Ensure that /etc/at.allow exists
Ensures /etc/at.allow exists (owned by root:root, mode 0600) so at job scheduling is restricted to an explicit allow list.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The at daemon decides who may schedule jobs based on at.allow/at.deny. When at.allow exists, only users listed in it (plus root) can schedule jobs, a default-deny posture. An allow list is far safer than a deny list: forgetting to add a new account to a deny list silently grants access, whereas an allow list grants nothing by default. An empty, root-owned at.allow blocks all non-root scheduling.
What Pavois checks
Pavois verifies the actual file /etc/at.allow exists on the live system (the InSpec file resource queries the real inode, not a config template). The presence of this file is itself the effective access-control state the at daemon reads at job-submission time.
describe file('/etc/at.allow') do
it { should exist }
endHow to verify it is applied
Run ls -l /etc/at.allow and confirm it exists with owner root, group root, mode 0600. Test enforcement by attempting echo 'true' | at now + 1 minute as a non-listed user (it should be refused). Re-running the InSpec command should pass.
Inspect & investigate
Inspect the file state with stat /etc/at.allow. Rejected at submissions and accepted jobs are logged by the at/atd service via journalctl -u atd (or /var/log/syslog / /var/log/cron, distro dependent).
Remediation
pavois harden apply uses the file resource to create /etc/at.allow as an empty file owned by root:root with mode 0600. An empty allow list means only root may schedule at jobs; add usernames (one per line) afterward to grant specific accounts.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| content | |
|---|---|
| group | daemon |
| mode | 0640 |
| owner | root |
| path | /etc/at.allow |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Creating an empty at.allow immediately blocks all non-root users from using at. If legitimate users or scripts rely on at, add their usernames to the file before or right after applying, otherwise their scheduling will silently fail. No service restart is required; the change takes effect on the next at submission.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.4.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.