Detections
Analytics

1.409 RHEL-09-654095

Information

RHEL 9 must audit all uses of the crontab command.

GROUP ID: V-258193
RULE ID: SV-258193r1045364

Solution

Configure RHEL 9 to generate audit records upon successful/unsuccessful attempts to use the "crontab" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules":

-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-crontab

To load the rules to the kernel immediately, use the following command:

$ sudo augenrules --load

See Also

https://workbench.cisecurity.org/benchmarks/22008

Item Details

Category: AUDIT AND ACCOUNTABILITY, MAINTENANCE

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-12a., 800-53|AU-12c., 800-53|MA-4(1), CAT|II, CCI|CCI-000130, CCI|CCI-000135, CCI|CCI-000169, CCI|CCI-000172, CCI|CCI-002884, Rule-ID|SV-258193r1045364_rule, STIG-ID|RHEL-09-654095, Vuln-ID|V-258193

Plugin: Unix

Control ID: 699087a00cbb66bd3bed48beeb5cf37e0bbeb3c1fe8524c461425f992ea3f2c9