Detections
Analytics

4.1.2.8 Ensure access on /var/spool/cron/crontabs is configured

Information

The /var/spool/cron/crontabs directory contains all of the crontabs for the users on the system.

The /var/spool/cron/crontabs directory contains all of the crontabs for the users on the system. Crontab files present a security problem because they are run by the cron daemon, which runs with super user rights. Allowing other users to have read/write permissions on these files may allow them to escalate their privileges. To negate this risk, the directory and all the files that it contains must be secured.

Solution

Use the following script to apply settings to /var/spool/cron/crontabs :

#!/usr/bin/ksh -e
#; remove any extended ACL information
echo | aclput /var/spool/cron/crontabs

#; remove other access from all
chmod -R o= /var/spool/cron/crontabs
#; set UID:GID to bin:cron to `/var/spool/cron/crontabs` and correct modes on directory and files within directory
chown bin:cron /var/spool/cron/crontabs
chgrp -R cron /var/spool/cron/crontabs
#; set modes on directory and files within directory
chmod ug=rwx,o= /var/spool/cron/crontabs
chmod a-w /var/spool/cron/crontabs

#; add or update entry in TCB
trustchk -a /var/spool/cron/crontabs size=VOLATILE >/dev/null 2>&1 || trustchk -u /var/spool/cron/crontabs owner=bin group=cron mode=770

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

References: 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-9, 800-53|SA-3, 800-53|SA-8, 800-53|SA-10, CSCv7|5.1

Plugin: Unix

Control ID: d3647265e2cb86d6d9ae2a0ab04f4ddb6a38ec1f12e46a6258a625cf7aa64fbd