Audit changes to scheduled tasks and to the systemd journal

Description

auditd rules in /etc/audit/rules.d/60-cirsec-cron.rules:

• writes to /etc/crontab, /etc/cron.d/, /etc/cron.hourly/, /etc/cron.daily/, /etc/cron.weekly/, /etc/cron.monthly/ and the user crontabs in /var/spool/cron/ (key cron);
• writes and deletions in the persistent journal /var/log/journal/ (key journal).

These rules come from the ANSSI and STIG baselines; CIS has no equivalent. Watches on paths that do not exist yet (cron is not installed by default) are accepted.

Rationale

Adding a cron job is one of the simplest ways to keep code running on a system. Deleting or truncating journal files is a way to erase what happened. Both should leave an audit record.

Impact

journald itself opens, rotates and removes journal files, which produces journal records from the systemd-journald process.

Setting

Audit

1. Run auditctl -l as root. It must list the rules shown below (keys cron, journal).
2. Run grep -h . /etc/audit/rules.d/*.rules. The same rules must be present, so they load at boot.

Expected rules, as auditctl -l prints them:

-w /etc/crontab -p wa -k cron
-w /etc/cron.d -p wa -k cron
-w /etc/cron.hourly -p wa -k cron
-w /etc/cron.daily -p wa -k cron
-w /etc/cron.weekly -p wa -k cron
-w /etc/cron.monthly -p wa -k cron
-w /var/spool/cron -p wa -k cron
-w /var/log/journal -p wa -k journal

Automated: every check must pass. Scanners report each check by its id.

rules

Rules loaded in the kernel and present in /etc/audit/rules.d.

script: |
  command -v auditctl >/dev/null 2>&1 || { echo "auditctl not found: auditd is not installed"; exit 1; }
  want() {
  cat <<'RULES'
  -w /etc/crontab -p wa -k cron
  -w /etc/cron.d -p wa -k cron
  -w /etc/cron.hourly -p wa -k cron
  -w /etc/cron.daily -p wa -k cron
  -w /etc/cron.weekly -p wa -k cron
  -w /etc/cron.monthly -p wa -k cron
  -w /var/spool/cron -p wa -k cron
  -w /var/log/journal -p wa -k journal
  RULES
  }
  loaded=$(auditctl -l 2>&1) || { echo "$loaded"; exit 3; }
  disk=$(cat /etc/audit/rules.d/*.rules 2>/dev/null)
  n=0 rc=0
  while IFS= read -r r; do
    [ -n "$r" ] || continue
    n=$((n + 1))
    printf '%s\n' "$loaded" | grep -Fxq -- "$r" || { echo "not loaded: $r"; rc=1; }
    printf '%s\n' "$disk" | grep -Fxq -- "$r" || { echo "not in /etc/audit/rules.d: $r"; rc=1; }
  done <<EOF
  $(want)
  EOF
  [ "$rc" = 1 ] || echo "$n rules loaded and present in /etc/audit/rules.d"
  exit "$rc"

Remediation

1. Write the expected rules to /etc/audit/rules.d/60-cirsec-cron.rules (mode 0640).
2. Run augenrules --load. If auditctl -s shows enabled 2, the configuration is locked: reboot to load the new rules.

Rollback

Delete /etc/audit/rules.d/60-cirsec-cron.rules and run augenrules --load (or reboot if the configuration is locked).

rules-file

command -v augenrules >/dev/null 2>&1 || { echo "auditd is not installed" >&2; exit 1; }
want() {
cat <<'RULES'
-w /etc/crontab -p wa -k cron
-w /etc/cron.d -p wa -k cron
-w /etc/cron.hourly -p wa -k cron
-w /etc/cron.daily -p wa -k cron
-w /etc/cron.weekly -p wa -k cron
-w /etc/cron.monthly -p wa -k cron
-w /var/spool/cron -p wa -k cron
-w /var/log/journal -p wa -k journal
RULES
}
f=/etc/audit/rules.d/60-cirsec-cron.rules
t=$(mktemp)
{ echo '# Written by CIRSEC Baselines CB-DEB-AUDIT-028'; want; } >"$t"
if ! cmp -s "$t" "$f"; then
  cb_backup "$f"
  cat "$t" >"$f"
fi
rm -f "$t"
chmod 640 "$f"
if auditctl -s | grep -q '^enabled 2'; then
  echo "audit rules are locked (-e 2): reboot to load $f"
else
  augenrules --load >/dev/null
fi

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• audit.rules(7), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• auditctl(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R73) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-DEB-AUDIT-011 Install and run the audit daemon
• related CB-DEB-AUDIT-029 Lock the audit configuration and load every valid rule

People and lifecycle