Access to the "at" utility must be controlled via the at.allow and/or at.deny file(s).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-984	GEN003280	SV-984r2_rule	ECLP-1	Medium

Description
The "at" facility selectively allows users to execute jobs at deferred times. It is usually used for one-time jobs. The at.allow file selectively allows access to the "at" facility. If there is no at.allow file, there is no ready documentation of who is allowed to submit "at" jobs.

STIG	Date
UNIX SRG	2013-03-26

Details

Check Text ( C-797r2_chk )
Check for the existence of at.allow and at.deny files. If neither file exists, this is a finding.

Fix Text (F-11346r2_fix)
Create at.allow and/or at.deny files containing appropriate lists of users to be allowed or denied access to the "at" daemon.