Keep APT signature, freshness and TLS checks enabled

Description

These APT options, set in /etc/apt/apt.conf or /etc/apt/apt.conf.d/, weaken the checks APT makes on every repository:

• Acquire::AllowInsecureRepositories: use repositories without a signed Release file;
• Acquire::AllowWeakRepositories: accept signatures made with weak algorithms (SHA-1);
• Acquire::AllowDowngradeToInsecureRepositories: accept a repository that was signed and no longer is;
• APT::Get::AllowUnauthenticated: install packages that cannot be authenticated;
• Acquire::Check-Date and Acquire::Check-Valid-Until set to false: accept Release files dated in the future or past their expiry date;
• Acquire::https::Verify-Peer and Acquire::https::Verify-Host set to false, globally or for one host: accept any TLS certificate.

APT's defaults are safe; the control checks that nothing overrides them.

Rationale

Signature checks are what make a compromised mirror or network harmless. With them disabled, or with expired metadata accepted, an attacker can install arbitrary packages as root, or replay old signed metadata so that known vulnerable versions stay installed.

Impact

None for the Debian archive. A repository that only works with one of these options must be fixed (signed, given a valid date or certificate) or removed.

Setting

Audit

Run apt-config dump and check that it shows none of: Acquire::AllowInsecureRepositories, Acquire::AllowWeakRepositories, Acquire::AllowDowngradeToInsecureRepositories or APT::Get::AllowUnauthenticated set to 1/true/yes, nor Acquire::Check-Date, Acquire::Check-Valid-Until, Acquire::https::Verify-Peer or Acquire::https::Verify-Host (also under Acquire::https::<host>::) set to 0/false/no.

Automated: every check must pass. Scanners report each check by its id.

options

Effective APT configuration, as merged by apt-config.

script: |
  o=$(apt-config dump 2>/dev/null) || { echo "apt-config failed"; exit 3; }
  p='^(Binary::[^:]+::)?'
  bad=$(printf '%s\n' "$o" | grep -Ei "$p(Acquire::(AllowInsecureRepositories|AllowWeakRepositories|AllowDowngradeToInsecureRepositories)|APT::Get::AllowUnauthenticated) \"(1|true|yes|on)\"";
        printf '%s\n' "$o" | grep -Ei "$p""Acquire::(Check-Date|Check-Valid-Until|https(::[^ ]+)?::Verify-(Peer|Host)) \"(0|false|no|off)\"")
  if [ -n "$bad" ]; then
    printf '%s\n' "$bad"
    exit 1
  fi
  echo "no option disables signature, date or TLS checks"

Remediation

1. Find where each option is set with grep -riE 'Allow(Insecure|Weak|DowngradeToInsecure|Unauthenticated)|Check-(Date|Valid-Until)|Verify-(Peer|Host)' /etc/apt/apt.conf /etc/apt/apt.conf.d/.
2. Remove those lines.
3. Optionally, write the safe values explicitly in /etc/apt/apt.conf.d/99cirsec-apt-security, which is read after the other files of the directory. /etc/apt/apt.conf is read last and wins over it.
4. Run apt-get update and check that it prints no error.

The automated fix writes 99cirsec-apt-security and comments out the offending lines of /etc/apt/apt.conf. Host-specific Verify-Peer/Verify-Host lines must be removed by hand.

Rollback

Remove /etc/apt/apt.conf.d/99cirsec-apt-security and restore /etc/apt/apt.conf from the backup directory printed by remediate.sh.

options

f=/etc/apt/apt.conf
if [ -f "$f" ] && grep -Eqi '^[^#]*(Allow(Insecure|Weak|DowngradeToInsecure)Repositories|AllowUnauthenticated|Check-(Date|Valid-Until)|Verify-(Peer|Host))' "$f"; then
  cb_backup "$f"
  sed -E -i 's/^([^#]*(Allow(Insecure|Weak|DowngradeToInsecure)Repositories|AllowUnauthenticated|Check-(Date|Valid-Until)|Verify-(Peer|Host)))/# disabled by CB-DEB-PKG-003: \1/I' "$f"
fi
f=/etc/apt/apt.conf.d/99cirsec-apt-security
cb_backup "$f"
cat >"$f" <<'EOF'
// CB-DEB-PKG-003: keep APT signature, freshness and TLS checks enabled.
Acquire::AllowInsecureRepositories "false";
Acquire::AllowWeakRepositories "false";
Acquire::AllowDowngradeToInsecureRepositories "false";
APT::Get::AllowUnauthenticated "false";
Acquire::Check-Date "true";
Acquire::Check-Valid-Until "true";
Acquire::https::Verify-Peer "true";
Acquire::https::Verify-Host "true";
EOF

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• apt.conf(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• apt-secure(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• apt-transport-https(1), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-PKG-001 Bind every APT repository to its signing key

People and lifecycle