RHEL UBI8.6-FIPS环境下yum无法找到AIDE包的安装求助

核心诉求 #

希望通过包管理器安装AIDE，但yum无法找到对应RPM包

系统环境 #

运行在符合DISA-STIG标准且启用FIPS的Ubuntu 20.04主机上的RHEL UBI8.6-FIPS Docker镜像/容器，已启用AppStream仓库

个人背景 #

日常使用Ubuntu，对RHEL不熟悉，若有疏漏敬请指出

操作步骤 #

我遵循《RHEL安全加固手册》和DISA-STIG检查清单操作，通过清单确认AIDE应存在于AppStream仓库中

1. 确认AppStream已启用：

[root@a1100622ac26 aide-0.17.4]# yum repolist
repo id                                                                repo name
ubi-8-appstream-rpms                                                   Red Hat Universal Base Image 8 (RPMs) - AppStream
ubi-8-baseos-rpms                                                      Red Hat Universal Base Image 8 (RPMs) - BaseOS
ubi-8-codeready-builder-rpms                                           Red Hat Universal Base Image 8 (RPMs) - CodeReady Builder

2. 检查yum仓库URI是否正确：

[root@a1100622ac26 scripts]# cat /etc/yum.repos.d/ubi.repo 
[ubi-8-baseos-rpms]
name = Red Hat Universal Base Image 8 (RPMs) - BaseOS
baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi8/8/$basearch/baseos/os
enabled = 1
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
gpgcheck = 1

[ubi-8-baseos-debug-rpms]
name = Red Hat Universal Base Image 8 (Debug RPMs) - BaseOS
baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi8/8/$basearch/baseos/debug
enabled = 0
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
gpgcheck = 1

[ubi-8-baseos-source]
name = Red Hat Universal Base Image 8 (Source RPMs) - BaseOS
baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi8/8/$basearch/baseos/source/SRPMS
enabled = 0
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
gpgcheck = 1

[ubi-8-appstream-rpms]
name = Red Hat Universal Base Image 8 (RPMs) - AppStream
baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi8/8/$basearch/appstream/os
enabled = 1
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
gpgcheck = 1

[ubi-8-appstream-debug-rpms]
name = Red Hat Universal Base Image 8 (Debug RPMs) - AppStream
baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi8/8/$basearch/appstream/debug
enabled = 0
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
gpgcheck = 1

[ubi-8-appstream-source]
name = Red Hat Universal Base Image 8 (Source RPMs) - AppStream
baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi8/8/$basearch/appstream/source/SRPMS
enabled = 0
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
gpgcheck = 1

[ubi-8-codeready-builder-rpms]
name = Red Hat Universal Base Image 8 (RPMs) - CodeReady Builder
baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi8/8/$basearch/codeready-builder/os
enabled = 1
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
gpgcheck = 1

[ubi-8-codeready-builder]
name = Red Hat Universal Base Image 8 (RPMs) - CodeReady Builder
baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi8/8/$basearch/codeready-builder/os
enabled = 0
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
gpgcheck = 1


[ubi-8-codeready-builder-debug-rpms]
name = Red Hat Universal Base Image 8 (Debug RPMs) - CodeReady Builder
baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi8/8/$basearch/codeready-builder/debug
enabled = 0
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
gpgcheck = 1

[ubi-8-codeready-builder-source]
name = Red Hat Universal Base Image 8 (Source RPMs) - CodeReady Builder
baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi8/8/$basearch/codeready-builder/source/SRPMS
enabled = 0
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
gpgcheck = 1

3. 更新yum：

[root@a1100622ac26 scripts]# yum update
Red Hat Universal Base Image 8 (RPMs) - BaseOS                                                                                            4.9 kB/s | 3.8 kB     00:00    
Red Hat Universal Base Image 8 (RPMs) - AppStream                                                                                         2.2 MB/s | 3.2 MB     00:01    
Red Hat Universal Base Image 8 (RPMs) - CodeReady Builder                                                                                 5.6 kB/s | 3.8 kB     00:00    
Dependencies resolved.
Nothing to do.
Complete!

4. 尝试安装AIDE：

[root@a1100622ac26 aide-0.17.4]# yum install aide
Last metadata expiration check: 0:48:42 ago on Wed Jan 25 08:01:40 2023.
No match for argument: aide
Error: Unable to find a match: aide

5. 通过浏览器访问AppStream URI手动查找AIDE的RPM包，未找到对应包
6. AIDE官网说明应通过AppStream使用yum安装

请求解决 #

由于依赖问题，不想手动安装AIDE，且需在Dockerfile中执行安装，优先使用包管理器。同时DISA-STIG要求使用可信源并通过包管理器更新，恳请提供解决建议。

内容的提问来源于stack exchange，提问作者Craig Opie