Ensure crontab is restricted to authorized users

높음레벨 1자동freebsd

설명

crontab is the program used to install, deinstall, or list the tables that drive the cron daemon. Each user can have their crontab, and though these are files in /var/cron/tabs, they are not intended to be edited directly. If the /var/cron/allow file exists, you must be listed (one user per line) therein to be allowed to use this command. Audit: /var/cron/allow must exist with mode 640 or stricter, root:wheel; /var/cron/deny must be absent or equally restricted.

점검 방법

감사 방식: 셸 명령

shell

r=compliant; for f in /var/cron/allow; do if [ -e "$f" ]; then set -- $(ls -ld "$f"); s=$(printf '%s %s %s\n' "$1" "$3" "$4" | awk -v m='rw-r-----' -v o='root' -v g='wheel' '{ok=1; for(i=1;i<=9;i++) if(substr(m,i,1)=="-" && substr($1,i+1,1)!="-") ok=0; if(o!="" && $2 !~ ("^(" o ")$")) ok=0; if(g!="" && $3 !~ ("^(" g ")$")) ok=0; print (ok ? "ok" : $0)}'); [ "$s" = ok ] || r="$f: $s"; else r="$f: missing"; fi; done; for f in /var/cron/deny; do if [ -e "$f" ]; then set -- $(ls -ld "$f"); s=$(printf '%s %s %s\n' "$1" "$3" "$4" | awk -v m='rw-r-----' -v o='root' -v g='wheel' '{ok=1; for(i=1;i<=9;i++) if(substr(m,i,1)=="-" && substr($1,i+1,1)!="-") ok=0; if(o!="" && $2 !~ ("^(" o ")$")) ok=0; if(g!="" && $3 !~ ("^(" g ")$")) ok=0; print (ok ? "ok" : $0)}'); [ "$s" = ok ] || r="$f: $s"; else :; fi; done; echo "$r"

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

-IF- cron is installed on the system: Run the following commands to: Create /var/cron/allow if it doesn't exist Change owner or user root Change group owner to group wheel Change mode to 640 or more restrictive # [ ! -e "/var/cron/allow" ] && touch /var/cron/allow # chown root:wheel /var/cron/allow # chmod u-x,g-wx,o-rwx /var/cron/allow Run the following commands to: -IF- /var/cron/deny exists: Change owner or user root Change group owner to group wheel Change mode to 640 or more restrictive # [ -e "/var/cron/deny" ] && chown root:wheel /var/cron/deny # [ -e "/var/cron/deny" ] && chmod u-x,g-wx,o-rwx /var/cron/deny

속성

운영 체제: 모두
태그: freebsdaccounts
참고 자료: CIS FreeBSD 14 Benchmark v1.0.1 - 4.1.1.3 Ensure crontab is restricted to authorized users

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target freebsd