# Ensure cron daemon is enabled and active

Necessity: The cron daemon is the standard Unix/Linux job scheduler responsible for executing automated, time-based tasks. These tasks are critical for system health and security, including log rotation, security patch checks, system cleanup, and running backup scripts. If the cron service is disabled or not running, these essential maintenance and security operations will not execute, leading to potential security vulnerabilities, unmanaged log files that can fill up disk space, and missed backups. This neglect significantly increases the system's attack surface and risk of failure.

Auditing and Remediation: The audit script verifies the status of the 'cron.service' using systemd's 'systemctl' utility, specifically checking if it is set to start on boot ('enabled') and if it is currently running ('active'). The remediation script ensures this state by executing 'systemctl enable --now cron', which both enables the service for future boots and starts it immediately.

Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'enabled-active'. Unlike a setting with varying degrees of security, the cron daemon's function is binary for most systems: it is either required or it is not. For any server or workstation that relies on scheduled tasks for security and maintenance, the only secure and functional configuration is to have the service enabled and running. There is no intermediate state that provides a lesser or greater degree of security; its absence represents a critical operational and security gap.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled-active']` |
| **Moderate** | `['enabled-active']` |
| **Strict** | `['enabled-active']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'cron.service' is enabled and active using 'systemctl'. The script must return a single string representing the combined state in the format 'IS_ENABLED-IS_ACTIVE' (e.g., 'enabled-active'). The output must not contain any other text, labels, or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument for the desired state of the 'cron.service'. If the argument is 'enabled-active', the script must use 'systemctl' to both enable and start the service. The script must return the string 'true' on success and 'false' on failure or if the input argument is invalid.

