用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-ubuntu2004-v300-2-4-1-9命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-ubuntu2004-v300-2-4-1-9 |
| description | Ensure access to crontab is configured |
| category | cis-iam |
| version | 3.0.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-20.04","cron","job-schedulers"] |
| cis_id | 2.4.1.9 |
| cis_benchmark | CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0 |
| tech_stack | ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
crontab is the program used to install, deinstall, or list the tables used to drive the cron daemon. Each user can have their own crontab, and though files are created, they are not intended to be edited directly.
If the /etc/cron.allow file exists, then you must be listed (one user per line) therein in order to be allowed to use this command. If the /etc/cron.allow file does not exist but the /etc/cron.deny file does exist, then you must not be listed in the /etc/cron.deny file in order to use this command.
If neither of these files exists, then depending on site-dependent configuration parameters, only the super user will be allowed to use this command, or all users will be able to use this command.
If both files exist then /etc/cron.allow takes precedence. Which means that /etc/cron.deny is not considered and your user must be listed in /etc/cron.allow in order to be able to use the crontab.
Regardless of the existence of any of these files, the root administrative user is always allowed to setup a crontab.
The files /etc/cron.allow and /etc/cron.deny, if they exist, must be either world-readable, or readable by group crontab. If they are not, then cron will deny access to all users until the permissions are fixed.
There is one file for each user's crontab. Users are not allowed to edit the file directly to ensure that only users allowed by the system to run periodic tasks can add them, and only syntactically correct crontabs will be written. This is enforced by having the directory writable only by the crontab group and configuring crontab command with the setgid bid set for that specific group.
Note:
On many systems, only the system administrator is authorized to schedule cron jobs. Using the cron.allow file to control who can run cron jobs enforces this policy. It is easier to manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files.
Run the following command to verify /etc/cron.allow:
# stat -Lc 'Access: (%a/%A) Owner: (%U) Group: (%G)' /etc/cron.allow
Verify the returned value is:
Access: (640/-rw-r-----) Owner: (root) Group: (root)
- OR -
Access: (640/-rw-r-----) Owner: (root) Group: (crontab)
Run the following command to verify either cron.deny doesn't exist or is:
# [ -e "/etc/cron.deny" ] && stat -Lc 'Access: (%a/%A) Owner: (%U) Group: (%G)' /etc/cron.deny
Verify either nothing is returned - OR - returned value is one of the following:
Access: (640/-rw-r-----) Owner: (root) Group: (root)
- OR -
Access: (640/-rw-r-----) Owner: (root) Group: (crontab)
Note: On systems where cron is configured to use the group crontab, if the group crontab is not set as the owner of cron.allow, then cron will deny access to all users and you will see an error similar to:
You (<USERNAME>) are not allowed to use this program (crontab)
See crontab(1) for more information
Run the following script to:
#!/usr/bin/env bash
{
[ ! -e "/etc/cron.deny" ] && touch /etc/cron.allow
chmod u=rw,g=rwx,o=rwx /etc/cron.allow
if grep -Pq -- '^\h*crontab\:' /etc/group; then
chown root:crontab /etc/cron.allow
else
chown root:root /etc/cron.allow
fi
}
IF - /etc/cron.deny exists, run the following script to:
Change owner to user root
Change group owner to group root - OR - group crontab if it exists
Change mode to 640 or more restrictive
#!/usr/bin/env bash
{
if [ -e "/etc/cron.deny" ]; then
chmod u=rw,g=wx,o=rwx /etc/cron.deny
if grep -Pq -- '^\h*crontab\:' /etc/group; then
chown root:crontab /etc/cron.deny
else
chown root:root /etc/cron.deny
fi
fi
}
Note: On systems where cron is configured to use the group crontab, if the group crontab is not set as the owner of cron.allow, then cron will deny access to all users and you will see an error similar to:
You (<USERNAME>) are not allowed to use this program (crontab)
See crontab(1) for more information
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.3 Configure Data Access Control Lists Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications. | ● | ● | ● |
| v7 | 14.6 Protect Information through Access Control Lists Protect all information stored on systems with file system, network share, claims, application, or database specific access control lists. These controls will enforce the principle that only authorized individuals should have access to the information based on their need to access the information as a part of their responsibilities. | ● | ● | ● |
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| T1053, T1053.003 | TA0002 | M1018 |