5.1.8 Ensure cron is restricted to authorized users - cron.allow

Information

If cron is installed in the system, configure /etc/cron.allow to allow specific users to use these services. If /etc/cron.allow does not exist, then /etc/cron.deny is checked. Any user not specifically defined in those files is allowed to use cron. By removing the file, only users in /etc/cron.allow are allowed to use cron.

Note: Even though a given user is not listed in cron.allow, cron jobs can still be run as that user. The cron.allow file only controls administrative access to the crontab command for scheduling and modifying cron jobs.

Rationale:

On many systems, only the system administrator is authorized to schedule cron jobs. Using the cron.allow file to control who can run cron jobs enforces this policy. It is easier to manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files.

Solution

Run the following command to remove /etc/cron.deny:

# rm /etc/cron.deny

Run the following command to create /etc/cron.allow

# touch /etc/cron.allow

Run the following commands to set the owner and permissions on /etc/cron.allow:

# chown root:root /etc/cron.allow

# chmod u-x,og-rwx /etc/cron.allow

OR
Run the following command to remove cron

# yum remove cronie

See Also

https://workbench.cisecurity.org/files/2925