Detections
Analytics

1.414 OL09-00-005010

Information

OL 9 must use cron logging.

GROUP ID: V-271853
RULE ID: SV-271853r1092271

Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used to spot intrusions into the use of the cron facility by unauthorized and malicious users.

Solution

Configure "rsyslog" to log all cron messages by adding or updating the following line to "/etc/rsyslog.conf" or a configuration file in the /etc/rsyslog.d/ directory:

cron.* /var/log/cron

The rsyslog daemon must be restarted for the changes to take effect:

$ sudo systemctl restart rsyslog.service

See Also

https://workbench.cisecurity.org/benchmarks/27024

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CCI|CCI-000366, Rule-ID|SV-271853r1092271_rule, STIG-ID|OL09-00-005010, Vuln-ID|V-271853

Plugin: Unix

Control ID: ce84c185eb77ee4fbe56845ce0febb74af0271b7e6b470e8e75c4f8615a63a58