Detections
Analytics

UBTU-16-030460 - Cron logging must be implemented.

Information

Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used to spot intrusions into the use of the cron facility by unauthorized and malicious users.

Solution

Configure 'rsyslog' to log all cron messages by adding or updating the following line to '/etc/rsyslog.d/50-default.conf':

cron.* /var/log/cron.log

Note: The line must be added before the following entry if it exists in '/etc/rsyslog.d/50-default.conf':

*.* ~ # discards everything

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_CAN_Ubuntu_16-04_LTS_V2R3_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-215142r610931_rule, STIG-ID|UBTU-16-030460, STIG-Legacy|SV-90545, STIG-Legacy|V-75865, Vuln-ID|V-215142

Plugin: Unix

Control ID: 7efe3e971c78de3a2c477e0d34e3fedc9b5dd08ae533ec0bcb6ee2d78ac47da0