I was reviewing the Rule: aide_periodic_cron_checking and noticed the following
recommended fix:
----start quote----
To implement a daily execution of AIDE at 4:05am using cron, add the
following line to /etc/crontab:
05 4 * * * root /usr/sbin/aide --check
AIDE can be executed periodically through other means; this is merely one
example.
---- end quote------
This fix is also documented in the RHEL STIG version 1 release 2.
I believe that is an incorrect line for crontab as the 6th element is to be the
executed command. On my RHEL 6.4 machine, "root" is not a valid command and I
receive the following in local mail box
# mail
Heirloom Mail version 12.4 7/29/08. Type ? for help.
"/var/spool/mail/root": 1 message 1 new
>N 1 Cron Daemon Fri Aug 9 04:05 23/1036 "Cron
<root@techval15> root /usr/sbin/aide --check"
& 1
Message 1:
From [email protected] Fri Aug 9 04:05:01 2013
Return-Path: <[email protected]>
Date: Fri, 9 Aug 2013 04:05:01 -0500
From: [email protected] (Cron Daemon)
To: [email protected]
Subject: Cron <root@techval15> root /usr/sbin/aide --check
Content-Type: text/plain; charset=ISO-8859-1
Auto-Submitted: auto-generated
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=root>
X-Cron-Env: <USER=root>
Status: R
/bin/sh: root: command not found
Am I missing something?
Thanks
Robert
Robert Hayden | Sr. Technology Architect | Cerner Corporation | 816.201.4068 |
[email protected]<mailto:[email protected]> | www.cerner.com
CONFIDENTIALITY NOTICE This message and any included attachments are from
Cerner Corporation and are intended only for the addressee. The information
contained in this message is confidential and may constitute inside or
non-public information under international, federal, or state securities laws.
Unauthorized forwarding, printing, copying, distribution, or use of such
information is strictly prohibited and may be unlawful. If you are not the
addressee, please promptly delete this message and notify the sender of the
delivery error by e-mail or you may call Cerner's corporate offices in Kansas
City, Missouri, U.S.A at (+1) (816)221-1024.
_______________________________________________
scap-security-guide mailing list
[email protected]
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
