V-983

Discussion

Cron logs contain reports of scheduled system activities and must be protected from unauthorized access or manipulation.

Check Content

Check the mode of the cron log file.

Procedure:

Check the configured cron log file found in the cron entry of the rsyslog configuration (normally /var/log/cron).
# grep cron /etc/rsyslog.conf /etc/rsyslog.d/*.conf
# ls -lL /var/log/cron

If the mode is more permissive than 0600, this is a finding.