Skip to content
ATO Pathways
  Log In

Ensure cron Is Logging To Rsyslog

An XCCDF Rule

Description

Cron logging must be implemented to spot intrusions or trace cron job status. If cron is not logging to rsyslog, it can be implemented by adding the following to the RULES section of /etc/rsyslog.conf: If the legacy syntax is used: 

cron.*                                                  /var/log/cron
If the modern syntax (RainerScript) is used: 
cron.* action(type="omfile" file="/var/log/cron")

Rationale

Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used to spot intrusions into the use of the cron facility by unauthorized and malicious users.

ID
xccdf_org.ssgproject.content_rule_rsyslog_cron_logging
Severity
Medium
References
Updated



Remediation - Ansible

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - configure_strategy

Remediation - Shell Script

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if ! grep -s "^\s*cron\.\*\s*/var/log/cron$" /etc/rsyslog.conf /etc/rsyslog.d/*.conf; then
	mkdir -p /etc/rsyslog.d
	echo "cron.*	/var/log/cron" >> /etc/rsyslog.d/cron.conf