Check: GEN003280
SUSE Linux Enterprise Server v11 for System z STIG:
GEN003280
(in versions v1 r12 through v1 r9)
Title
Access to the at utility must be controlled via the at.allow and/or at.deny file(s). (Cat II impact)
Discussion
The "at" facility selectively allows users to execute jobs at deferred times. It is usually used for one-time jobs. The at.allow file selectively allows access to the "at" facility. If there is no at.allow file, there is no ready documentation of who is allowed to submit "at" jobs.
Check Content
If the “at” package is not installed, this is not applicable. Check for the existence of at.allow and at.deny files. # ls -lL /etc/at.allow # ls -lL /etc/at.deny If neither file exists, this is a finding.
Fix Text
Create at.allow and/or at.deny files containing appropriate lists of users to be allowed or denied access to the "at" daemon.
Additional Identifiers
Rule ID: SV-45648r2_rule
Vulnerability ID: V-984
Group Title: GEN003280
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000225 |
The organization employs the concept of least privilege, allowing only authorized accesses for users (and processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions. |
Controls
| Number | Title |
|---|---|
| AC-6 |
Least Privilege |