Keep the cron daemon enabled and running

Description

cron runs the jobs in /etc/crontab, /etc/cron.d/, the /etc/cron.hourly to /etc/cron.monthly directories and the users' crontabs. When the package is installed, cron.service must be enabled and running.

Debian cloud images do not install cron (systemd timers do the package maintenance); the control is then not applicable.

Rationale

Packages and administrators rely on cron for periodic tasks: integrity checks, report mails, cleanup jobs. A stopped daemon disables them without any error message.

Impact

None known.

Applies when

Detected: when: cron is installed A scanner reports the control not applicable when one is false.

Audit

systemctl is-enabled cron must print enabled and systemctl is-active cron must print active.

Automated: every check must pass. Scanners report each check by its id.

enabled

cron is enabled.

unit: cron.service
state: enabled

active

cron is running.

script: systemctl is-active cron.service || exit 1

Remediation

Run systemctl unmask cron if it is masked, then systemctl enable --now cron.

Rollback

Run systemctl disable --now cron.

enabled

Generated from check enabled: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• cron(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• systemctl(1), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-DEB-SVC-018 Restrict the system crontab and cron directories to root

People and lifecycle