用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-ubuntu1604-v200-5-1-8命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-ubuntu1604-v200-5-1-8 |
| description | Ensure cron is restricted to authorized users |
| category | cis-iam |
| version | 2.0.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-16.04","access-control"] |
| cis_id | 5.1.8 |
| cis_benchmark | CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0 |
| tech_stack |
| ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Configure /etc/cron.allow to allow specific users to use this service. If /etc/cron.allow does not exist, then /etc/cron.deny is checked. Any user not specifically defined in this file is allowed to use cron. By removing the file, only users in /etc/cron.allow are allowed to use cron.
Notes:
systemd timers, exist for scheduling jobs. If another method is used, cron should be removed, and the alternate method should be secured in accordance with local site policycron.allow, cron jobs can still be run as that usercron.allow file only controls administrative access to the crontab command for scheduling and modifying cron jobsOn many systems, only the system administrator is authorized to schedule cron jobs. Using the cron.allow file to control who can run cron jobs enforces this policy. It is easier to manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files.
None.
Run the following command and verify that /etc/cron.deny does not exist:
stat /etc/cron.deny
Run the following command and verify Uid and Gid are both 0/root and Access, does not grant write or execute to group, and does not grant permissions to other for /etc/cron.allow:
stat /etc/cron.allow
The first command should return:
stat: cannot stat '/etc/cron.deny': No such file or directory
The second command should return:
Access: (0640/-rw-r-----) Uid: ( 0/ root) Gid: ( 0/ root)
Run the following commands to remove /etc/cron.deny:
rm /etc/cron.deny
Run the following command to create /etc/cron.allow:
touch /etc/cron.allow
Run the following commands to set permissions and ownership for /etc/cron.allow:
chmod g-wx,o-rwx /etc/cron.allow
chown root:root /etc/cron.allow
By default, /etc/cron.deny exists and /etc/cron.allow does not exist.
None.
| Controls Version | Control |
|---|---|
| v7 | 14.6 Protect Information through Access Control Lists |
Automated