Detections
Analytics

RHEL-10-200648 - RHEL 10 must use cron logging.

Information

Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used to spot intrusions into the use of the cron facility by unauthorized and malicious users.

Solution

Configure RHEL 10 rsyslog to log all cron messages by adding or updating the following line to "/etc/rsyslog.conf" or a configuration file in the "/etc/rsyslog.d/" directory:

cron.* /var/log/cron

Restart the rsyslog daemon with the following command for the changes to take effect:

$ sudo systemctl restart rsyslog.service

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_10_V1R1_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, CAT|II, CCI|CCI-000133, Rule-ID|SV-280991r1165328_rule, STIG-ID|RHEL-10-200648, Vuln-ID|V-280991

Plugin: Unix

Control ID: 54a387b741266b2accebc2136ae38a61ba41841f1ac5fe9a4919b5d3044ef24e