I'm considering setting up WSUS on a Server 2008 machine to push updates to my Windows 7 clients. If I do, I'll be following the hardening guidelines issued by MS (such as enabling SSL).
One thing I couldn't seem to find out (and apologies in advance if I have missed the relevant MS documentation!) is how the updates are signed. Obviously, the updates it downloads from MS onto the WSUS server are signed by MS, and verified by the WSUS server (right?) but does the client machine validate the certificate too, or are updates re-signed by the WSUS server for transfer to the client? Surely not, right?
My concern here is that an attacker with root on the WSUS server may be able to easily break in to all the connected machines, by sending a bogus update to them. Is this a valid concern, or does the client perform the same validation of updates as it would when downloading updates directly from Windows Update?
I'm not concerned, in this scenario, about MS's Windows Update key being compromised, and I'm also not concerned about an attacker on the WSUS box preventing updates from being pushed to clients.
Also, the client machines are not joined to an AD domain, if that is relevant. Configuration is done locally on each client.