@test "Verify APT AllowUnauthenticated" {
run bash -c "grep '^APT::Get::AllowUnauthenticated \"false\";$' /etc/apt/apt.conf.d/*"
[ "$status" -eq 0 ]
}Ensure APT do not allow AllowUnauthenticated
Description
Allowing unauthenticated repositories ignores if packages can’t be authenticated and don’t prompt about it.
Rationale
If authenticity isn’t ensured in another way by the user itself, it is a security risk.
Audit
Remediation
shell
if ! grep '^APT::Get::AllowUnauthenticated' /etc/apt/apt.conf.d/* ; then
echo 'APT::Get::AllowUnauthenticated "false";' >> /etc/apt/apt.conf.d/01-vendor-ubuntu
else
sed -i 's/.*APT::Get::AllowUnauthenticated.*/APT::Get::AllowUnauthenticated "false";/g' "$(grep -l 'APT::Get::AllowUnauthenticated' /etc/apt/apt.conf.d/*)"
fiAnsible
---
- name: configure apt
become: 'yes'
become_method: sudo
lineinfile:
dest: /etc/apt/apt.conf.d/98apt-conf
mode: 0644
state: present
create: 'yes'
line: ""
with_items:
- 'APT::Get::AllowUnauthenticated "false";'
when: ansible_os_family == "Debian"
tags:
- apt
- security
...