8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
|
# File 'manifests/trusty64/cron.pp', line 8
class cis_benchmark::trusty64::cron {
## local variables: stig items
$cis_5_1_1 = $::cis_benchmark::cis_5_1_1
$cis_5_1_2 = $::cis_benchmark::cis_5_1_2
$cis_5_1_3 = $::cis_benchmark::cis_5_1_3
$cis_5_1_4 = $::cis_benchmark::cis_5_1_4
$cis_5_1_5 = $::cis_benchmark::cis_5_1_5
$cis_5_1_6 = $::cis_benchmark::cis_5_1_6
$cis_5_1_7 = $::cis_benchmark::cis_5_1_7
$cis_5_1_8 = $::cis_benchmark::cis_5_1_8
## ensure cron installed
package { 'cron':
ensure => 'installed',
}
## 5.1.1 Ensure cron daemon is enabled (Scored)
if ($cis_5_1_1) {
## ensure configuration
file { '/etc/init/cron.conf':
ensure => present,
mode => '0644',
owner => 'root',
group => 'root',
content => dos2unix(template('cis_benchmark/trusty64/cron/init_cron.conf.erb')),
}
## ensure running service
service { 'cron':
ensure => true,
enable => true,
}
}
## 5.1.2 Ensure permissions on /etc/crontab are configured (Scored)
if ($cis_5_1_2) {
file { '/etc/crontab':
ensure => present,
mode => '0700',
owner => 'root',
group => 'root',
content => dos2unix(template('cis_benchmark/trusty64/cron/crontab.erb')),
}
}
## 5.1.3 Ensure permissions on /etc/cron.hourly are configured (Scored)
if ($cis_5_1_3) {
file { '/etc/cron.hourly':
ensure => directory,
mode => '0700',
owner => 'root',
group => 'root',
}
}
## 5.1.4 Ensure permissions on /etc/cron.daily are configured (Scored)
if ($cis_5_1_4) {
file { '/etc/cron.daily':
ensure => directory,
mode => '0700',
owner => 'root',
group => 'root',
}
}
## 5.1.5 Ensure permissions on /etc/cron.weekly are configured (Scored)
if ($cis_5_1_5) {
file { '/etc/cron.weekly':
ensure => directory,
mode => '0700',
owner => 'root',
group => 'root',
}
}
## 5.1.6 Ensure permissions on /etc/cron.monthly are configured (Scored)
if ($cis_5_1_6) {
file { '/etc/cron.monthly':
ensure => directory,
mode => '0700',
owner => 'root',
group => 'root',
}
}
## 5.1.7 Ensure permissions on /etc/cron.d are configured (Scored)
if ($cis_5_1_7) {
file { '/etc/cron.d':
ensure => directory,
mode => '0700',
owner => 'root',
group => 'root',
}
}
## 5.1.8 Ensure at/cron is restricted to authorized users (Scored)
if ($cis_5_1_8) {
## ensure absent
file { '/etc/cron.deny':
ensure => absent,
}
file { '/etc/at.deny':
ensure => absent,
}
## ensure present
file { '/etc/cron.allow':
ensure => present,
mode => '0700',
owner => 'root',
group => 'root',
}
file { '/etc/at.allow':
ensure => present,
mode => '0700',
owner => 'root',
group => 'root',
}
}
}
|