# yaml-language-server: $schema=../../../../schema/control.schema.json id: CB-DEB-AUDIT-028 title: Audit changes to scheduled tasks and to the systemd journal finding: title: Changes to scheduled tasks and journal files are not recorded description: A scheduled task is a common persistence mechanism, and journal files can be removed to erase traces. status: active profiles: [server-hardened, desktop-hardened] risk: severity: low assessment: automated tags: [auditd, cron, journald] description: | auditd rules in `/etc/audit/rules.d/60-cirsec-cron.rules`: - writes to `/etc/crontab`, `/etc/cron.d/`, `/etc/cron.hourly/`, `/etc/cron.daily/`, `/etc/cron.weekly/`, `/etc/cron.monthly/` and the user crontabs in `/var/spool/cron/` (key `cron`); - writes and deletions in the persistent journal `/var/log/journal/` (key `journal`). rationale: | Adding a cron job is one of the simplest ways to keep code running on a system. Deleting or truncating journal files is a way to erase what happened. Both should leave an audit record. impact: | journald itself opens, rotates and removes journal files, which produces `journal` records from the `systemd-journald` process. notes: | These rules come from the ANSSI and STIG baselines; CIS has no equivalent. Watches on paths that do not exist yet (cron is not installed by default) are accepted. setting: location: /etc/audit/rules.d/60-cirsec-cron.rules default_value: No audit rules recommended_value: "Rules loaded (auditctl -l) and present in /etc/audit/rules.d/60-cirsec-cron.rules" audit: manual: | 1. Run `auditctl -l` as root. It must list the rules shown below (keys `cron`, `journal`). 2. Run `grep -h . /etc/audit/rules.d/*.rules`. The same rules must be present, so they load at boot. Expected rules, as `auditctl -l` prints them: ``` -w /etc/crontab -p wa -k cron -w /etc/cron.d -p wa -k cron -w /etc/cron.hourly -p wa -k cron -w /etc/cron.daily -p wa -k cron -w /etc/cron.weekly -p wa -k cron -w /etc/cron.monthly -p wa -k cron -w /var/spool/cron -p wa -k cron -w /var/log/journal -p wa -k journal ``` checks: - id: rules engine: shell description: Rules loaded in the kernel and present in /etc/audit/rules.d. spec: script: | command -v auditctl >/dev/null 2>&1 || { echo "auditctl not found: auditd is not installed"; exit 1; } want() { cat <<'RULES' -w /etc/crontab -p wa -k cron -w /etc/cron.d -p wa -k cron -w /etc/cron.hourly -p wa -k cron -w /etc/cron.daily -p wa -k cron -w /etc/cron.weekly -p wa -k cron -w /etc/cron.monthly -p wa -k cron -w /var/spool/cron -p wa -k cron -w /var/log/journal -p wa -k journal RULES } loaded=$(auditctl -l 2>&1) || { echo "$loaded"; exit 3; } disk=$(cat /etc/audit/rules.d/*.rules 2>/dev/null) n=0 rc=0 while IFS= read -r r; do [ -n "$r" ] || continue n=$((n + 1)) printf '%s\n' "$loaded" | grep -Fxq -- "$r" || { echo "not loaded: $r"; rc=1; } printf '%s\n' "$disk" | grep -Fxq -- "$r" || { echo "not in /etc/audit/rules.d: $r"; rc=1; } done </dev/null 2>&1 || { echo "auditd is not installed" >&2; exit 1; } want() { cat <<'RULES' -w /etc/crontab -p wa -k cron -w /etc/cron.d -p wa -k cron -w /etc/cron.hourly -p wa -k cron -w /etc/cron.daily -p wa -k cron -w /etc/cron.weekly -p wa -k cron -w /etc/cron.monthly -p wa -k cron -w /var/spool/cron -p wa -k cron -w /var/log/journal -p wa -k journal RULES } f=/etc/audit/rules.d/60-cirsec-cron.rules t=$(mktemp) { echo '# Written by CIRSEC Baselines CB-DEB-AUDIT-028'; want; } >"$t" if ! cmp -s "$t" "$f"; then cb_backup "$f" cat "$t" >"$f" fi rm -f "$t" chmod 640 "$f" if auditctl -s | grep -q '^enabled 2'; then echo "audit rules are locked (-e 2): reboot to load $f" else augenrules --load >/dev/null fi references: - title: audit.rules(7), Debian manual pages url: https://manpages.debian.org/trixie/auditd/audit.rules.7.en.html publisher: Debian kind: vendor-doc accessed: 2026-10-18 - title: auditctl(8), Debian manual pages url: https://manpages.debian.org/trixie/auditd/auditctl.8.en.html publisher: Debian kind: vendor-doc accessed: 2026-10-18 - title: ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R73) url: https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf publisher: ANSSI kind: guide accessed: 2026-10-18 mappings: - framework: anssi-linux framework_version: "2.0" id: "R73" relation: partial - framework: nist-800-53r5 framework_version: "5.1.1" id: "AU-12" relation: related - framework: nist-800-53r5 framework_version: "5.1.1" id: "AU-9" relation: related threats: - framework: mitre-attack id: T1053.003 - framework: mitre-attack id: T1070.002 related_controls: - id: CB-DEB-AUDIT-011 type: requires - id: CB-DEB-AUDIT-029 type: related authors: - name: Alice github: Sn0wAlice verified: - date: 2026-10-18 by: Sn0wAlice versions: ["12"] environment: Proxmox VM, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64, auditd 1:3.0.9-1, BIOS boot notes: "Rules fail on fresh install; fix writes /etc/audit/rules.d/60-cirsec-cron.rules and loads it; rules match auditctl -l, kept after reboot; second run idempotent." - date: 2026-10-18 by: Sn0wAlice versions: ["13"] environment: Proxmox VM, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64, auditd 1:4.0.2-2+deb13u1, BIOS boot notes: "Rules fail on fresh install; fix writes /etc/audit/rules.d/60-cirsec-cron.rules and loads it; rules match auditctl -l, kept after reboot; second run idempotent." introduced_in: 0.1.0 created: 2026-10-18 updated: 2026-10-18