Detections
Analytics

6.2.2 Ensure access to crontab is configured

Information

crontab is the program used to install, deinstall, list or execute the tables used to drive the cron daemon. Each user can have their own crontab, and though files are created, they are not intended to be edited directly.

If the /var/adm/cron/cron.allow file exists, then you must be listed (one user per line) therein in order to be allowed to use this command. If the /var/adm/cron/cron.allow file does not exist but the /var/adm/cron/cron.deny file does exist, then you must not be listed in the /var/adm/cron/cron.deny file in order to use this command.

If neither of these files exists, then depending on site-dependent configuration parameters, only the super user will be allowed to use this command, or all users will be able to use this command.

If both files exist then /var/adm/cron/cron.allow takes precedence. Which means that /var/adm/cron/cron.deny is not considered and your user must be listed in /var/adm/cron/cron.allow in order to be able to use the crontab.

An attacker may exploit use of the crontab to execute programs or processes automatically. Limiting access to crontab to authorised users reduces this risk.

It is easier to manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files.

Solution

Remove /var/adm/cron/cron.deny if it exists:

# /usr/bin/rm /var/adm/cron/cron.deny

IF /var/adm/cron/cron.allow does not exist, create the file:

# print "root\nadm" > /var/adm/cron/cron.allow

IF /var/adm/cron/cron.allow already exists, ensure that it contains at least the root and adm users.

Impact:

Any user(s), including the root user, not listed within cron.allow will not be permitted to execute tasks via cron.

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 566446b20a44af6df7436ef3c16044be8884e1d13d8388be19b2f63c9204779e