# Ensure crontab is restricted to authorized users

Necessity: The `cron` daemon is a powerful utility that allows users to schedule recurring tasks. Unrestricted access to `crontab` can be a significant security risk. Malicious actors or unauthorized users could schedule jobs to maintain persistence, escalate privileges, exfiltrate data, or disrupt services. Restricting `crontab` access to a small, authorized set of users enforces the principle of least privilege and reduces the system's attack surface.

Auditing and Remediation: The audit script checks for the recommended secure configuration, which involves using an explicit allow-list (`/etc/cron.allow`) and ensuring a deny-list (`/etc/cron.deny`) is not present. This configuration ensures that only users explicitly listed in `/etc/cron.allow` can use the scheduler. The remediation script establishes this state by creating and setting the correct ownership and permissions for `/etc/cron.allow` while removing `/etc/cron.deny`.

Recommended State Rationale: For this control, the recommended state is binary; it is either securely configured or it is not. Therefore, the 'Configured' state is recommended for all security levels. 
- Basic/Moderate/Strict: All levels require the state to be 'Configured'. This establishes a default-deny policy, which is a fundamental security practice. The distinction between security levels for this control would lie in the contents of the `/etc/cron.allow` file (i.e., how few administrative accounts are permitted), rather than the configuration of the control mechanism itself.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Configured']` |
| **Moderate** | `['Configured']` |
| **Strict** | `['Configured']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if access to `crontab` is restricted according to security best practices. The script must verify that the file `/etc/cron.allow` exists, is owned by `root:root`, and has permissions set to `600`. It must also verify that `/etc/cron.deny` does not exist. If all these conditions are met, the script must return the string `Configured`. In all other cases, it must return `Not Configured`.

## Remediation Script Working

Bash script that accepts a single positional argument, which should be the string `Configured`. Upon receiving this argument, the script must enforce `crontab` restrictions by: 1. Removing the `/etc/cron.deny` file if it exists. 2. Creating the `/etc/cron.allow` file if it does not exist. 3. Setting the ownership of `/etc/cron.allow` to `root:root`. 4. Setting the permissions of `/etc/cron.allow` to `600`. The script must return `true` if the operation is successful, and `false` otherwise.

