securing oracle linux 9 article 13 configuring job schedulers cron and at

سیستم عامل و زیرساخت Hits: 7

In the previous part

Configuring Time Synchronization

was completed.

1. CIS Benchmark Requirements (Section 2.4)

This section addresses the securing and restriction of access to task scheduling services (cron and at):

  • 2.4.1 Configure cron
    • 2.4.1.1 Ensure cron daemon is enabled and active (Automated)
    • 2.4.1.2 Ensure permissions on /etc/crontab are configured (Automated)
    • 2.4.1.3 Ensure permissions on /etc/cron.hourly are configured (Automated)
    • 2.4.1.4 Ensure permissions on /etc/cron.daily are configured (Automated)
    • 2.4.1.5 Ensure permissions on /etc/cron.weekly are configured (Automated)
    • 2.4.1.6 Ensure permissions on /etc/cron.monthly are configured (Automated)
    • 2.4.1.7 Ensure permissions on /etc/cron.d are configured (Automated)
    • 2.4.1.8 Ensure crontab is restricted to authorized users (Automated)
  • 2.4.2 Configure at
    • 2.4.2.1 Ensure at is restricted to authorized users (Automated)

 

2. Concept & Rationale

Concept: The cron and at services are used for the scheduled execution of scripts and commands. Since many of these tasks run at the system level with root privileges, the goal of these requirements is to prevent unauthorized access to their configuration files.

Security Reason: If the permissions for configuration folders and files are open, unauthorized users could escalate their privileges (Privilege Escalation) by injecting malicious code into scheduled scripts. Restricting access only to verified users and setting 0600 permissions for files and 0700 for folders significantly reduces the attack surface.

 

3. Oracle Database Compatibility Check (RAC, ASM, Grid)

  • High Potential for Conflict: Database Administrators (DBAs) rely heavily on cron for executing RMAN backup scripts, log cleaning, system log collection, and monitoring. Careless restriction of this service will cause all these processes to fail.
  • Solution & Conflict Resolution: When implementing requirement 2.4.1.8 (creating the /etc/cron.allow file and removing /etc/cron.deny), the oracle and grid users MUST be added to /etc/cron.allow immediately. Otherwise, Oracle's scheduled tasks will be disrupted.
  • Permission Compatibility: Applying restrictions to /etc/cron.* folders does not create a conflict, as Oracle users typically use the crontab -e command, and their tasks are stored directly in the /var/spool/cron path.

 

4. Checking the Current Status (Audit Script)

The following script checks the service status and the permission levels of critical cron and at files/folders:

GitHub link:

modules/audit_13_Job_Schedulers_Cron_At.sh

If you are not familiar with bash scripts, you can refer to the training material I have published on the site for database administrators.

Bash for Oracle DBAs

 

#!/bin/bash
# Script: audit13.sh
# Purpose: Audit Script for Job Schedulers - Cron & At (CIS 2.4)

echo "=========================================================================="
echo " CIS Requirement: 2.4 Job Schedulers"
echo " - Ensure cron daemon is active and permissions are tightly configured."
echo " Oracle Context:"
echo " - CRITICAL: 'oracle' and 'grid' users MUST be allowed to use cron."
echo " - Database backups (RMAN) and maintenance jobs rely heavily on crontab."
echo "=========================================================================="

FAIL_COUNT=0

echo -e "\n[*] Auditing Cron & At Configurations..."

# 1. Check crond service
if systemctl is-enabled crond &>/dev/null && systemctl is-active crond &>/dev/null; then
    echo -e "  \e[32m[PASS]\e[0m crond service is enabled and active."
else
    echo -e "  \e[31m[FAIL]\e[0m crond service is NOT enabled/active."
    FAIL_COUNT=$((FAIL_COUNT + 1))
fi

# 2. Check /etc/crontab permissions
if [ "$(stat -c "%a %U %G" /etc/crontab 2>/dev/null)" = "600 root root" ]; then
    echo -e "  \e[32m[PASS]\e[0m /etc/crontab permissions are correct (0600 root:root)."
else
    echo -e "  \e[31m[FAIL]\e[0m /etc/crontab permissions are incorrect."
    FAIL_COUNT=$((FAIL_COUNT + 1))
fi

# 3. Check cron directories permissions
for dir in /etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly /etc/cron.d; do
    if [ -d "$dir" ]; then
        if [ "$(stat -c "%a %U %G" "$dir" 2>/dev/null)" = "700 root root" ]; then
            echo -e "  \e[32m[PASS]\e[0m $dir permissions are correct."
        else
            echo -e "  \e[31m[FAIL]\e[0m $dir permissions are incorrect."
            FAIL_COUNT=$((FAIL_COUNT + 1))
        fi
    fi
done

# 4. Check cron access control
if [ ! -f /etc/cron.deny ] && [ -f /etc/cron.allow ] && [ "$(stat -c "%a %U %G" /etc/cron.allow 2>/dev/null)" = "600 root root" ]; then
    echo -e "  \e[32m[PASS]\e[0m cron.allow exists (0600 root:root) and cron.deny is absent."
else
    echo -e "  \e[31m[FAIL]\e[0m cron access control is not properly configured."
    FAIL_COUNT=$((FAIL_COUNT + 1))
fi

# 5. Check at access control
if [ ! -f /etc/at.deny ] && [ -f /etc/at.allow ] && [ "$(stat -c "%a %U %G" /etc/at.allow 2>/dev/null)" = "600 root root" ]; then
    echo -e "  \e[32m[PASS]\e[0m at.allow exists (0600 root:root) and at.deny is absent."
else
    echo -e "  \e[31m[FAIL]\e[0m at access control is not properly configured."
    FAIL_COUNT=$((FAIL_COUNT + 1))
fi

# 6. Oracle Context: Check if oracle/grid are whitelisted in cron.allow
if grep -q "^oracle$" /etc/cron.allow 2>/dev/null || grep -q "^grid$" /etc/cron.allow 2>/dev/null; then
    echo -e "  \e[32m[PASS]\e[0m Oracle/Grid users are correctly whitelisted in /etc/cron.allow."
else
    echo -e "  \e[31m[FAIL]\e[0m Oracle/Grid users are MISSING from /etc/cron.allow!"
    FAIL_COUNT=$((FAIL_COUNT + 1))
fi

if [ "$FAIL_COUNT" -eq 0 ]; then
    echo -e "\n\e[32m[+] AUDIT RESULT: PASS\e[0m"
else
    echo -e "\n\e[31m[-] AUDIT RESULT: FAIL ($FAIL_COUNT issues found)\e[0m"
fi

5. Applying the Configuration (Remediation Bash Script)

This script corrects permissions and whitelists Oracle users to prevent backup outages:

GitHub link:

modules/remediate_13_Job_Schedulers_Cron_At.sh

 

#!/bin/bash
# Script: remediation13.sh
# Purpose: Configure Job Schedulers (Cron & At) (CIS 2.4)

if [ "$EUID" -ne 0 ]; then
    echo "Please run as root"
    exit 1
fi

echo "=========================================================================="
echo " Applying Remediation for CIS 2.4 (Job Schedulers)"
echo " Oracle Context: Ensuring 'oracle' and 'grid' can execute scheduled jobs."
echo "=========================================================================="

echo -e "\n[*] Configuring Cron and At..."

# 1. Enable and start crond
systemctl enable --now crond > /dev/null 2>&1
echo -e "  \e[32m[OK]\e[0m Enabled and started crond service."

# 2. Set permissions for /etc/crontab
chown root:root /etc/crontab
chmod 0600 /etc/crontab
echo -e "  \e[32m[OK]\e[0m Set permissions on /etc/crontab."

# 3. Set permissions for cron directories
for dir in /etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly /etc/cron.d; do
    if [ -d "$dir" ]; then
        chown root:root "$dir"
        chmod 0700 "$dir"
    fi
done
echo -e "  \e[32m[OK]\e[0m Set permissions on /etc/cron.* directories."

# 4. Restrict crontab access
rm -f /etc/cron.deny
touch /etc/cron.allow
chown root:root /etc/cron.allow
chmod 0600 /etc/cron.allow

# 5. Restrict at access
rm -f /etc/at.deny
touch /etc/at.allow
chown root:root /etc/at.allow
chmod 0600 /etc/at.allow

echo -e "  \e[32m[OK]\e[0m Configured cron.allow and at.allow (denied others)."

# 6. Oracle DBA Exception: Allow oracle and grid users
grep -q "^oracle$" /etc/cron.allow || echo "oracle" >> /etc/cron.allow
grep -q "^grid$" /etc/cron.allow || echo "grid" >> /etc/cron.allow
# Optional: also allow root explicitly
grep -q "^root$" /etc/cron.allow || echo "root" >> /etc/cron.allow

echo -e "  \e[32m[OK]\e[0m Whitelisted 'root', 'oracle', and 'grid' users in /etc/cron.allow."

echo -e "\n\e[32m[+] REMEDIATION APPLIED SUCCESSFULLY\e[0m"

In the next part, we will move on to:

Securing Network Configuration and Kernel Parameters