Restrict the system crontab and cron directories to root

Description

The system cron jobs live in /etc/crontab, /etc/cron.d/ and the /etc/cron.hourly, cron.daily, cron.weekly, cron.monthly and cron.yearly directories. They must belong to root:root, with mode 0600 for the file and 0700 for the directories, or stricter.

Debian ships these paths with mode 0644 and 0755, so the control fails on a fresh install of cron. A missing directory (/etc/cron.yearly is not created by every version) makes its check not applicable.

Rationale

These jobs run as root. Reading them tells an attacker which scripts to target and when they run; a writable job or directory is a direct path to root.

Impact

Users can no longer list the system cron jobs. cron runs as root and is not affected.

Applies when

Detected: when: cron is installed A scanner reports the control not applicable when one is false.

Setting

Audit

Run stat -Lc '%n %U:%G %a' /etc/crontab /etc/cron.d /etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly /etc/cron.yearly. Each must be root:root, with mode 600 for /etc/crontab and 700 for the directories, or stricter.

Automated: every check must pass. Scanners report each check by its id.

crontab

/etc/crontab.

path: /etc/crontab
owner: root
group: root
mode: '0600'

cron-hourly

/etc/cron.hourly.

path: /etc/cron.hourly
owner: root
group: root
mode: '0700'

cron-daily

/etc/cron.daily.

path: /etc/cron.daily
owner: root
group: root
mode: '0700'

cron-weekly

/etc/cron.weekly.

path: /etc/cron.weekly
owner: root
group: root
mode: '0700'

cron-monthly

/etc/cron.monthly.

path: /etc/cron.monthly
owner: root
group: root
mode: '0700'

cron-yearly

/etc/cron.yearly.

path: /etc/cron.yearly
owner: root
group: root
mode: '0700'

cron-d

/etc/cron.d.

path: /etc/cron.d
owner: root
group: root
mode: '0700'

Remediation

Run chown root:root /etc/crontab /etc/cron.d /etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly /etc/cron.yearly, chmod 600 /etc/crontab and chmod 700 /etc/cron.d /etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly /etc/cron.yearly.

Rollback

Run chmod 644 /etc/crontab and chmod 755 on the directories.

crontab

Generated from check crontab: the engine writes the fix for every output, it sets the expected value and the check runs again after.

cron-hourly

Generated from check cron-hourly: the engine writes the fix for every output, it sets the expected value and the check runs again after.

cron-daily

Generated from check cron-daily: the engine writes the fix for every output, it sets the expected value and the check runs again after.

cron-weekly

Generated from check cron-weekly: the engine writes the fix for every output, it sets the expected value and the check runs again after.

cron-monthly

Generated from check cron-monthly: the engine writes the fix for every output, it sets the expected value and the check runs again after.

cron-yearly

Generated from check cron-yearly: the engine writes the fix for every output, it sets the expected value and the check runs again after.

cron-d

Generated from check cron-d: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• cron(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R50) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle