RHEL-08-030655 - RHEL 8 must audit any script or executable called by cron as root or by any privileged user.

Information

Any script or executable called by cron as root or by any privileged user must be owned by that user, must have the permissions set to 755 or more restrictive, and have no extended rights that allow a nonprivileged user to modify the script or executable.

Solution

Configure RHEL 8 to audit the execution of any system call made by cron as root or as any privileged user.

Add or update the following file system rules to "/etc/audit/rules.d/audit.rules":
-w /etc/cron.d/ -p wa -k cronjobs
-w /var/spool/cron/ -p wa -k cronjobs

To load the rules to the kernel immediately, use the following command:

$ sudo augenrules --load

Item Details

Audit Name: DISA Red Hat Enterprise Linux 8 STIG v2r7

Category: AUDIT AND ACCOUNTABILITY

Plugin: Unix

Control ID: 80c3db58f4fac14b43cb08d32477810ba23b742f625e3a443e86574478408563

Detections

Analytics

RHEL-08-030655 - RHEL 8 must audit any script or executable called by cron as root or by any privileged user.

Information

Solution

See Also

Item Details