# yaml-language-server: $schema=../../../../schema/control.schema.json id: CB-UBU-AUDIT-028 title: Audit changes to scheduled tasks and to the systemd journal finding: title: Changes to scheduled tasks and journal files are not recorded description: A scheduled task is a common persistence mechanism, and journal files can be removed to erase traces. status: active profiles: [server-hardened, desktop-hardened] risk: severity: low assessment: automated tags: [auditd, cron, journald] description: | auditd rules in `/etc/audit/rules.d/60-cirsec-cron.rules`: - writes to `/etc/crontab`, `/etc/cron.d/`, `/etc/cron.hourly/`, `/etc/cron.daily/`, `/etc/cron.weekly/`, `/etc/cron.monthly/` and the user crontabs in `/var/spool/cron/` (key `cron`); - writes and deletions in the persistent journal `/var/log/journal/` (key `journal`). rationale: | Adding a cron job is one of the simplest ways to keep code running on a system. Deleting or truncating journal files is a way to erase what happened. Both should leave an audit record. impact: | journald itself opens, rotates and removes journal files, which produces `journal` records from the `systemd-journald` process. notes: | These rules come from the ANSSI and STIG baselines; CIS has no equivalent. Watches on paths that do not exist yet (cron is not installed by default) are accepted. setting: location: /etc/audit/rules.d/60-cirsec-cron.rules default_value: No audit rules recommended_value: "Rules loaded (auditctl -l) and present in /etc/audit/rules.d/60-cirsec-cron.rules" audit: manual: | 1. Run `auditctl -l` as root. It must list the rules shown below (keys `cron`, `journal`). 2. Run `grep -h . /etc/audit/rules.d/*.rules`. The same rules must be present, so they load at boot. Expected rules, as `auditctl -l` prints them: ``` -w /etc/crontab -p wa -k cron -w /etc/cron.d -p wa -k cron -w /etc/cron.hourly -p wa -k cron -w /etc/cron.daily -p wa -k cron -w /etc/cron.weekly -p wa -k cron -w /etc/cron.monthly -p wa -k cron -w /var/spool/cron -p wa -k cron -w /var/log/journal -p wa -k journal ``` checks: - id: rules engine: shell description: Rules loaded in the kernel and present in /etc/audit/rules.d. spec: script: | command -v auditctl >/dev/null 2>&1 || { echo "auditctl not found: auditd is not installed"; exit 1; } want() { cat <<'RULES' -w /etc/crontab -p wa -k cron -w /etc/cron.d -p wa -k cron -w /etc/cron.hourly -p wa -k cron -w /etc/cron.daily -p wa -k cron -w /etc/cron.weekly -p wa -k cron -w /etc/cron.monthly -p wa -k cron -w /var/spool/cron -p wa -k cron -w /var/log/journal -p wa -k journal RULES } loaded=$(auditctl -l 2>&1) || { echo "$loaded"; exit 3; } disk=$(cat /etc/audit/rules.d/*.rules 2>/dev/null) n=0 rc=0 while IFS= read -r r; do [ -n "$r" ] || continue n=$((n + 1)) printf '%s\n' "$loaded" | grep -Fxq -- "$r" || { echo "not loaded: $r"; rc=1; } printf '%s\n' "$disk" | grep -Fxq -- "$r" || { echo "not in /etc/audit/rules.d: $r"; rc=1; } done </dev/null 2>&1 || { echo "auditd is not installed" >&2; exit 1; } want() { cat <<'RULES' -w /etc/crontab -p wa -k cron -w /etc/cron.d -p wa -k cron -w /etc/cron.hourly -p wa -k cron -w /etc/cron.daily -p wa -k cron -w /etc/cron.weekly -p wa -k cron -w /etc/cron.monthly -p wa -k cron -w /var/spool/cron -p wa -k cron -w /var/log/journal -p wa -k journal RULES } f=/etc/audit/rules.d/60-cirsec-cron.rules t=$(mktemp) { echo '# Written by CIRSEC Baselines CB-UBU-AUDIT-028'; want; } >"$t" if ! cmp -s "$t" "$f"; then cb_backup "$f" cat "$t" >"$f" fi rm -f "$t" chmod 640 "$f" if auditctl -s | grep -q '^enabled 2'; then echo "audit rules are locked (-e 2): reboot to load $f" else augenrules --load >/dev/null fi references: - title: audit.rules(7), Ubuntu manual pages url: https://manpages.ubuntu.com/manpages/noble/man7/audit.rules.7.html publisher: Canonical kind: vendor-doc accessed: 2026-10-19 - title: auditctl(8), Ubuntu manual pages url: https://manpages.ubuntu.com/manpages/noble/man8/auditctl.8.html publisher: Canonical kind: vendor-doc accessed: 2026-10-19 - title: ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R73) url: https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf publisher: ANSSI kind: guide accessed: 2026-10-19 mappings: - framework: anssi-linux framework_version: "2.0" id: "R73" relation: partial - framework: nist-800-53r5 framework_version: "5.1.1" id: "AU-12" relation: related - framework: nist-800-53r5 framework_version: "5.1.1" id: "AU-9" relation: related threats: - framework: mitre-attack id: T1053.003 - framework: mitre-attack id: T1070.002 related_controls: - id: CB-UBU-AUDIT-011 type: requires - id: CB-UBU-AUDIT-029 type: related authors: - name: Alice github: Sn0wAlice verified: - date: 2026-10-19 by: Sn0wAlice versions: ["20.04"] environment: Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic notes: "Fails after auditd install; rules written and loaded (augenrules), all present in auditctl -l with auditd 2.8.5; passes after reboot with enabled 2." - date: 2026-10-19 by: Sn0wAlice versions: ["22.04"] environment: Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic notes: "Fails after auditd install; rules written and loaded (augenrules), all present in auditctl -l with auditd 3.0.7; passes after reboot with enabled 2." - date: 2026-10-19 by: Sn0wAlice versions: ["24.04"] environment: Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic notes: "Fails after auditd install; rules written and loaded (augenrules), all present in auditctl -l with auditd 3.1.2; passes after reboot with enabled 2." - date: 2026-10-19 by: Sn0wAlice versions: ["26.04"] environment: Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic notes: "Fails after auditd install; rules written and loaded (augenrules), all present in auditctl -l with auditd 4.1.2; passes after reboot with enabled 2." introduced_in: 0.1.0 created: 2026-10-19 updated: 2026-10-19