0

I ran yum update on a newly built machine.

  • Why does it ask to accept keys?
  • Is it safe to accept the keys?
base/7/x86_64/signature                                                                                             |  811 B  00:00:00     
Retrieving key from file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
Importing GPG key 0xF4A80EB5:
 Userid     : "CentOS-7 Key (CentOS 7 Official Signing Key) <security@centos.org>"
 Fingerprint: 6341 ab27 53d7 8a78 a7c2 7bb1 24c6 a8a7 f4a8 0eb5
 Package    : centos-release-7-6.1810.2.el7.centos.x86_64 (@anaconda)
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
Is this ok [y/N]: y

Note, I did change the /etc/yum.repos.d/CentOS-Base.repo added base URL to a near by public (ISP) repo.

I also change the /etc/yum.conf and added/modified the following:

repo_gpgcheck=1
payload_gpgcheck=1
plugins=0
0

The reason yum ask is because you do not have installed this key on your machine. This will happen on every new machine. You can switch it off by changing:

repo_gpgcheck=0

You can trust those keys if the fingerprint match with one of those here

  • Thanks. Since posting the question I have already checked them and they match. I was surprised that it doesn't come installed already. In other words why doesn't in come with the install media (I did use the minimal version). I am used to other distros where AFAIK is key is installed at install time. – NewCentOSuser Mar 5 at 8:45
  • @NewCentOSuser, from security point of view its wise to do not put them together. If someone alter some package and sign it with own key and add this key you will not be able to recognize it and do not install it – Romeo Ninov Mar 5 at 8:51
  • Makes sense now that you have explained it. It seems the Centos approach seems like a better one as you are force to accept it and it displays the fingerprint. I suppose you can tamper with the display code too, but at least it makes you think about it. – NewCentOSuser Mar 5 at 11:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.