securing oracle linux 9 part 3 securing package management

وحید نوروزی سیستم عامل و زیرساخت 29 July 2026 Hits: 8

In the previous section,

Configuring Partitions and Mount Options

was completed.

CIS Benchmark Requirements (Section 1.2)

This article covers and implements the following items from the CIS standard:

1.2.1.1 Ensure GPG keys are configured (Manual)
1.2.1.2 Ensure gpgcheck is globally activated (Automated)
1.2.1.3 Ensure repo_gpgcheck is globally activated (Manual)
1.2.1.4 Ensure package manager repositories are configured (Manual)
1.2.2.1 Ensure updates, patches, and additional security software are installed (Manual)

1. Concept & Rationale

Why is digital signing (GPG) important?

To prevent malware installation (Supply Chain Attacks) or tampered packages, the operating system relies on digital signatures (GPG):

gpgcheck: When enabled, the system verifies the package (RPM) signature before installing it.
repo_gpgcheck: In addition to the package itself, this option verifies the repository metadata signatures (repodata files) to prevent connecting to a fake repository.

Enterprise Challenge (Local Repositories / Air-Gapped):

In most organizations, database and infrastructure servers are placed in isolated (air-gapped) networks with no direct internet access. Therefore, system administrators must use a Local Repository (e.g., mounting the OS ISO file, or setting up an internal repository server using Nginx/Apache).

Critical security & operational note: In local repositories, verifying package signatures (gpgcheck=1 and localpkg_gpgcheck=1) is always required and works reliably. However, because repository metadata is typically not signed when creating local repos using tools such as createrepo, enabling repo_gpgcheck=1 often triggers GPG errors during updates. For this reason, in trusted internal networks, this option is intentionally disabled (set to 0) to avoid breaking package installation and updates.

2. Compatibility with Oracle Database (RAC & Grid)

Potential Conflicts:

GPG verification settings do not conflict with Oracle at all. However, the concept of a Local Repository is extremely important for Oracle environments:

Installing Oracle prerequisites (such as oracle-database-preinstall-19c or 23ai) involves many dependencies. Having a properly configured offline local repository makes Oracle installations far more stable and predictable.
System update warning (CIS 1.2.2.1): In Oracle RAC environments, updating core packages (Kernel) or base libraries (e.g., glibc) must not be done while the cluster is running. This must be planned (downtime or rolling where supported) and executed node-by-node (rolling update) according to your change plan.

3. How to Audit the Current Status (Audit Script)

This script checks DNF settings and repository status:

Link to this script on GitHub:

modules/audit_03_Secure_Package_Management.sh

If you are not familiar with Bash scripting, you can refer to the tutorial I have published on the website for DBAs.

Bash for Oracle DBAs

#!/bin/bash
# Script: audit_cis_1_2.sh
# Purpose: Audit DNF settings and Repositories (CIS 1.2)

echo "=========================================================================="
echo " CIS Requirement: 1.2 Package Management"
echo " - Ensure gpgcheck is globally activated (1.2.3)"
echo " - Ensure localpkg_gpgcheck is activated (1.2.4)"
echo " - Ensure no individual repos override gpgcheck=0"
echo " Oracle Context: 'repo_gpgcheck=0' is allowed for air-gapped environments."
echo "=========================================================================="

DNF_CONF="/etc/dnf/dnf.conf"
FAIL_COUNT=0

echo -e "\n[*] Auditing DNF global configurations in $DNF_CONF..."

check_dnf_option() {
local opt=$1
local expected=$2
local val=$(grep "^${opt}=" "$DNF_CONF" | cut -d'=' -f2)

if [ "$val" == "$expected" ]; then
echo -e " \e[32m[PASS]\e[0m $opt is set to $val"
else
echo -e " \e[31m[FAIL]\e[0m $opt is not set to $expected (Current: ${val:-Not Set})"
FAIL_COUNT=$((FAIL_COUNT + 1))
fi
}

check_dnf_option "gpgcheck" "1"
check_dnf_option "localpkg_gpgcheck" "1"
check_dnf_option "repo_gpgcheck" "0"

echo -e "\n[*] Checking Repository Overrides (*.repo)..."
OVERRIDE_COUNT=$(grep -ir '^gpgcheck\s*=\s*0' /etc/yum.repos.d/ 2>/dev/null | wc -l)

if [ "$OVERRIDE_COUNT" -eq 0 ]; then
echo -e " \e[32m[PASS]\e[0m No repositories override gpgcheck to 0."
else
echo -e " \e[31m[FAIL]\e[0m Found repositories overriding gpgcheck to 0:"
grep -ir '^gpgcheck\s*=\s*0' /etc/yum.repos.d/ | sed 's/^/ - /'
FAIL_COUNT=$((FAIL_COUNT + 1))
fi

echo -e "\n[*] Active Repositories:"
dnf repolist enabled 2>/dev/null | awk 'NR>1 {print " - " $0}'

if [ "$FAIL_COUNT" -eq 0 ]; then
echo -e "\n\e[32m[+] AUDIT RESULT: PASS\e[0m"
else
echo -e "\n\e[31m[-] AUDIT RESULT: FAIL ($FAIL_COUNT issues found)\e[0m"
fi

4. How to Apply Settings (Remediation Bash Script)

In addition to enforcing DNF security requirements, this script also creates a standard template for building a Local Repository from an ISO file under the repository directory.

Link to this script on GitHub:

modules/remediate_03_Secure_Package_Management.sh

#!/bin/bash
# Script: remediate_cis_1_2.sh
# Purpose: Harden DNF and Configure Local Repository

if [ "$EUID" -ne 0 ]; then echo "Please run as root"; exit 1; fi

DNF_CONF="/etc/dnf/dnf.conf"
echo -e "\n[+] Applying Remediation for Package Management (CIS 1.2)..."

set_dnf_option() {
local option=$1
local value=$2
if grep -q "^${option}=" "$DNF_CONF"; then
sed -i "s/^${option}=.*/${option}=${value}/" "$DNF_CONF"
else
echo "${option}=${value}" >> "$DNF_CONF"
fi
echo " [+] Set $option=$value in $DNF_CONF"
}

# 1. Global Settings
set_dnf_option "gpgcheck" "1"
set_dnf_option "localpkg_gpgcheck" "1"
set_dnf_option "repo_gpgcheck" "0"

# 2. Fix Repo Overrides (Change gpgcheck=0 to gpgcheck=1 in all .repo files)
echo -e "\n [*] Checking for gpgcheck overrides in repository files..."
if grep -qir '^gpgcheck\s*=\s*0' /etc/yum.repos.d/; then
sed -i 's/^gpgcheck\s*=\s*0/gpgcheck=1/ig' /etc/yum.repos.d/*.repo
echo " [+] Fixed: Changed 'gpgcheck=0' to 'gpgcheck=1' in repository files."
else
echo " [INFO] No repository overrides found."
fi

# 3. Configure Local Repository Template (if not exists)

echo -e "\n[+] Package Management Hardening Completed."

In the next part, we will cover

Configuring and Securing SELinux