Detections
Analytics

2.4.1.7 Ensure access to /etc/cron.yearly is configured

Information

The /etc/cron.yearly directory contains system cron jobs that run on an annual basis. Files in this directory are edited directly by system administrators rather than through the crontab command. The commands below restrict read, write, and search access to root only, preventing regular users from accessing this directory.

Granting write access to /etc/cron.yearly for non-privileged users would allow them to introduce arbitrary commands that run annually as root, providing a path to unauthorized privilege escalation. Granting read access would expose the contents of scheduled jobs, potentially revealing sensitive system information or attack opportunities.

Solution

- IF - cron is installed on the system:

Run the following commands to set ownership and permissions on the /etc/cron.yearly directory:

# chown root:root /etc/cron.yearly/
# chmod og-rwx /etc/cron.yearly/

See Also

https://workbench.cisecurity.org/benchmarks/27798

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 06ffda62e7bc8b9f43d787dfcf3a820f9fcc9e50da30ec6c2d77801f7483d813