CIS: Lock Down cron

EasyLinux Security15 min

The brief

The CIS Benchmark restricts who can schedule jobs and protects the cron configuration from tampering. Bring this host into line: /etc/crontab must be owner-only (600), the /etc/cron.d directory must be 700, and access must be allow-listed — /etc/cron.allow present and /etc/cron.deny removed. Grading reads the file permissions and access files the way a CIS-CAT scan would.

What you'll do

/etc/crontab is mode 600
/etc/cron.d directory is mode 700
/etc/cron.allow exists (allow-list model)
/etc/cron.deny is removed

Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.