The /etc/crontab file is what I was missing.  I simply did the user specific 
"crontab -e" command out of habit.  Old dog, new tricks.

Thanks
Robert

Robert Hayden | Sr. Technology Architect | Cerner Corporation | 816.201.4068 | 
[email protected]<mailto:[email protected]> | www.cerner.com

From: [email protected] 
[mailto:[email protected]] On Behalf Of Bryan 
Harris
Sent: Friday, August 09, 2013 11:57 AM
To: [email protected]
Cc: [email protected]
Subject: Re: Does aide_periodic_cron_checking have an incorrect fix documented?

The sixth element is the user to run the command. The /etc/crontab file can run 
the command as any user. Same goes for files placed in /etc/cron.d folder IIRC.

On my RHEL 6.4 server there is a pretty obvious comment explaining the fields 
at the top of /etc/crontab unless I'm mistaken. Do you have a comment block on 
your servers in that file?

In any case all they're doing is giving one example that works. They say at the 
bottom there are other means (root's own crontab, another user via sudo, etc.)

Bryan

On Aug 9, 2013, at 12:52 PM, Paul Whitney 
<[email protected]<mailto:[email protected]>> wrote:
Pretty sure you are correct.  This is an entry that should be in root's 
crontab, without the word "root".

Paul M. Whitney
RHCSA, VCP

Chesapeake IT Consulting, Inc.
2680 Tobacco Rd
Chesapeake Beach, MD

20732


Work: 301.543.3716
Cell:   410.493.9448

[email protected]<mailto:[email protected]>





On Aug 09, 2013, at 12:38 PM, "Hayden,Robert" 
<[email protected]<mailto:[email protected]>> wrote:
I was reviewing the Rule: aide_periodic_cron_checking and noticed the following 
recommended fix:
----start quote----
To implement a daily execution of AIDE at 4:05am using cron, add the following 
line to /etc/crontab:
05 4 * * * root /usr/sbin/aide --check

AIDE can be executed periodically through other means; this is merely one 
example.

---- end quote------

This fix is also documented in the RHEL STIG version 1 release 2.

I believe that is an incorrect line for crontab as the 6th element is to be the 
executed command.  On my RHEL 6.4 machine, "root" is not a valid command and  I 
receive the following in local mail box

# mail
Heirloom Mail version 12.4 7/29/08.  Type ? for help.
"/var/spool/mail/root": 1 message 1 new
>N  1 Cron Daemon           Fri Aug  9 04:05  23/1036  "Cron <root@techval15> 
>root /usr/sbin/aide --check"
& 1
Message  1:
From 
[email protected]<mailto:[email protected]>
  Fri Aug  9 04:05:01 2013
Return-Path: 
<[email protected]<mailto:[email protected]>>
Date: Fri, 9 Aug 2013 04:05:01 -0500
From: 
[email protected]<mailto:[email protected]>
 (Cron Daemon)
To: 
[email protected]<mailto:[email protected]>
Subject: Cron <root@techval15> root /usr/sbin/aide --check
Content-Type: text/plain; charset=ISO-8859-1
Auto-Submitted: auto-generated
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=root>
X-Cron-Env: <USER=root>
Status: R

/bin/sh: root: command not found


Am I missing something?

Thanks
Robert


Robert Hayden | Sr. Technology Architect | Cerner Corporation | 816.201.4068 | 
[email protected]<mailto:[email protected]> | 
www.cerner.com<http://www.cerner.com>



CONFIDENTIALITY NOTICE This message and any included attachments are from 
Cerner Corporation and are intended only for the addressee. The information 
contained in this message is confidential and may constitute inside or 
non-public information under international, federal, or state securities laws. 
Unauthorized forwarding, printing, copying, distribution, or use of such 
information is strictly prohibited and may be unlawful. If you are not the 
addressee, please promptly delete this message and notify the sender of the 
delivery error by e-mail or you may call Cerner's corporate offices in Kansas 
City, Missouri, U.S.A at (+1) (816)221-1024.
_______________________________________________
scap-security-guide mailing list
[email protected]<mailto:[email protected]>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide<https://urldefense.proofpoint.com/v1/url?u=https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide&k=PmKqfXspAHNo6iYJ48Q45A%3D%3D%0A&r=MeiC35CFRyFVyqWUnw11jlPbFzJPYPeXmyplv564q7o%3D%0A&m=srzESgYPteuGTVhBfVlT35dlOzjHzBkk%2Bg5wEv4LHa0%3D%0A&s=b0b9e43c84ad7fe237a48cbfca588072f92bb813cf9a2e932c595d4c9f110754>
_______________________________________________
scap-security-guide mailing list
[email protected]<mailto:[email protected]>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide<https://urldefense.proofpoint.com/v1/url?u=https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide&k=PmKqfXspAHNo6iYJ48Q45A%3D%3D%0A&r=MeiC35CFRyFVyqWUnw11jlPbFzJPYPeXmyplv564q7o%3D%0A&m=srzESgYPteuGTVhBfVlT35dlOzjHzBkk%2Bg5wEv4LHa0%3D%0A&s=b0b9e43c84ad7fe237a48cbfca588072f92bb813cf9a2e932c595d4c9f110754>
_______________________________________________
scap-security-guide mailing list
[email protected]
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

Reply via email to