the operating system prevents the installation of patches, service packs, device drivers, or operating system components from a repository without verification that they have been digitally signed using a certificate that is recognized and approved by the organization.

Check that YUM verifies the signature of packages from a repository prior to install with the following command:

$ sudo grep -E '^\[.*\]|gpgcheck' /etc/yum.repos.d/*.repo

/etc/yum.repos.d/appstream.repo:[appstream]
/etc/yum.repos.d/appstream.repo:gpgcheck=1
/etc/yum.repos.d/baseos.repo:[baseos]
/etc/yum.repos.d/baseos.repo:gpgcheck=1

If "gpgcheck" is not set to "1", or if options are missing or commented out, this is a finding.

Execute the following command to check the kernel and cryptographic libraries, as well as the SHA256 checksums of the application files:
$ sudo /opt/grizzly/bin/hycu-selftest.sh

If the output is not OK for the OS, this is a finding.

If the output reports an error for any other file than /etc/issue for the App section, this is a finding.

Vulnerability Number

V-268283

Documentable

False

Rule Version

HYCU-ND-000760

Severity Override Guidance

Verify the operating system prevents the installation of patches, service packs, device drivers, or operating system components from a repository without verification that they have been digitally signed using a certificate that is recognized and approved by the organization.

Check that YUM verifies the signature of packages from a repository prior to install with the following command:

$ sudo grep -E '^\[.*\]|gpgcheck' /etc/yum.repos.d/*.repo

/etc/yum.repos.d/appstream.repo:[appstream]
/etc/yum.repos.d/appstream.repo:gpgcheck=1
/etc/yum.repos.d/baseos.repo:[baseos]
/etc/yum.repos.d/baseos.repo:gpgcheck=1

If "gpgcheck" is not set to "1", or if options are missing or commented out, this is a finding.

Execute the following command to check the kernel and cryptographic libraries, as well as the SHA256 checksums of the application files:
$ sudo /opt/grizzly/bin/hycu-selftest.sh

If the output is not OK for the OS, this is a finding.

If the output reports an error for any other file than /etc/issue for the App section, this is a finding.

Check Content Reference

M

Target Key

5660