STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must ensure cryptographic verification of vendor software packages.

DISA Rule

SV-280931r1197213_rule

Vulnerability Number

V-280931

Group Title

SRG-OS-000366-GPOS-00153

Rule Version

RHEL-10-001020

Severity

CAT II

CCI(s)

CCI-003992 - Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

Weight

Fix Recommendation

Configure RHEL 10 to ensure cryptographic verification of vendor software packages.

Install Red Hat package-signing keys on the system and verify their fingerprints match vendor values.

Insert the RHEL 10 installation disc or attach the RHEL 10 installation image to the system. Mount the disc or image to make the contents accessible inside the system.

Assuming the mounted location is "/media/cdrom", use the following command to copy the Red Hat GPG key file onto the system:

$ sudo cp /media/cdrom/RPM-GPG-KEY-redhat-release /etc/pki/rpm-gpg/

Import Red Hat GPG keys from the key file into the system keyring:

$ sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

Using the steps listed in the Check Text, confirm the newly imported keys show as installed on the system and verify their fingerprints match vendor values.

Check Contents

Verify RHEL 10 ensures cryptographic verification of vendor software packages.

Confirm Red Hat package-signing keys are installed on the system and verify their fingerprints match vendor values.

Note: For RHEL 10 software packages, Red Hat uses GPG keys labeled "release key 2", "auxiliary key 3", and "release key 4". The keys are defined in key file "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" by default.

List Red Hat GPG keys installed on the system:

$ sudo rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey | grep -i "red hat"
Red Hat, Inc. (release key 2) <security@redhat.com> public key
Red Hat, Inc. (auxiliary key 3) <security@redhat.com> public key
Red Hat, Inc. (release key 4) <security@redhat.com> public key

If Red Hat GPG keys "release key 2", "auxiliary key 3", and "release key 4" are not installed, or if the key file "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" is missing, this is a finding.

List key fingerprints of installed Red Hat GPG keys:

$ sq inspect /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release: OpenPGP Certificate.

Fingerprint: 567E347AD0044ADE55BA8A5F199E2F91FD431D51
Public-key algo: RSA
Public-key size: 4096 bits
Creation time: 2009-10-22 11:59:55 UTC
Key flags: certification, signing

UserID: Red Hat, Inc. (release key 2) <security@redhat.com>

Note: There is another block of armored OpenPGP data.
Note: This is a non-standard extension to OpenPGP.

/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release: OpenPGP Certificate.

Fingerprint: 7E4624258C406535D56D6F135054E4A45A6340B3
Public-key algo: RSA
Public-key size: 4096 bits
Creation time: 2022-03-09 21:56:46 UTC
Key flags: certification, signing

UserID: Red Hat, Inc. (auxiliary key 3) <security@redhat.com>

Note: There is another block of armored OpenPGP data.
Note: This is a non-standard extension to OpenPGP.

/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release: OpenPGP Certificate.

Fingerprint: FCD355B305707A62DA143AB6E422397E50FE8467A2A95343D246D6276AFEDF8F
Public-key algo: ML-DSA-87+Ed448
Creation time: 2025-10-08 17:40:03 UTC
Key flags: certification, signing

UserID: Red Hat, Inc. (release key 4) <security@redhat.com>

Compare key fingerprints of installed Red Hat GPG keys with fingerprints listed for RHEL 10 on the Red Hat "Product Signing Keys" webpage at https://access.redhat.com/security/team/key.

If key fingerprints do not match, this is a finding.

Vulnerability Number

V-280931

Documentable

False

Rule Version

RHEL-10-001020

Severity Override Guidance

Check Content Reference

Target Key

5733