Ensure that /etc/at.deny does not exist
Ensures /etc/at.deny does not exist, so at access is governed solely by the allow list (/etc/at.allow) under a default-deny model.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
When both files are present, at consults at.allow first and at.deny is ignored, but leaving a stale at.deny invites confusion and a default-permit fallback if at.allow is ever removed. A deny list is inherently risky: any account not explicitly denied is allowed, so a forgotten or newly created user silently gains access. Removing at.deny forces reliance on the safer allow-list model.
What Pavois checks
Pavois verifies the actual absence of /etc/at.deny on the live system via the InSpec file resource, which queries the real filesystem rather than any template. This absence is the effective access-control state read by the at daemon.
describe file('/etc/at.deny') do
it { should_not exist }
endHow to verify it is applied
Run test ! -e /etc/at.deny && echo absent (expect absent), or ls -l /etc/at.deny (expect No such file or directory). Re-running the InSpec command should pass.
Inspect & investigate
Confirm the file state with stat /etc/at.deny (should report the file is missing). at access decisions are visible in the at/atd service logs via journalctl -u atd (or /var/log/syslog / /var/log/cron, distro dependent).
Remediation
The remediation object is empty, so Pavois does not auto-remediate this rule. Remove the file manually with rm -f /etc/at.deny, and make sure /etc/at.allow exists (see file-at-allow-exists) so access remains controlled.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | delete |
|---|---|
| path | /etc/at.deny |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Minimal risk if /etc/at.allow is already in place. Removing at.deny while no at.allow exists could change behavior on some distros toward a more permissive default, so apply file-at-allow-exists together with this rule. No service restart needed.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.4.2.1 | direct | per OS, see the benchmark table | high |
| PCI DSS | 2.2.6 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.