Detections
Analytics

6.2.1 Ensure at is restricted to authorized users

Information

at allows fairly complex time specifications, extending the POSIX.2 standard. It accepts times of the form HH:MM to run a job at a specific time of day. (If that time is already past, the next day is assumed.) You may also specify midnight, noon, or teatime (4pm) and you can have a time-of-day suffixed with AM or PM for running in the morning or the evening. You can also say what day the job will be run, by giving a date in the form month-name day with an optional year, or giving a date of the form MMDD[CC]YY, MM/DD/[CC]YY, DD.MM.[CC]YY or [CC]YY-MM-DD. The specification of a date must follow the specification of the time of day. You can also give times like now + count time-units, where the time-units can be minutes, hours, days, or weeks and you can tell at to run the job today by suffixing the time with today and to run the job tomorrow by suffixing the time with tomorrow.

The /var/adm/cron/at.allow and /var/adm/cron/at.deny files determine which user can submit commands for later execution via at or batch. The format of the files is a list of usernames, one on each line. Whitespace is not permitted. If the file /var/adm/cron/at.allow exists, only usernames mentioned in it are allowed to use at. If /var/adm/cron/at.allow does not exist, /var/adm/cron/at.deny is checked, every username not mentioned in it is then allowed to use at. An empty /var/adm/cron/at.deny means that every user may use at.

An attacker may exploit use of the at to execute programs or processes automatically. Limiting access to at to authorised users reduces this risk.

It is easier to manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files.

Solution

Remove /var/adm/cron/at.deny if it exists:

# /usr/bin/rm /var/adm/cron/at.deny

IF /var/adm/cron/at.allow does not exist, create the file:

# print "root\nadm" > /var/adm/cron/at.allow

IF /var/adm/cron/at.allow already exists, ensure that it contains at least the root and adm users.

Impact:

Any user(s), including the root user, not listed within at.allow will not be permitted to execute tasks via at.

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: cbc77816b7858cd9d5f0a19c12ef9f081117f9af1fd4d48e16686e6a885e0884