Ensure crontab is restricted to authorized users

CaoCấp 1Tự độngfreebsd

Mô tả

crontab is the program used to install, deinstall, or list the tables that drive the cron daemon. Each user can have their crontab, and though these are files in /var/cron/tabs, they are not intended to be edited directly. If the /var/cron/allow file exists, you must be listed (one user per line) therein to be allowed to use this command. Audit: /var/cron/allow must exist with mode 640 or stricter, root:wheel; /var/cron/deny must be absent or equally restricted.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

r=compliant; for f in /var/cron/allow; do if [ -e "$f" ]; then set -- $(ls -ld "$f"); s=$(printf '%s %s %s\n' "$1" "$3" "$4" | awk -v m='rw-r-----' -v o='root' -v g='wheel' '{ok=1; for(i=1;i<=9;i++) if(substr(m,i,1)=="-" && substr($1,i+1,1)!="-") ok=0; if(o!="" && $2 !~ ("^(" o ")$")) ok=0; if(g!="" && $3 !~ ("^(" g ")$")) ok=0; print (ok ? "ok" : $0)}'); [ "$s" = ok ] || r="$f: $s"; else r="$f: missing"; fi; done; for f in /var/cron/deny; do if [ -e "$f" ]; then set -- $(ls -ld "$f"); s=$(printf '%s %s %s\n' "$1" "$3" "$4" | awk -v m='rw-r-----' -v o='root' -v g='wheel' '{ok=1; for(i=1;i<=9;i++) if(substr(m,i,1)=="-" && substr($1,i+1,1)!="-") ok=0; if(o!="" && $2 !~ ("^(" o ")$")) ok=0; if(g!="" && $3 !~ ("^(" g ")$")) ok=0; print (ok ? "ok" : $0)}'); [ "$s" = ok ] || r="$f: $s"; else :; fi; done; echo "$r"

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

-IF- cron is installed on the system: Run the following commands to: Create /var/cron/allow if it doesn't exist Change owner or user root Change group owner to group wheel Change mode to 640 or more restrictive # [ ! -e "/var/cron/allow" ] && touch /var/cron/allow # chown root:wheel /var/cron/allow # chmod u-x,g-wx,o-rwx /var/cron/allow Run the following commands to: -IF- /var/cron/deny exists: Change owner or user root Change group owner to group wheel Change mode to 640 or more restrictive # [ -e "/var/cron/deny" ] && chown root:wheel /var/cron/deny # [ -e "/var/cron/deny" ] && chmod u-x,g-wx,o-rwx /var/cron/deny

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: freebsdaccounts
Tham chiếu: CIS FreeBSD 14 Benchmark v1.0.1 - 4.1.1.3 Ensure crontab is restricted to authorized users

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target freebsd