STIGQter: STIG Summary: Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 01 Jul 2026:

Ubuntu 24.04 LTS Advance Package Tool (APT) must be configured to prevent the installation of patches, service packs, device drivers, or Ubuntu 24.04 LTS components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.

DISA Rule

SV-270695r1066574_rule

Vulnerability Number

V-270695

Group Title

SRG-OS-000366-GPOS-00153

Rule Version

UBTU-24-300001

Severity

CAT III

CCI(s)

• CCI-003992 - Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

Weight

10

Fix Recommendation

Configure APT to prevent the installation of patches, service packs, device drivers, or Ubuntu 24.04 LTS components without verification they have been digitally signed using a certificate recognized and approved by the organization.

Remove/update any APT configuration files that contain the variable "AllowUnauthenticated" to "false" or remove "AllowUnauthenticated" entirely from each file. Below is an example of setting the "AllowUnauthenticated" variable to "false":

APT::Get::AllowUnauthenticated "false";

Check Contents

Verify that APT is configured to prevent the installation of patches, service packs, device drivers, or Ubuntu 24.04 LTS components without verification they have been digitally signed using a certificate recognized and approved by the organization with the following command:

$ grep AllowUnauthenticated /etc/apt/apt.conf.d/*

If any files are returned from the command with "AllowUnauthenticated" are set to "true", this is a finding.

Vulnerability Number

V-270695

Documentable

False

Rule Version

UBTU-24-300001

Severity Override Guidance

Verify that APT is configured to prevent the installation of patches, service packs, device drivers, or Ubuntu 24.04 LTS components without verification they have been digitally signed using a certificate recognized and approved by the organization with the following command:

$ grep AllowUnauthenticated /etc/apt/apt.conf.d/*

If any files are returned from the command with "AllowUnauthenticated" are set to "true", this is a finding.

Check Content Reference

M

Target Key

5673