5.1.8 Ensure cron is restricted to authorized users - '/etc/cron.deny'

Information

Configure /etc/cron.allow to allow specific users to use this service. If /etc/cron.allow does not exist, then /etc/cron.deny is checked. Any user not specifically defined in this file is allowed to use cron. By removing the file, only users in /etc/cron.allow are allowed to use cron.

Notes:

Other methods, such as systemd timers, exist for scheduling jobs. If another method is used, cron should be removed, and the alternate method should be secured in accordance with local site policy

Even though a given user is not listed in cron.allow, cron jobs can still be run as that user

The cron.allow file only controls administrative access to the crontab command for scheduling and modifying cron jobs

Rationale:

On many systems, only the system administrator is authorized to schedule cron jobs. Using the cron.allow file to control who can run cron jobs enforces this policy. It is easier to manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files.

Solution

Run the following commands to remove /etc/cron.deny:

# rm /etc/cron.deny

Run the following command to create /etc/cron.allow

# touch /etc/cron.allow

Run the following commands to set permissions and ownership for /etc/cron.allow:

# chmod g-wx,o-rwx /etc/cron.allow

# chown root:root /etc/cron.allow

See Also

https://workbench.cisecurity.org/files/3219

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3, CSCv7|14.6

Plugin: Unix

Control ID: a513e4ebed9adc05c286d409ad867cc97207d5f4dbeaded860c00bd182025f54