Ensure crontab is restricted to authorized users

HighLevel 1Automatedfreebsd

Description

crontab is the program used to install, deinstall, or list the tables that drive the cron daemon. Each user can have their crontab, and though these are files in /var/cron/tabs, they are not intended to be edited directly. If the /var/cron/allow file exists, you must be listed (one user per line) therein to be allowed to use this command. Audit: /var/cron/allow must exist with mode 640 or stricter, root:wheel; /var/cron/deny must be absent or equally restricted.

How it is checked

Audit method: Shell command

shell

r=compliant; for f in /var/cron/allow; do if [ -e "$f" ]; then set -- $(ls -ld "$f"); s=$(printf '%s %s %s\n' "$1" "$3" "$4" | awk -v m='rw-r-----' -v o='root' -v g='wheel' '{ok=1; for(i=1;i<=9;i++) if(substr(m,i,1)=="-" && substr($1,i+1,1)!="-") ok=0; if(o!="" && $2 !~ ("^(" o ")$")) ok=0; if(g!="" && $3 !~ ("^(" g ")$")) ok=0; print (ok ? "ok" : $0)}'); [ "$s" = ok ] || r="$f: $s"; else r="$f: missing"; fi; done; for f in /var/cron/deny; do if [ -e "$f" ]; then set -- $(ls -ld "$f"); s=$(printf '%s %s %s\n' "$1" "$3" "$4" | awk -v m='rw-r-----' -v o='root' -v g='wheel' '{ok=1; for(i=1;i<=9;i++) if(substr(m,i,1)=="-" && substr($1,i+1,1)!="-") ok=0; if(o!="" && $2 !~ ("^(" o ")$")) ok=0; if(g!="" && $3 !~ ("^(" g ")$")) ok=0; print (ok ? "ok" : $0)}'); [ "$s" = ok ] || r="$f: $s"; else :; fi; done; echo "$r"

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

-IF- cron is installed on the system: Run the following commands to: Create /var/cron/allow if it doesn't exist Change owner or user root Change group owner to group wheel Change mode to 640 or more restrictive # [ ! -e "/var/cron/allow" ] && touch /var/cron/allow # chown root:wheel /var/cron/allow # chmod u-x,g-wx,o-rwx /var/cron/allow Run the following commands to: -IF- /var/cron/deny exists: Change owner or user root Change group owner to group wheel Change mode to 640 or more restrictive # [ -e "/var/cron/deny" ] && chown root:wheel /var/cron/deny # [ -e "/var/cron/deny" ] && chmod u-x,g-wx,o-rwx /var/cron/deny

Properties

Operating systems: Any
Tags: freebsdaccounts
Reference: CIS FreeBSD 14 Benchmark v1.0.1 - 4.1.1.3 Ensure crontab is restricted to authorized users

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target freebsd