<Group id="cron_and_at">
<title>Cron and At Daemons</title>
<description>The cron and at services are used to allow commands to
be executed at a later time. The cron service is required by almost
all systems to perform necessary maintenance tasks, while at may or
may not be required on a given system. Both daemons should be
configured defensively.</description>

<Rule id="service_crond_enabled" severity="medium">
<title>Enable cron Service</title>
<description>The <tt>crond</tt> service is used to execute commands at
preconfigured times. It is required by almost all systems to perform necessary
maintenance tasks, such as notifying root of system activity.
<service-enable-macro service="crond" />
</description>
<ocil><service-enable-check-macro service="crond" /></ocil>
<rationale>Due to its usage for maintenance and security-supporting tasks,
enabling the cron daemon is essential.
</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="service_crond_enabled" />
<ref nist="CM-7" />
<tested by="DS" on="20121024"/>
</Rule>

<Rule id="disable_anacron">
<title>Disable anacron Service</title>
<description>The <tt>cronie-anacron</tt> package, which provides <tt>anacron</tt>
functionality, is installed by default. 
<package-remove-macro package="cronie-anacron" />
</description>
<ocil><package-check-macro package="cronie-anacron" /></ocil>
<rationale>
The <tt>anacron</tt> service provides <tt>cron</tt> functionality for systems
such as laptops and workstations that may be shut down during the normal times
that <tt>cron</tt> jobs are scheduled to run. On systems which do not require this
additional functionality, <tt>anacron</tt> could needlessly increase the possible
attack surface for an intruder.
</rationale>
<ref nist="CM-7" />
<ident cce="RHEL7-CCE-TBD" />
</Rule>


<Rule id="service_atd_disabled">
<title>Disable At Service (atd)</title>
<description>The <tt>at</tt> and <tt>batch</tt> commands can be used to
schedule tasks that are meant to be executed only once. This allows delayed
execution in a manner similar to cron, except that it is not
recurring. The daemon <tt>atd</tt> keeps track of tasks scheduled via
<tt>at</tt> and <tt>batch</tt>, and executes them at the specified time.
<service-disable-macro service="atd" />
</description>
<ocil><service-disable-check-macro service="atd" /></ocil>
<rationale>
The <tt>atd</tt> service could be used by an unsophisticated insider to carry
out activities outside of a normal login session, which could complicate
accountability. Furthermore, the need to schedule tasks with <tt>at</tt> or
<tt>batch</tt> is not common.
</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="service_atd_disabled" />
<ref nist="CM-7" disa="381" />
</Rule>

<Group id="restrict_at_cron_users">
<title>Restrict at and cron to Authorized Users if Necessary</title>
<description>
The <tt>/etc/cron.allow</tt> and <tt>/etc/at.allow</tt> files contain lists of users who are allowed
to use cron and at to delay execution of processes. If these files exist and
if the corresponding files <tt>/etc/cron.deny</tt> and <tt>/etc/at.deny</tt> do not exist,
then only users listed in the relevant allow files can run the crontab and at
commands to submit jobs to be run at scheduled intervals.
On many systems, only the system administrator needs the ability to schedule
jobs. Note that even if a given user is not listed in <tt>cron.allow</tt>, cron jobs can
still be run as that user. The <tt>cron.allow</tt> file controls only administrative access
to the crontab command for scheduling and modifying cron jobs.
<br/>
<br/>
To restrict at and cron to only authorized users:
<ul>
<li>Remove the cron.deny file:<pre>$ sudo rm /etc/cron.deny</pre></li>
<li>Edit <tt>/etc/cron.allow</tt>, adding one line for each user allowed to use the crontab command to create cron jobs.</li>
<li>Remove the <tt>at.deny</tt> file:<pre>$ sudo rm /etc/at.deny</pre></li>
<li>Edit <tt>/etc/at.allow</tt>, adding one line for each user allowed to use the at command to create at jobs.</li>
</ul>
</description>
</Group>

</Group>
