Description
To properly set the owner of /etc/crontab, run the command:
$ sudo chown root /etc/crontab
Rationale
Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes.
Shell script
The following script can be run on the host to remediate the issue.
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
chown 0 /etc/crontab
else
>&2 echo 'Remediation is not applicable, nothing was done'
fi
Ansible playbook
The following playbook can be run with Ansible to remediate the issue.
- name: Test for existence /etc/crontab
stat:
path: /etc/crontab
register: file\_exists
when: ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags:
- NIST-800-53-AC-6(1)
- NIST-800-53-CM-6(a)
- configure\_strategy
- file\_owner\_crontab
- low\_complexity
- low\_disruption
- medium\_severity
- no\_reboot\_needed
- name: Ensure owner 0 on /etc/crontab
file:
path: /etc/crontab
owner: '0'
when:
- ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
- file\_exists.stat is defined and file\_exists.stat.exists
tags:
- NIST-800-53-AC-6(1)
- NIST-800-53-CM-6(a)
- configure\_strategy
- file\_owner\_crontab
- low\_complexity
- low\_disruption
- medium\_severity
- no\_reboot\_needed
