Ensure that /etc/cron.deny does not exist

Classification:

compliance

Framework:

Control:

Description

The file /etc/cron.deny should not exist. Use /etc/cron.allow instead.

Rationale

Access to cron should be restricted. It is easier to manage an allow list than a deny list.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

#!/bin/bash



 if [[ -f /etc/cron.deny ]]; then
 rm /etc/cron.deny
 fi

else
 >&2 echo 'Remediation is not applicable, nothing was done'
fi

Ansible playbook

The following playbook can be run with Ansible to remediate the issue.

- name: Remove /etc/cron.deny
 file:
 path: /etc/cron.deny
 state: absent
 when: ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - PCI-DSSv4-2.2.6
 - disable\_strategy
 - file\_cron\_deny\_not\_exist
 - low\_complexity
 - low\_disruption
 - medium\_severity
 - no\_reboot\_needed