V-979

Discussion

To protect the integrity of scheduled system jobs and to prevent malicious modification to these jobs, crontab files must be secured.

Check Content

Check the mode of the crontab directories.

Procedure:
# ls -ld /var/spool/cron /var/spool/cron/tabs


ls -ld /etc/crontab /etc/cron.{d,daily,hourly,monthly,weekly}
or 
# ls -ld /etc/cron*|grep -v deny

If the mode of any of the crontab directories is more permissive than 0755, this is a finding.