Does aide_periodic_cron_checking have an incorrect fix documented?

Paul Whitney paul.whitney at mac.com
Fri Aug 9 16:52:33 UTC 2013


Pretty sure you are correct.  This is an entry that should be in root's crontab, without the word "root".

Paul M. Whitney
RHCSA, VCP

Chesapeake IT Consulting, Inc.
2680 Tobacco Rd
Chesapeake Beach, MD
20732


Work: 301.543.3716
Cell:   410.493.9448
paul.whitney at mac.com



On Aug 09, 2013, at 12:38 PM, "Hayden,Robert" <RHAYDEN at CERNER.COM> wrote:

> I was reviewing the Rule: aide_periodic_cron_checking and noticed the following recommended fix:
> ----start quote----
> To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab:
> 05 4 * * * root /usr/sbin/aide --check
>  
> AIDE can be executed periodically through other means; this is merely one example.
>  
> ---- end quote------
>  
> This fix is also documented in the RHEL STIG version 1 release 2.
>  
> I believe that is an incorrect line for crontab as the 6th element is to be the executed command.  On my RHEL 6.4 machine, "root" is not a valid command and  I receive the following in local mail box
>  
> # mail
> Heirloom Mail version 12.4 7/29/08.  Type ? for help.
> "/var/spool/mail/root": 1 message 1 new
> >N  1 Cron Daemon           Fri Aug  9 04:05  23/1036  "Cron <root at techval15> root /usr/sbin/aide --check"
> & 1
> Message  1:
> From root at techval15.northamerica.cerner.net  Fri Aug  9 04:05:01 2013
> Return-Path: <root at techval15.northamerica.cerner.net>
> Date: Fri, 9 Aug 2013 04:05:01 -0500
> From: root at techval15.northamerica.cerner.net (Cron Daemon)
> To: root at techval15.northamerica.cerner.net
> Subject: Cron <root at techval15> root /usr/sbin/aide --check
> Content-Type: text/plain; charset=ISO-8859-1
> Auto-Submitted: auto-generated
> X-Cron-Env: <SHELL=/bin/sh>
> X-Cron-Env: <HOME=/root>
> X-Cron-Env: <PATH=/usr/bin:/bin>
> X-Cron-Env: <LOGNAME=root>
> X-Cron-Env: <USER=root>
> Status: R
>  
> /bin/sh: root: command not found
>  
>  
> Am I missing something?
>  
> Thanks
> Robert
>  
>  
> Robert Hayden | Sr. Technology Architect | Cerner Corporation | 816.201.4068 | rhayden at cerner.com | www.cerner.com
>  
>  
>  
> CONFIDENTIALITY NOTICE This message and any included attachments are from Cerner Corporation and are intended only for the addressee. The information contained in this message is confidential and may constitute inside or non-public information under international, federal, or state securities laws. Unauthorized forwarding, printing, copying, distribution, or use of such information is strictly prohibited and may be unlawful. If you are not the addressee, please promptly delete this message and notify the sender of the delivery error by e-mail or you may call Cerner's corporate offices in Kansas City, Missouri, U.S.A at (+1) (816)221-1024.
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130809/63246d8f/attachment.html>


More information about the scap-security-guide mailing list