I was reviewing the Rule: aide_periodic_cron_checking and noticed the following recommended fix:
----start quote---- To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab: 05 4 * * * root /usr/sbin/aide --check
AIDE can be executed periodically through other means; this is merely one example.
---- end quote------
This fix is also documented in the RHEL STIG version 1 release 2.
I believe that is an incorrect line for crontab as the 6th element is to be the executed command. On my RHEL 6.4 machine, "root" is not a valid command and I receive the following in local mail box
# mail Heirloom Mail version 12.4 7/29/08. Type ? for help. "/var/spool/mail/root": 1 message 1 new >N 1 Cron Daemon Fri Aug 9 04:05 23/1036 "Cron root@techval15 root /usr/sbin/aide --check" & 1 Message 1: From root@techval15.northamerica.cerner.net Fri Aug 9 04:05:01 2013 Return-Path: root@techval15.northamerica.cerner.net Date: Fri, 9 Aug 2013 04:05:01 -0500 From: root@techval15.northamerica.cerner.net (Cron Daemon) To: root@techval15.northamerica.cerner.net Subject: Cron root@techval15 root /usr/sbin/aide --check Content-Type: text/plain; charset=ISO-8859-1 Auto-Submitted: auto-generated X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=root> X-Cron-Env: <USER=root> Status: R
/bin/sh: root: command not found
Am I missing something?
Thanks Robert
Robert Hayden | Sr. Technology Architect | Cerner Corporation | 816.201.4068 | rhayden@cerner.commailto:rhayden@cerner.com | www.cerner.com
CONFIDENTIALITY NOTICE This message and any included attachments are from Cerner Corporation and are intended only for the addressee. The information contained in this message is confidential and may constitute inside or non-public information under international, federal, or state securities laws. Unauthorized forwarding, printing, copying, distribution, or use of such information is strictly prohibited and may be unlawful. If you are not the addressee, please promptly delete this message and notify the sender of the delivery error by e-mail or you may call Cerner's corporate offices in Kansas City, Missouri, U.S.A at (+1) (816)221-1024.
Pretty sure you are correct. This is an entry that should be in root's crontab, without the word "root".
Paul M. Whitney RHCSA, VCP
Chesapeake IT Consulting, Inc. 2680 Tobacco Rd Chesapeake Beach, MD 20732
Work: 301.543.3716 Cell: 410.493.9448 paul.whitney@mac.com
On Aug 09, 2013, at 12:38 PM, "Hayden,Robert" RHAYDEN@CERNER.COM wrote:
I was reviewing the Rule: aide_periodic_cron_checking and noticed the following recommended fix: ----start quote---- To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab: 05 4 * * * root /usr/sbin/aide --check
AIDE can be executed periodically through other means; this is merely one example.
---- end quote------
This fix is also documented in the RHEL STIG version 1 release 2.
I believe that is an incorrect line for crontab as the 6th element is to be the executed command. On my RHEL 6.4 machine, "root" is not a valid command and I receive the following in local mail box
# mail Heirloom Mail version 12.4 7/29/08. Type ? for help. "/var/spool/mail/root": 1 message 1 new
N 1 Cron Daemon Fri Aug 9 04:05 23/1036 "Cron root@techval15 root /usr/sbin/aide --check"
& 1 Message 1: From root@techval15.northamerica.cerner.net Fri Aug 9 04:05:01 2013 Return-Path: root@techval15.northamerica.cerner.net Date: Fri, 9 Aug 2013 04:05:01 -0500 From: root@techval15.northamerica.cerner.net (Cron Daemon) To: root@techval15.northamerica.cerner.net Subject: Cron root@techval15 root /usr/sbin/aide --check Content-Type: text/plain; charset=ISO-8859-1 Auto-Submitted: auto-generated X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=root> X-Cron-Env: <USER=root> Status: R
/bin/sh: root: command not found
Am I missing something?
Thanks Robert
Robert Hayden | Sr. Technology Architect | Cerner Corporation | 816.201.4068 | rhayden@cerner.com | www.cerner.com
CONFIDENTIALITY NOTICE This message and any included attachments are from Cerner Corporation and are intended only for the addressee. The information contained in this message is confidential and may constitute inside or non-public information under international, federal, or state securities laws. Unauthorized forwarding, printing, copying, distribution, or use of such information is strictly prohibited and may be unlawful. If you are not the addressee, please promptly delete this message and notify the sender of the delivery error by e-mail or you may call Cerner's corporate offices in Kansas City, Missouri, U.S.A at (+1) (816)221-1024. _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
The sixth element is the user to run the command. The /etc/crontab file can run the command as any user. Same goes for files placed in /etc/cron.d folder IIRC.
On my RHEL 6.4 server there is a pretty obvious comment explaining the fields at the top of /etc/crontab unless I'm mistaken. Do you have a comment block on your servers in that file?
In any case all they're doing is giving one example that works. They say at the bottom there are other means (root's own crontab, another user via sudo, etc.)
Bryan
On Aug 9, 2013, at 12:52 PM, Paul Whitney paul.whitney@mac.com wrote:
Pretty sure you are correct. This is an entry that should be in root's crontab, without the word "root". Paul M. Whitney RHCSA, VCP
Chesapeake IT Consulting, Inc. 2680 Tobacco Rd Chesapeake Beach, MD 20732
Work: 301.543.3716 Cell: 410.493.9448 paul.whitney@mac.com
On Aug 09, 2013, at 12:38 PM, "Hayden,Robert" RHAYDEN@CERNER.COM wrote:
I was reviewing the Rule: aide_periodic_cron_checking and noticed the following recommended fix: ----start quote---- To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab: 05 4 * * * root /usr/sbin/aide --check
AIDE can be executed periodically through other means; this is merely one example.
---- end quote------
This fix is also documented in the RHEL STIG version 1 release 2.
I believe that is an incorrect line for crontab as the 6th element is to be the executed command. On my RHEL 6.4 machine, "root" is not a valid command and I receive the following in local mail box
# mail Heirloom Mail version 12.4 7/29/08. Type ? for help. "/var/spool/mail/root": 1 message 1 new
N 1 Cron Daemon Fri Aug 9 04:05 23/1036 "Cron root@techval15 root /usr/sbin/aide --check"
& 1 Message 1: From root@techval15.northamerica.cerner.net Fri Aug 9 04:05:01 2013 Return-Path: root@techval15.northamerica.cerner.net Date: Fri, 9 Aug 2013 04:05:01 -0500 From: root@techval15.northamerica.cerner.net (Cron Daemon) To: root@techval15.northamerica.cerner.net Subject: Cron root@techval15 root /usr/sbin/aide --check Content-Type: text/plain; charset=ISO-8859-1 Auto-Submitted: auto-generated X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=root> X-Cron-Env: <USER=root> Status: R
/bin/sh: root: command not found
Am I missing something?
Thanks Robert
Robert Hayden | Sr. Technology Architect | Cerner Corporation | 816.201.4068 | rhayden@cerner.com | www.cerner.com
CONFIDENTIALITY NOTICE This message and any included attachments are from Cerner Corporation and are intended only for the addressee. The information contained in this message is confidential and may constitute inside or non-public information under international, federal, or state securities laws. Unauthorized forwarding, printing, copying, distribution, or use of such information is strictly prohibited and may be unlawful. If you are not the addressee, please promptly delete this message and notify the sender of the delivery error by e-mail or you may call Cerner's corporate offices in Kansas City, Missouri, U.S.A at (+1) (816)221-1024. _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
The /etc/crontab file is what I was missing. I simply did the user specific "crontab -e" command out of habit. Old dog, new tricks.
Thanks Robert
Robert Hayden | Sr. Technology Architect | Cerner Corporation | 816.201.4068 | rhayden@cerner.commailto:rhayden@cerner.com | www.cerner.com
From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Bryan Harris Sent: Friday, August 09, 2013 11:57 AM To: scap-security-guide@lists.fedorahosted.org Cc: scap-security-guide@lists.fedorahosted.org Subject: Re: Does aide_periodic_cron_checking have an incorrect fix documented?
The sixth element is the user to run the command. The /etc/crontab file can run the command as any user. Same goes for files placed in /etc/cron.d folder IIRC.
On my RHEL 6.4 server there is a pretty obvious comment explaining the fields at the top of /etc/crontab unless I'm mistaken. Do you have a comment block on your servers in that file?
In any case all they're doing is giving one example that works. They say at the bottom there are other means (root's own crontab, another user via sudo, etc.)
Bryan
On Aug 9, 2013, at 12:52 PM, Paul Whitney <paul.whitney@mac.commailto:paul.whitney@mac.com> wrote: Pretty sure you are correct. This is an entry that should be in root's crontab, without the word "root".
Paul M. Whitney RHCSA, VCP
Chesapeake IT Consulting, Inc. 2680 Tobacco Rd Chesapeake Beach, MD
20732
Work: 301.543.3716 Cell: 410.493.9448
paul.whitney@mac.commailto:paul.whitney@mac.com
On Aug 09, 2013, at 12:38 PM, "Hayden,Robert" <RHAYDEN@CERNER.COMmailto:RHAYDEN@CERNER.COM> wrote: I was reviewing the Rule: aide_periodic_cron_checking and noticed the following recommended fix: ----start quote---- To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab: 05 4 * * * root /usr/sbin/aide --check
AIDE can be executed periodically through other means; this is merely one example.
---- end quote------
This fix is also documented in the RHEL STIG version 1 release 2.
I believe that is an incorrect line for crontab as the 6th element is to be the executed command. On my RHEL 6.4 machine, "root" is not a valid command and I receive the following in local mail box
# mail Heirloom Mail version 12.4 7/29/08. Type ? for help. "/var/spool/mail/root": 1 message 1 new
N 1 Cron Daemon Fri Aug 9 04:05 23/1036 "Cron root@techval15 root /usr/sbin/aide --check"
& 1 Message 1: From root@techval15.northamerica.cerner.netmailto:root@techval15.northamerica.cerner.net Fri Aug 9 04:05:01 2013 Return-Path: <root@techval15.northamerica.cerner.netmailto:root@techval15.northamerica.cerner.net> Date: Fri, 9 Aug 2013 04:05:01 -0500 From: root@techval15.northamerica.cerner.netmailto:root@techval15.northamerica.cerner.net (Cron Daemon) To: root@techval15.northamerica.cerner.netmailto:root@techval15.northamerica.cerner.net Subject: Cron root@techval15 root /usr/sbin/aide --check Content-Type: text/plain; charset=ISO-8859-1 Auto-Submitted: auto-generated X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=root> X-Cron-Env: <USER=root> Status: R
/bin/sh: root: command not found
Am I missing something?
Thanks Robert
Robert Hayden | Sr. Technology Architect | Cerner Corporation | 816.201.4068 | rhayden@cerner.commailto:rhayden@cerner.com | www.cerner.comhttp://www.cerner.com
CONFIDENTIALITY NOTICE This message and any included attachments are from Cerner Corporation and are intended only for the addressee. The information contained in this message is confidential and may constitute inside or non-public information under international, federal, or state securities laws. Unauthorized forwarding, printing, copying, distribution, or use of such information is strictly prohibited and may be unlawful. If you are not the addressee, please promptly delete this message and notify the sender of the delivery error by e-mail or you may call Cerner's corporate offices in Kansas City, Missouri, U.S.A at (+1) (816)221-1024. _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.orgmailto:scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guidehttps://urldefense.proofpoint.com/v1/url?u=https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide&k=PmKqfXspAHNo6iYJ48Q45A%3D%3D%0A&r=MeiC35CFRyFVyqWUnw11jlPbFzJPYPeXmyplv564q7o%3D%0A&m=srzESgYPteuGTVhBfVlT35dlOzjHzBkk%2Bg5wEv4LHa0%3D%0A&s=b0b9e43c84ad7fe237a48cbfca588072f92bb813cf9a2e932c595d4c9f110754 _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.orgmailto:scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guidehttps://urldefense.proofpoint.com/v1/url?u=https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide&k=PmKqfXspAHNo6iYJ48Q45A%3D%3D%0A&r=MeiC35CFRyFVyqWUnw11jlPbFzJPYPeXmyplv564q7o%3D%0A&m=srzESgYPteuGTVhBfVlT35dlOzjHzBkk%2Bg5wEv4LHa0%3D%0A&s=b0b9e43c84ad7fe237a48cbfca588072f92bb813cf9a2e932c595d4c9f110754
scap-security-guide@lists.fedorahosted.org