Install the cron service
Ensures the cron package is installed so scheduled jobs (updates, log rotation, monitoring) can run.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The cron service allows periodic job execution, needed for almost all administrative tasks and services (software updates, log rotation, etc.). Access to the cron service should be restricted to administrative accounts only.
What Pavois checks
Pavois verifies that the cron package is present via the package manager (dpkg/rpm). A missing cron daemon means scheduled hardening, patching and log-rotation jobs silently never run, which itself becomes a security gap.
describe package('cron') do
it { should be_installed }
endHow to verify it is applied
On Debian/Ubuntu: dpkg -s cron | grep Status should show install ok installed. On RHEL family: rpm -q cronie. Confirm the daemon is active with systemctl is-active cron (or crond), which should return active.
Inspect & investigate
Cron activity is logged to /var/log/syslog (Debian/Ubuntu) or /var/log/cron (RHEL); follow it live with journalctl -u cron or journalctl -u crond.
Remediation
Pavois's harden plan installs the cron package (resource package, action install) and is applied with pavois harden apply. After installation, enable and start the service so jobs actually run.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | cron |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without cron, periodic maintenance (patching, log rotation, backups, security scans) silently stops, letting disks fill and vulnerabilities accumulate. Installing cron has no negative impact; just ensure no third-party scheduler (e.g. systemd timers used exclusively) conflicts with reintroducing cron jobs.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.2.6, 2.4.1.1 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.6 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.