BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

RHEL-09-215035 RHEL 9 must not install packages from the Extra Packages for Enterprise Linux (EPEL) repository.

DISA STIG library V2R10
All changes in this version
first version loaded CAT II

Maps to CM-7 via CCI-000381

Title

RHEL 9 must not install packages from the Extra Packages for Enterprise Linux (EPEL) repository.

Control

Verify that RHEL 9 is not able to install packages from the EPEL with the following command: $ dnf repolist rhel-9-for-x86_64-appstream-rpms Red Hat Enterprise Linux 9 for x86_64 - AppStream (RPMs) rhel-9-for-x86_64-baseos-rpms Red Hat Enterprise Linux 9 for x86_64 - BaseOS (RPMs) If any repositories containing the word "epel" in the name exist, this is a finding.

Discussion

The EPEL is a repository of high-quality open-source packages for enterprise-class Linux distributions such as RHEL, CentOS, AlmaLinux, Rocky Linux, and Oracle Linux. These packages are not part of the official distribution but are built using the same Fedora build system to ensure compatibility and maintain quality standards.

Related controls

CCI-000381

Fix

The repo package can be manually removed with the following command: $ sudo dnf remove epel-release Configure the operating system to disable use of the EPEL repository with the following command: $ sudo dnf config-manager --set-disabled epel