Check: GEN003300
Solaris 10 X86 STIG:
GEN003300
(in versions v2 r4 through v1 r17)
Title
The at.deny file must not be empty if it exists. (Cat II impact)
Discussion
On some systems, if there is no at.allow file and there is an empty at.deny file, then the system assumes everyone has permission to use the at facility. This could create an insecure setting in the case of malicious users or system intruders.
Check Content
# more /etc/cron.d/at.deny If the at.deny file exists and is empty, this is a finding.
Fix Text
Add appropriate users to the at.deny file, or remove the empty at.deny file if an at.allow file exists.
Additional Identifiers
Rule ID: SV-227766r603266_rule
Vulnerability ID: V-227766
Group Title: SRG-OS-000480
Expert Comments
Expert comments are only available to logged-in users.
CCIs
CCIs tied to check.
| Number | Definition |
|---|---|
| CCI-000366 |
The organization implements the security configuration settings. |
Controls
Controls tied to check. These are derived from the CCIs shown above.
| Number | Title |
|---|---|
| CM-6 |
Configuration Settings |