[CentOS] yum/RPM and Trust on First Use

Ned Slider
2015-12-20T12:26:14Z

On 20/12/15 10:28, Gordon Messmer wrote:
> On 12/19/2015 09:49 AM, Alice Wonder wrote:
>>
>> With third party repositories the key and configuration file is often
>> distributed separately. That's the potential attack vector for
trojan
>> keys.
>
> Examples?
>
> All of the notable repositories that I'm aware of publish an
> x-release.rpm that installs their key and yum repo file.  But if your
> concern is that users might manually install a repo file and public key,
> then I don't see how modifying yum would change that. The attacker
would
> probably include a key that contains an address they control and
> validates properly against it.
>
> In other words, I think the solution to the problem is simply to make
> sure that the repositories publish their "release" rpm over https
and
> that documentation reflects the secure URL.  I notice now that EPEL
> links directly to the https URL for their release rpm, but their FAQ
> still provides a command-line example for installation using an http URL.
>
> The FAQ should be updated.  That method is a potential security problem
> because it doesn't use https and doesn't check the package
signature.
> But the solution is simply to replace http with https in the FAQ.  yum
> isn't used to install the release package, and I think the solution is
> to make sure that malicious release packages don't get installed, not
to
> try to behave well on a system where an attacker already installed
> malicious data.
>

Unless I'm mistaken RPM in el5 does not support the https protocol.