# Ensure crontab is restricted to authorized users

The cron daemon is a time-based job scheduler that enables users to execute commands or scripts at specified intervals. Restricting access to crontab is crucial to prevent unauthorized users from scheduling jobs that could lead to privilege escalation, unauthorized data access, or denial-of-service attacks by consuming system resources. An unrestricted cron service allows any user to schedule tasks, creating a significant security vulnerability.

The audit script checks for the presence of `/etc/cron.allow` and `/etc/cron.deny` to determine the current access control method. The remediation script enforces the most secure configuration by creating and properly permissioning `/etc/cron.allow` while ensuring `/etc/cron.deny` is removed.

The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'Allow Configured'. This enforces a default-deny policy, aligning with the principle of least privilege. By using `/etc/cron.allow`, administrators must explicitly grant cron access to users, which is inherently more secure than using `/etc/cron.deny` (a blocklist) where any new or unlisted user could potentially schedule jobs. The unrestricted state, where neither file exists, is highly insecure as it permits all users to use cron.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Allow Configured']` |
| **Moderate** | `['Allow Configured']` |
| **Strict** | `['Allow Configured']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that audits the crontab access control configuration. The script must check for the existence of `/etc/cron.allow` and `/etc/cron.deny`. If `/etc/cron.allow` exists, the script must return the string 'Allow Configured'. If `/etc/cron.allow` does not exist but `/etc/cron.deny` does, it must return 'Deny Configured'. If neither file exists, it must return 'Unrestricted'. The output must only be one of these three strings, with no additional text.

## Remediation Script Working

Bash script that configures crontab access control based on a single positional argument. If the argument is 'Allow Configured', the script must create an empty `/etc/cron.allow` file if it does not exist, set its ownership to `root:root`, set its permissions to `600`, and remove the `/etc/cron.deny` file if it exists. The script must return `true` on successful configuration or if the system is already in the desired state, and `false` on any failure.

