Enable cron Service

An XCCDF Rule

Description

The crond service is used to execute commands at preconfigured times. It is required by almost all systems to perform necessary maintenance tasks, such as notifying root of system activity. The cron service can be enabled with the following command:

$ sudo systemctl enable cron.service

Rationale

Due to its usage for maintenance and security-supporting tasks, enabling the cron daemon is essential.

ID: xccdf_org.ssgproject.content_rule_service_cron_enabled
Severity: Medium
References: 11 14 3 9

BAI10.01 BAI10.02 BAI10.03 BAI10.05 DSS05.02 DSS05.05 DSS06.06

164.308(a)(4)(i) 164.308(b)(1) 164.308(b)(3) 164.310(b) 164.312(e)(1) 164.312(e)(2)(ii)

4.3.3.5.1 4.3.3.5.2 4.3.3.5.3 4.3.3.5.4 4.3.3.5.5 4.3.3.5.6 4.3.3.5.7 4.3.3.5.8 4.3.3.6.1 4.3.3.6.2 4.3.3.6.3 4.3.3.6.4 4.3.3.6.5 4.3.3.6.6 4.3.3.6.7 4.3.3.6.8 4.3.3.6.9 4.3.3.7.1 4.3.3.7.2 4.3.3.7.3 4.3.3.7.4 4.3.4.3.2 4.3.4.3.3

SR 1.1 SR 1.10 SR 1.11 SR 1.12 SR 1.13 SR 1.2 SR 1.3 SR 1.4 SR 1.5 SR 1.6 SR 1.7 SR 1.8 SR 1.9 SR 2.1 SR 2.2 SR 2.3 SR 2.4 SR 2.5 SR 2.6 SR 2.7 SR 7.6

A.12.1.2 A.12.5.1 A.12.6.2 A.14.2.2 A.14.2.3 A.14.2.4 A.9.1.2

CM-6(a)

PR.IP-1 PR.PT-3
Updated: about 1 month ago

Remediation Templates

service enable cron

include enable_cron
class enable_cron {
  service {'cron':
    enable => true,
    ensure => 'running',
  }
}

[customizations.services]
enabled = ["cron"]

- name: Enable cron Service - Enable service cron
  block:
  - name: Gather the package facts
    package_facts:
      manager: auto
  - name: Enable cron Service - Enable Service cron
    ansible.builtin.systemd:
      name: cron
      enabled: true
      state: started
      masked: false
    when:
    - '"cron" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_cron_enabled

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'cron.service'
"$SYSTEMCTL_EXEC" start 'cron.service'
"$SYSTEMCTL_EXEC" enable 'cron.service'
else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Enable cron Service

Description

Rationale

Remediation Templates

script:kickstart

A Puppet Snippet

OS Build Blueprint

An Ansible Snippet

A Shell Script