STIGQter: STIG Summary: Riverbed NetIM OS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

Ubuntu OS must be configured so that the Advance Package Tool (APT) prevents the installation of patches, service packs, device drivers, or operating system components without verification they have been digitally signed using a certificate recognized and approved by the organization.

DISA Rule

SV-275571r1147763_rule

Vulnerability Number

V-275571

Group Title

SRG-OS-000366-GPOS-00153

Rule Version

RIIM-OS-214010

Severity

CAT I

CCI(s)

• CCI-003992 - Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

Weight

10

Fix Recommendation

Configure APT to prevent the installation of patches, service packs, device drivers, or Ubuntu operating system components without verification they have been digitally signed using a certificate recognized and approved by the organization.

Add or modify the following line in any file under the "/etc/apt/apt.conf.d/" directory:

APT::Get::AllowUnauthenticated "false";

Check Contents

Verify APT is configured to prevent the installation of patches, service packs, device drivers, or Ubuntu operating system components without verification they have been digitally signed using a certificate recognized and approved by the organization by using the following command:

$ grep -i allowunauthenticated /etc/apt/apt.conf.d/*
/etc/apt/apt.conf.d/01-vendor-ubuntu:APT::Get::AllowUnauthenticated "false";

If "APT::Get::AllowUnauthenticated" is not set to "false", is commented out, or is missing, this is a finding.

Vulnerability Number

V-275571

Documentable

False

Rule Version

RIIM-OS-214010

Severity Override Guidance

Verify APT is configured to prevent the installation of patches, service packs, device drivers, or Ubuntu operating system components without verification they have been digitally signed using a certificate recognized and approved by the organization by using the following command:

$ grep -i allowunauthenticated /etc/apt/apt.conf.d/*
/etc/apt/apt.conf.d/01-vendor-ubuntu:APT::Get::AllowUnauthenticated "false";

If "APT::Get::AllowUnauthenticated" is not set to "false", is commented out, or is missing, this is a finding.

Check Content Reference

M

Target Key

5706