Detections
Analytics

UBTU-22-654041 - Ubuntu 22.04 LTS must audit any script or executable called by cron as root or by any privileged user.

Information

Any script or executable called by cron as root or by any privileged user must be owned by that user, must have the permissions 755 or more restrictive, and should have no extended rights that allow any nonprivileged user to modify the script or executable.

Solution

Configure Ubuntu 22.04 LTS to audit the execution of any system call made by cron as root or as any privileged user.

Add or update the following file system rules to "/etc/audit/rules.d/audit.rules":
-w /etc/cron.d/ -p wa -k cronjobs
-w /var/spool/cron/ -p wa -k cronjobs

To load the rules to the kernel immediately, use the following command:

$ sudo augenrules --load

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_CAN_Ubuntu_22-04_LTS_V2R8_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12c., CAT|II, CCI|CCI-000172, Rule-ID|SV-274862r1155211_rule, STIG-ID|UBTU-22-654041, Vuln-ID|V-274862

Plugin: Unix

Control ID: 2f40478c95da3ea8dbbe4ec81794cbc6a943496fd39a8e814f7fa2b1cafc1702