Cis Ubuntu2004 V300 2 4 2 1

Ensure access to at is configured

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

at is a command-line utility used to schedule a job for later execution

Note: if at is not installed on the system, this section can be skipped

Audit

Verify /etc/at.allow:

Command Line

• Exists
• Is mode 0640 or more restrictive
• Is owned by the user root
• Is group owned by the group root - OR - the group daemon

# stat -Lc 'Access: (%a/%A) Owner: (%U) Group: (%G)' /etc/at.allow

Verify the returned value is:

Access: (640/-rw-r-----) Owner: (root) Group: (root)
- OR -
Access: (640/-rw-r-----) Owner: (root) Group: (daemon)

Run the following command to verify either at.deny doesn't exist or is:

• Mode 0640 or more restrictive
• Owned by the user root
• Is group owned by the group root - OR - the group daemon

# [ -e "/etc/at.deny" ] && stat -Lc 'Access: (%a/%A) Owner: (%U) Group: (%G)' /etc/at.deny

Verify either nothing is returned - OR - returned value is one of the following:

Access: (640/-rw-r-----) Owner: (root) Group: (root)
- OR -
Access: (640/-rw-r-----) Owner: (root) Group: (daemon)

Note: On systems where at is configured to use the group daemon, if the group daemon is not set as the owner of at.allow, then at will deny access to all users and you will see an error similar to:

You (<USERNAME>) are not allowed to use this program (at)
See at(1) for more information

Remediation

Run the following script to:

Command Line

• Create /etc/at.allow if it doesn't exist
• Change owner to user root
• Change group owner to group root - OR - group daemon if it exists
• Change mode to 640 or more restrictive

#!/usr/bin/env bash
{
  [ ! -e "/etc/at.deny" ] && touch /etc/at.allow
  chmod u=rw,g=wx,o=rwx /etc/at.allow
  if grep -Pq -- '^\h*daemon\:' /etc/group; then
    chown root:daemon /etc/at.allow
  else
    chown root:root /etc/at.allow
  fi
}

• IF - /etc/at.deny exists, run the following script to:

• Change owner to user root

• Change group owner to group root - OR - group daemon if it exists

• Change mode to 640 or more restrictive

#!/usr/bin/env bash
{
  if [ -e "/etc/at.deny" ]; then
    chmod u=rw,g=wx,o=rwx /etc/at.deny
    if grep -Pq -- '^\h*daemon\:' /etc/group; then
      chown root:daemon /etc/at.deny
    else
      chown root:root /etc/at.deny
    fi
  fi
}

Note: On systems where at is configured to use the group daemon, if the group daemon is not set as the owner of at.allow, then at will deny access to all users and you will see an error similar to:

You (<USERNAME>) are not allowed to use this program (at)
See at(1) for more information

References

1. NIST SP 800-53 Rev. 5: AC-3. MP-2

CIS Controls

MITRE ATT&CK Mappings