← Back to SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

V-984

CAT II (Medium)

Access to the at utility must be controlled via the at.allow and/or at.deny file(s).

Rule ID

SV-45648r2_rule

STIG

SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

Version

V1R12

CCIs

CCI-000225

Discussion

The "at" facility selectively allows users to execute jobs at deferred times. It is usually used for one-time jobs. The at.allow file selectively allows access to the "at" facility. If there is no at.allow file, there is no ready documentation of who is allowed to submit "at" jobs.

Check Content

If the “at” package is not installed, this is not applicable.

Check for the existence of at.allow and at.deny files.
# ls -lL /etc/at.allow
# ls -lL /etc/at.deny
If neither file exists, this is a finding.

Fix Text

Create at.allow and/or at.deny files containing appropriate lists of users to be allowed or denied access to the "at" daemon.