cis-ubuntu2004-v300-2-4-2-1

name	cis-ubuntu2004-v300-2-4-2-1
description	Ensure access to at is configured
category	cis-iam
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","at","job-schedulers"]
cis_id	2.4.2.1
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure access to at is configured

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

at is a command-line utility used to schedule a job for later execution

Note: if at is not installed on the system, this section can be skipped

Audit

Verify /etc/at.allow:

Command Line

• Exists
• Is mode 0640 or more restrictive
• Is owned by the user root
• Is group owned by the group root - OR - the group daemon

# stat -Lc 'Access: (%a/%A) Owner: (%U) Group: (%G)' /etc/at.allow

Verify the returned value is:

Access: (640/-rw-r-----) Owner: (root) Group: (root)
- OR -
Access: (640/-rw-r-----) Owner: (root) Group: (daemon)

Run the following command to verify either at.deny doesn't exist or is:

• Mode 0640 or more restrictive
• Owned by the user root
• Is group owned by the group root - OR - the group daemon

# [ -e "/etc/at.deny" ] && stat -Lc 'Access: (%a/%A) Owner: (%U) Group: (%G)' /etc/at.deny

Verify either nothing is returned - OR - returned value is one of the following:

Access: (640/-rw-r-----) Owner: (root) Group: (root)
- OR -
Access: (640/-rw-r-----) Owner: (root) Group: (daemon)

Note: On systems where at is configured to use the group daemon, if the group daemon is not set as the owner of at.allow, then at will deny access to all users and you will see an error similar to:

You (<USERNAME>) are not allowed to use this program (at)
See at(1) for more information

Remediation

Run the following script to:

Command Line

• Create /etc/at.allow if it doesn't exist
• Change owner to user root
• Change group owner to group root - OR - group daemon if it exists
• Change mode to 640 or more restrictive

#!/usr/bin/env bash
{
  [ ! -e "/etc/at.deny" ] && touch /etc/at.allow
  chmod u=rw,g=wx,o=rwx /etc/at.allow
  if grep -Pq -- '^\h*daemon\:' /etc/group; 
     root:daemon /etc/at.allow
  
     root:root /etc/at.allow
  
}