Ensure crontab is restricted to authorized users

高レベル 1自動freebsd

説明

crontab is the program used to install, deinstall, or list the tables that drive the cron daemon. Each user can have their crontab, and though these are files in /var/cron/tabs, they are not intended to be edited directly. If the /var/cron/allow file exists, you must be listed (one user per line) therein to be allowed to use this command. Audit: /var/cron/allow must exist with mode 640 or stricter, root:wheel; /var/cron/deny must be absent or equally restricted.

チェック方法

監査方法: シェルコマンド

shell

r=compliant; for f in /var/cron/allow; do if [ -e "$f" ]; then set -- $(ls -ld "$f"); s=$(printf '%s %s %s\n' "$1" "$3" "$4" | awk -v m='rw-r-----' -v o='root' -v g='wheel' '{ok=1; for(i=1;i<=9;i++) if(substr(m,i,1)=="-" && substr($1,i+1,1)!="-") ok=0; if(o!="" && $2 !~ ("^(" o ")$")) ok=0; if(g!="" && $3 !~ ("^(" g ")$")) ok=0; print (ok ? "ok" : $0)}'); [ "$s" = ok ] || r="$f: $s"; else r="$f: missing"; fi; done; for f in /var/cron/deny; do if [ -e "$f" ]; then set -- $(ls -ld "$f"); s=$(printf '%s %s %s\n' "$1" "$3" "$4" | awk -v m='rw-r-----' -v o='root' -v g='wheel' '{ok=1; for(i=1;i<=9;i++) if(substr(m,i,1)=="-" && substr($1,i+1,1)!="-") ok=0; if(o!="" && $2 !~ ("^(" o ")$")) ok=0; if(g!="" && $3 !~ ("^(" g ")$")) ok=0; print (ok ? "ok" : $0)}'); [ "$s" = ok ] || r="$f: $s"; else :; fi; done; echo "$r"

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

-IF- cron is installed on the system: Run the following commands to: Create /var/cron/allow if it doesn't exist Change owner or user root Change group owner to group wheel Change mode to 640 or more restrictive # [ ! -e "/var/cron/allow" ] && touch /var/cron/allow # chown root:wheel /var/cron/allow # chmod u-x,g-wx,o-rwx /var/cron/allow Run the following commands to: -IF- /var/cron/deny exists: Change owner or user root Change group owner to group wheel Change mode to 640 or more restrictive # [ -e "/var/cron/deny" ] && chown root:wheel /var/cron/deny # [ -e "/var/cron/deny" ] && chmod u-x,g-wx,o-rwx /var/cron/deny

プロパティ

オペレーティングシステム: すべて
タグ: freebsdaccounts
参照: CIS FreeBSD 14 Benchmark v1.0.1 - 4.1.1.3 Ensure crontab is restricted to authorized users

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target freebsd