Detections
Analytics

4.1.2.9 Ensure access on /var/spool/cron/atjobs is configured

Information

The /var/spool/cron/atjobs directory contains scripts submitted by authorized users using the command at.

The /var/spool/cron/atjobs directory contains all of the at jobs for the users on the system. Atjob files present a security problem because they are run using SUID and SGID of the user who submits the job.

Allowing other users to have read/write permissions on these files may allow them to escalate their privileges to that user and/or group.

To negate this risk, the directory and all the files that it contains must be secured.

Solution

Use the following script to apply settings to /var/spool/cron/atjobs :

#!/usr/bin/ksh
#; remove any extended ACL information
echo | aclput /var/spool/cron/atjobs

#; remove other access from all
chmod -R o= /var/spool/cron/atjobs
#; set UID:GID to bin:cron to `/var/spool/cron/atjobs` and correct modes on directory
chown bin:cron /var/spool/cron/atjobs

#; remove world access on directory and files within directory
chmod -R o= /var/spool/cron/atjobs

#; add or update entry in TCB
trustchk -a /var/spool/cron/atjobs size=VOLATILE >/dev/null 2>&1 || trustchk -u /var/spool/cron/atjobs owner=bin group=cron mode=770

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

References: 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-9, 800-53|SA-3, 800-53|SA-8, 800-53|SA-10, CSCv7|5.1

Plugin: Unix

Control ID: 68a9e37e582984e9c61a5b8b37c4512843f48bca97ea1873714d9f8b23c7a199