Detections
Analytics

OL08-00-030645 - OL 8 must audit any script or executable called by cron as root or by any privileged user.

Information

Any script or executable called by cron as root or by any privileged user must be owned by that user and must have the permissions 755 or more restrictive and should have no extended rights that allow any nonprivileged user to modify the script or executable.

Solution

Configure OL 8 to audit the execution of any system call made by cron as root or as any privileged user.

Add or update the following file system rules to "/etc/audit/rules.d/audit.rules":
-w /etc/cron.d/ -p wa -k cronjobs
-w /var/spool/cron/ -p wa -k cronjobs

To load the rules to the kernel immediately, use the following command:

$ sudo augenrules --load

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_8_V2R8_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12c., CAT|II, CCI|CCI-000172, Rule-ID|SV-274876r1156668_rule, STIG-ID|OL08-00-030645, Vuln-ID|V-274876

Plugin: Unix

Control ID: e440e14d0f5dcddf6070192ab264f5b71c252fb4813b5bb5ba08b7edea17aca8