TMA-SOLARIS-6.3
Restrict at/cron to Authorized Users
Açıklama
The cron.allow and at.allow files contain a list of users who are allowed to run the crontab and at commands to submit jobs to be run at scheduled intervals. On many systems, only the system administrator needs the ability to schedule jobs. Even though a given user is not listed in cron.allow, cron jobs can still be run as that user. Audit: cron.deny and at.deny must be absent, cron.allow must list root, at.allow must exist and be empty.
Nasıl denetlenir
Denetim yöntemi: Kabuk komutu
r=compliant; [ -e /etc/cron.d/cron.deny ] && r="cron.deny exists"; [ -e /etc/cron.d/at.deny ] && r="at.deny exists"; grep -qx root /etc/cron.d/cron.allow 2>/dev/null || r="root not in cron.allow"; if [ -f /etc/cron.d/at.allow ]; then n=$(wc -l < /etc/cron.d/at.allow); [ "$n" -eq 0 ] || r="at.allow is not empty"; else r="at.allow missing"; fi; echo "$r"- Beklenen çıktı
compliant
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
Perform the following to implement the recommended state: # mv /etc/cron.deny /etc/cron.deny.cis # mv /etc/at.deny /etc/at.deny.cis # echo root > /etc/cron.allow # cp /dev/null at.allow # chown root:root cron.allow at.allow # chmod 400 cron.allow at.allow Note that the root/superuser is always allowed to use the at command and is not required to be specifically listed in at.allow.
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- solarisaccounts
- Referans
- CIS Oracle Solaris 11.4 Benchmark v1.1.0 - 6.3 Restrict at/cron to Authorized Users
Bu ana makineyi denetle
Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.
tmaegis scan --target solaris