<html><body><div>Pretty sure you are correct.&nbsp; This is an entry that should be in root's crontab, without the word "root".<br></div><div><pre style="font-family: Helvetica,Arial,sans-serif; font-size: 13px; white-space: pre-wrap" data-mce-style="font-family: Helvetica,Arial,sans-serif; font-size: 13px; white-space: pre-wrap;">Paul M. Whitney<br>RHCSA, VCP<br><br>Chesapeake IT Consulting, Inc.<br><span class="listing-address adr"><span class="street-address">2680 Tobacco Rd<br></span><span class="city-state"><span class="locality">Chesapeake Beach, </span><span class="region">MD</span>
<span class="postal-code">20732</span>
</span></span><br><br>Work: 301.543.3716<br>Cell:&nbsp;&nbsp; 410.493.9448
paul.whitney@mac.com


</pre></div><div><div><br>On Aug 09, 2013, at 12:38 PM, "Hayden,Robert" &lt;RHAYDEN@CERNER.COM&gt; wrote:<br><br><div><blockquote type="cite"><div class="msg-quote"><div>I was reviewing the Rule: <strong>aide_periodic_cron_checking</strong> and noticed the following recommended fix:</div><div style="margin-top:5pt;margin-bottom:5pt;padding-left:36pt;" data-mce-style="margin-top: 5pt; margin-bottom: 5pt; padding-left: 36pt;"><span style="font-family: Times New Roman; font-size: small;" data-mce-style="font-family: Times New Roman; font-size: small;" face="Times New Roman" size="3"><span style="font-size:12pt;" data-mce-style="font-size: 12pt;">----start quote----</span></span></div><div style="margin-top:5pt;margin-bottom:5pt;padding-left:36pt;" data-mce-style="margin-top: 5pt; margin-bottom: 5pt; padding-left: 36pt;"><span style="font-family: Times New Roman; font-size: small;" data-mce-style="font-family: Times New Roman; font-size: small;" face="Times New Roman" size="3"><span style="font-size:12pt;" data-mce-style="font-size: 12pt;">To implement a daily execution of AIDE at 4:05am using cron, add the following line to <span style="font-family: Courier New; font-size: x-small;" data-mce-style="font-family: Courier New; font-size: x-small;" face="Courier New" size="2"><span style="font-size:10pt;" data-mce-style="font-size: 10pt;">/etc/crontab</span></span>: </span></span></div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;"><span style="font-family: Courier New; font-size: x-small;" data-mce-style="font-family: Courier New; font-size: x-small;" face="Courier New" size="2"><span style="font-size:10pt;" data-mce-style="font-size: 10pt;">05 4 * * * root /usr/sbin/aide --check</span></span></div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">&nbsp;</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;"><span style="font-family: Times New Roman; font-size: small;" data-mce-style="font-family: Times New Roman; font-size: small;" face="Times New Roman" size="3"><span style="font-size:12pt;" data-mce-style="font-size: 12pt;">AIDE can be executed periodically through other means; this is merely one example.</span></span></div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">&nbsp;</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">---- end quote------</div><div>&nbsp;</div><div>This fix is also documented in the RHEL STIG version 1 release 2.</div><div>&nbsp;</div><div>I believe that is an incorrect line for crontab as the 6<span style="font-size: xx-small;" data-mce-style="font-size: xx-small;" size="1"><span style="font-size:7.3pt;" data-mce-style="font-size: 7.3pt;"><sup>th</sup></span></span> element is to be the executed command.&nbsp; On my RHEL 6.4 machine, "root" is not a valid command and&nbsp; I receive the following in local mail box</div><div>&nbsp;</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;"># mail</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">Heirloom Mail version 12.4 7/29/08.&nbsp; Type ? for help.</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">"/var/spool/mail/root": 1 message 1 new</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">&gt;N&nbsp; 1 Cron Daemon&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Fri Aug&nbsp; 9 04:05&nbsp; 23/1036&nbsp; "Cron &lt;root@techval15&gt; root /usr/sbin/aide --check"</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">&amp; 1</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">Message&nbsp; 1:</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">From root@techval15.northamerica.cerner.net&nbsp; Fri Aug&nbsp; 9 04:05:01 2013</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">Return-Path: &lt;root@techval15.northamerica.cerner.net&gt;</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">Date: Fri, 9 Aug 2013 04:05:01 -0500</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">From: root@techval15.northamerica.cerner.net (Cron Daemon)</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">To: root@techval15.northamerica.cerner.net</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">Subject: Cron &lt;root@techval15&gt; root /usr/sbin/aide --check</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">Content-Type: text/plain; charset=ISO-8859-1</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">Auto-Submitted: auto-generated</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">X-Cron-Env: &lt;SHELL=/bin/sh&gt;</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">X-Cron-Env: &lt;HOME=/root&gt;</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">X-Cron-Env: &lt;PATH=/usr/bin:/bin&gt;</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">X-Cron-Env: &lt;LOGNAME=root&gt;</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">X-Cron-Env: &lt;USER=root&gt;</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">Status: R</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;">&nbsp;</div><div style="padding-left:36pt;" data-mce-style="padding-left: 36pt;"><span style="background-color:yellow;" data-mce-style="background-color: yellow;">/bin/sh: root: command not found</span></div><div>&nbsp;</div><div>&nbsp;</div><div>Am I missing something?</div><div>&nbsp;</div><div>Thanks</div><div>Robert</div><div>&nbsp;</div><div>&nbsp;</div><div><span style="color: navy; font-family: Arial; font-size: x-small;" data-mce-style="color: navy; font-family: Arial; font-size: x-small;" color="navy" face="Arial" size="2"><span style="font-size:10pt;" data-mce-style="font-size: 10pt;"><strong>Robert Hayden</strong> | Sr. Technology Architect | Cerner Corporation | 816.201.4068 | <a href="mailto:rhayden@cerner.com" data-mce-href="mailto:rhayden@cerner.com"><span style="color: blue;" data-mce-style="color: blue;" color="blue"><span style="text-decoration: underline;" data-mce-style="text-decoration: underline;">rhayden@cerner.com</span></span></a> | <a><span style="color: blue;" data-mce-style="color: blue;" color="blue"><span style="text-decoration: underline;" data-mce-style="text-decoration: underline;">www.cerner.com</span></span></a></span></span></div><div>&nbsp;</div><div>&nbsp;</div><div>&nbsp;</div><div>CONFIDENTIALITY NOTICE This message and any included attachments are from Cerner Corporation and are intended only for the addressee. The information contained in this message is confidential and may constitute inside or non-public information under international, federal, or state securities laws. Unauthorized forwarding, printing, copying, distribution, or use of such information is strictly prohibited and may be unlawful. If you are not the addressee, please promptly delete this message and notify the sender of the delivery error by e-mail or you may call Cerner's corporate offices in Kansas City, Missouri, U.S.A at (+1) (816)221-1024.<br></div><div class="_stretch">_______________________________________________<br> scap-security-guide mailing list<br> <a href="mailto:scap-security-guide@lists.fedorahosted.org" data-mce-href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br> <a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" data-mce-href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br></div></div></blockquote></div></div></div><style class="_message-styles">.msg-quote .EmailQuote {margin-left: 1pt; padding-left: 4pt; border-left: 2px solid rgb(128, 0, 0);}
</style></body></html>