Detections
Analytics

1.391 OL09-00-002584

Information

OL 9 must audit any script or executable called by cron as root or by any privileged user.

GROUP ID: V-278952
RULE ID: SV-278952r1135407

Any script or executable called by cron as root or by any privileged user must be owned by that user, must have the permissions 0755 or more restrictive, and should have no extended rights that allow any nonprivileged user to modify the script or executable.

Solution

Configure OL 9 to audit the execution of any system call made by cron as root or as any privileged user.

Add or update the following file system rules to "/etc/audit/rules.d/audit.rules":

auditctl -w /etc/cron.d/ -p wa -k cronjobs
auditctl -w /var/spool/cron/ -p wa -k cronjobs

To load the rules to the kernel immediately, use the following command:

$ sudo augenrules --load

See Also

https://workbench.cisecurity.org/benchmarks/27024

Item Details

Category: AUDIT AND ACCOUNTABILITY, MAINTENANCE

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-12a., 800-53|AU-12c., 800-53|MA-4(1), CCI|CCI-000130, CCI|CCI-000135, CCI|CCI-000169, CCI|CCI-000172, CCI|CCI-002884, Rule-ID|SV-278952r1135407_rule, STIG-ID|OL09-00-002584, Vuln-ID|V-278952

Plugin: Unix

Control ID: c280712921ff186e5eeac8c5a63b239c6b3e6628941d2ef79fba5ad6a72859e9