{
  "id": "CB-UBU-PKG-003",
  "standard": "ubuntu",
  "version": "0.1.2",
  "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-PKG-003",
  "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-PKG-003.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-PKG-003.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-PKG-003",
    "title": "Keep APT signature, freshness and TLS checks enabled",
    "finding": {
      "title": "APT is configured to accept unsigned, weakly signed, outdated or unverified repositories",
      "description": "Global APT options disable the checks that stop a tampered or replayed repository from being used."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "automated",
    "tags": [
      "apt",
      "repositories",
      "signatures",
      "supply-chain"
    ],
    "description": "These APT options, set in `/etc/apt/apt.conf` or `/etc/apt/apt.conf.d/`, weaken the checks APT\nmakes on every repository:\n\n- `Acquire::AllowInsecureRepositories`: use repositories without a signed `Release` file;\n- `Acquire::AllowWeakRepositories`: accept signatures made with weak algorithms (SHA-1);\n- `Acquire::AllowDowngradeToInsecureRepositories`: accept a repository that was signed and no\n  longer is;\n- `APT::Get::AllowUnauthenticated`: install packages that cannot be authenticated;\n- `Acquire::Check-Date` and `Acquire::Check-Valid-Until` set to false: accept `Release` files\n  dated in the future or past their expiry date;\n- `Acquire::https::Verify-Peer` and `Acquire::https::Verify-Host` set to false, globally or for\n  one host: accept any TLS certificate.\n\nAPT's defaults are safe, and Ubuntu sets the first three options to `0` explicitly; the\ncontrol checks that nothing overrides them.\n",
    "rationale": "Signature checks are what make a compromised mirror or network harmless. With them disabled, or\nwith expired metadata accepted, an attacker can install arbitrary packages as root, or replay old\nsigned metadata so that known vulnerable versions stay installed.\n",
    "impact": "None for the Ubuntu archive. A repository that only works with one of these options must be\nfixed (signed, given a valid date or certificate) or removed.\n",
    "setting": {
      "location": "/etc/apt/apt.conf, /etc/apt/apt.conf.d/",
      "default_value": "All checks enabled",
      "recommended_value": "All checks enabled, written explicitly in /etc/apt/apt.conf.d/99cirsec-apt-security"
    },
    "audit": {
      "manual": "Run `apt-config dump` and check that it shows none of:\n`Acquire::AllowInsecureRepositories`, `Acquire::AllowWeakRepositories`,\n`Acquire::AllowDowngradeToInsecureRepositories` or `APT::Get::AllowUnauthenticated` set to\n`1`/`true`/`yes`, nor `Acquire::Check-Date`, `Acquire::Check-Valid-Until`,\n`Acquire::https::Verify-Peer` or `Acquire::https::Verify-Host` (also under\n`Acquire::https::<host>::`) set to `0`/`false`/`no`.\n",
      "checks": [
        {
          "id": "options",
          "engine": "shell",
          "description": "Effective APT configuration, as merged by apt-config.",
          "spec": {
            "script": "o=$(apt-config dump 2>/dev/null) || { echo \"apt-config failed\"; exit 3; }\np='^(Binary::[^:]+::)?'\nbad=$(printf '%s\\n' \"$o\" | grep -Ei \"$p(Acquire::(AllowInsecureRepositories|AllowWeakRepositories|AllowDowngradeToInsecureRepositories)|APT::Get::AllowUnauthenticated) \\\"(1|true|yes|on)\\\"\";\n      printf '%s\\n' \"$o\" | grep -Ei \"$p\"\"Acquire::(Check-Date|Check-Valid-Until|https(::[^ ]+)?::Verify-(Peer|Host)) \\\"(0|false|no|off)\\\"\")\nif [ -n \"$bad\" ]; then\n  printf '%s\\n' \"$bad\"\n  exit 1\nfi\necho \"no option disables signature, date or TLS checks\"\n"
          }
        }
      ]
    },
    "remediation": {
      "manual": "1. Find where each option is set with `grep -riE 'Allow(Insecure|Weak|DowngradeToInsecure|Unauthenticated)|Check-(Date|Valid-Until)|Verify-(Peer|Host)' /etc/apt/apt.conf /etc/apt/apt.conf.d/`.\n2. Remove those lines.\n3. Optionally, write the safe values explicitly in `/etc/apt/apt.conf.d/99cirsec-apt-security`,\n   which is read after the other files of the directory. `/etc/apt/apt.conf` is read last and\n   wins over it.\n4. Run `apt-get update` and check that it prints no error.\n\nThe automated fix writes `99cirsec-apt-security` and comments out the offending lines of\n`/etc/apt/apt.conf`. Host-specific `Verify-Peer`/`Verify-Host` lines must be removed by hand.\n",
      "effects": {
        "restart": "none",
        "disruption": "low",
        "lockout_risk": false
      },
      "rollback": "Remove `/etc/apt/apt.conf.d/99cirsec-apt-security` and restore `/etc/apt/apt.conf` from the\nbackup directory printed by `remediate.sh`.\n",
      "scripts": [
        {
          "id": "options",
          "engine": "shell",
          "content": "f=/etc/apt/apt.conf\nif [ -f \"$f\" ] && grep -Eqi '^[^#]*(Allow(Insecure|Weak|DowngradeToInsecure)Repositories|AllowUnauthenticated|Check-(Date|Valid-Until)|Verify-(Peer|Host))' \"$f\"; then\n  cb_backup \"$f\"\n  sed -E -i 's/^([^#]*(Allow(Insecure|Weak|DowngradeToInsecure)Repositories|AllowUnauthenticated|Check-(Date|Valid-Until)|Verify-(Peer|Host)))/# disabled by CB-UBU-PKG-003: \\1/I' \"$f\"\nfi\nf=/etc/apt/apt.conf.d/99cirsec-apt-security\ncb_backup \"$f\"\ncat >\"$f\" <<'EOF'\n// CB-UBU-PKG-003: keep APT signature, freshness and TLS checks enabled.\nAcquire::AllowInsecureRepositories \"false\";\nAcquire::AllowWeakRepositories \"false\";\nAcquire::AllowDowngradeToInsecureRepositories \"false\";\nAPT::Get::AllowUnauthenticated \"false\";\nAcquire::Check-Date \"true\";\nAcquire::Check-Valid-Until \"true\";\nAcquire::https::Verify-Peer \"true\";\nAcquire::https::Verify-Host \"true\";\nEOF\n"
        }
      ]
    },
    "references": [
      {
        "title": "apt.conf(5), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man5/apt.conf.5.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "apt-secure(8), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man8/apt-secure.8.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "apt-transport-https(1), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man1/apt-transport-https.1.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-linux",
        "framework_version": "2.0",
        "id": "R59",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-7",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1195.002"
      },
      {
        "framework": "cwe",
        "id": "CWE-494"
      },
      {
        "framework": "cwe",
        "id": "CWE-295"
      }
    ],
    "related_controls": [
      {
        "id": "CB-UBU-PKG-001",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic",
        "notes": "Passes on stock; AllowInsecureRepositories in apt.conf and per-host Verify-Peer false detected; fix writes 99cirsec-apt-security and comments apt.conf, apt-get update works."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic",
        "notes": "Passes on stock; AllowInsecureRepositories in apt.conf and per-host Verify-Peer false detected; fix writes 99cirsec-apt-security and comments apt.conf, apt-get update works."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic",
        "notes": "Passes on stock; AllowInsecureRepositories in apt.conf and per-host Verify-Peer false detected; fix writes 99cirsec-apt-security and comments apt.conf, apt-get update works."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic",
        "notes": "Passes on stock; AllowInsecureRepositories in apt.conf and per-host Verify-Peer false detected; fix writes 99cirsec-apt-security and comments apt.conf, apt-get update works."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}