# Ensure cron daemon is enabled and active

Necessity: The cron daemon (`crond`) is a fundamental system service responsible for running scheduled tasks, such as log rotation, security patch checks, system maintenance scripts, and backups. Disabling this service prevents these critical, automated tasks from executing, which can lead to significant security risks like unpatched vulnerabilities, data loss from missed backups, and system instability due to unmanaged log files. Ensuring cron is active and enabled is essential for maintaining system health and security posture. Auditing and Remediation: The audit script checks the `systemd` service manager to verify that the `crond` service is both enabled (configured to start on boot) and active (currently running). The remediation script uses `systemctl` to both enable and start the service, ensuring it persists across reboots and is running in the current session. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'enabled-active'. This is a foundational service, not a tunable parameter with varying degrees of security. For a server to be considered properly configured and secure, its job scheduler must be operational. Any other state is a misconfiguration that directly impairs automated security and maintenance functions.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled-active']` |
| **Moderate** | `['enabled-active']` |
| **Strict** | `['enabled-active']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of the 'crond' service. The script must query `systemctl` to determine if the service is 'enabled' and if it is 'active'. The script should then output a single, combined string in the format 'enabled_status-active_status' (e.g., 'enabled-active', 'disabled-inactive') with no extra text or labels.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired state (e.g., 'enabled-active'). If the argument is 'enabled-active', the script must use `systemctl enable --now crond` to configure the service. The script must output 'true' on success or 'false' on failure.

