Detections
Analytics

1.63 RHEL-10-200648

Information

RHEL 10 must use cron logging.

GROUP ID: V-280991RULE ID: SV-280991r1165328

Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used to spot intrusions into the use of the cron facility by unauthorized and malicious users.

Solution

Configure RHEL 10 rsyslog to log all cron messages by adding or updating the following line to "/etc/rsyslog.conf" or a configuration file in the "/etc/rsyslog.d/" directory:

cron.* /var/log/cron

Restart the rsyslog daemon with the following command for the changes to take effect:

$ sudo systemctl restart rsyslog.service

See Also

https://workbench.cisecurity.org/benchmarks/26403

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, CAT|II, CCI|CCI-000133, Rule-ID|SV-280991r1165328_rule, STIG-ID|RHEL-10-200648, Vuln-ID|V-280991

Plugin: Unix

Control ID: a16d42ad13f864e31180d6f7e15c2cef0faa1126c29e5a2990edeb4cdd7df9b4