Verify Owner on cron.deny
Ensures the cron deny-list /etc/cron.deny is owned by the root user (UID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
Why this rule matters
The /etc/cron.deny file lists users who are forbidden from scheduling cron jobs (used when cron.allow is absent). If it is not owned by root, an unauthorized user could remove their own name to bypass the restriction and gain cron access, undermining the intended control. Root ownership keeps the deny-list authoritative.
What Pavois checks
Pavois reads the effective owner of /etc/cron.deny via the InSpec file resource and asserts uid == 0, only when the file exists (only_if). Reading the live inode ownership reflects the real on-disk state and catches drift from manual edits, rather than relying on an assumed default.
only_if { file('/etc/cron.deny').exist? }
describe file('/etc/cron.deny') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U %u' /etc/cron.deny. Expected output: root 0. Alternatively ls -l /etc/cron.deny should show root in the owner column.
Inspect & investigate
Ownership has no service log. Confirm the state with stat -c '%U %u' /etc/cron.deny. To trace changes, an auditd watch such as auditctl -w /etc/cron.deny -p wa -k cron-access records writes/attribute changes in /var/log/audit/audit.log.
Remediation
No automated harden plan is defined for this rule, so it must be applied manually: run chown root /etc/cron.deny as root to set the owner to root.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /etc/cron.deny |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If misconfigured, an unauthorized user could edit the deny-list to bypass cron restrictions.
Precautions before applying: chown root /etc/cron.deny is safe and reversible with no service restart. Best practice is to use cron.allow (default-deny) instead of cron.deny; do not create cron.deny solely to remediate ownership, only adjust it if it already exists.