documentation_complete: true


title: 'Verify Permissions on cron.monthly'

description: |-
    {{{ describe_file_permissions(file="/etc/cron.monthly", perms="0700") }}}

rationale: |-
    Service configuration files enable or disable features of their respective services that if configured incorrectly
    can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the
    correct access rights to prevent unauthorized changes.

severity: medium

identifiers:
    cce@rhel8: CCE-82263-5
    cce@rhel9: CCE-84181-7
    cce@rhel10: CCE-86632-7
    cce@sle12: CCE-91671-8
    cce@sle15: CCE-91303-8

references:
    cis-csc: 12,13,14,15,16,18,3,5
    cis@sle12: 5.1.6
    cis@sle15: 5.1.6
    cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02
    isa-62443-2009: 4.3.3.7.3
    isa-62443-2013: 'SR 2.1,SR 5.2'
    iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
    nist: CM-6(a),AC-6(1)
    nist-csf: PR.AC-4,PR.DS-5
    srg: SRG-OS-000480-GPOS-00227

ocil_clause: '{{{ ocil_clause_file_permissions(file="/etc/cron.monthly", perms="-rwx------") }}}'

ocil: |-
    {{{ ocil_file_permissions(file="/etc/cron.monthly", perms="-rwx------") }}}

fixtext: '{{{ fixtext_directory_permissions(file="/etc/cron.monthly/", mode="0700") }}}'

srg_requirement: '{{{ srg_requirement_directory_permission(file="/etc/cron.monthly", mode="0700") }}}'

template:
    name: file_permissions
    vars:
        filepath: /etc/cron.monthly/
        filemode: '0700'
