topic Re: Can normal users edit Crontab in Operating System - HP-UX

Can normal users edit Crontab

Henry Chua — Thu, 09 Dec 2004 19:51:47 GMT

HI Guys,

A query, except super users, can normal users edit the crontab. Can I assign rights to normal users to perform that. And if yes, how do I do that?

THank u!!

regards..

Re: Can normal users edit Crontab

Patrick Wallek — Thu, 09 Dec 2004 20:12:03 GMT

Each user can edit his/her own crontab. You just need to edit /var/adm/cron.allow to allow them to run jobs.

If you are talking about them editing root's crontab, then no they can't, and I wouldn't want them to (would you want a user to randomly put something like 'shutdown -hy 0' in root's crontab? I think NOT!).

There are ways to allow that via things like sudo though.

Re: Can normal users edit Crontab

Steven E. Protter — Thu, 09 Dec 2004 20:19:30 GMT

You probably could assign rights to the file that the root crontab stores its commands in.

This would be a terrible idea and security threat. The kind of idea that would cause you to flunk a security audit. Never, never never give regular users root access accept under controlled circumstances.

For example the passwd command is a SUID command because the user needs to update a root only file for writes, /etc/passwd

To give users access to root cron would be like placing a "have an IT disaster here please" sign on your forehead.

SEP

Re: Can normal users edit Crontab

Rashid Hamid — Thu, 09 Dec 2004 21:45:44 GMT

Hi Henry

I think you can edit the cron.allow and cron.deny.

If only the cron.deny file exists, any user whose name does not appear in the file can use crontab command.

A user cannot use the crontab command if one of the following is true
1) The cron.allow file and cron.deny file does not exist(allows root user only)
2) The cron.allow file exists but the user's login name not listed in cron.allow
3) The cron.deny file exists and the user login name is listed on it

Rashid

Re: Can normal users edit Crontab

Geoff Wild — Fri, 10 Dec 2004 00:04:15 GMT

Yes - you have to add the users to /var/adm/cron.allow.

Then, they execute:

crontab -e

man cron for more info.

Rgds...Geoff

Re: Can normal users edit Crontab

Henry Chua — Fri, 10 Dec 2004 00:48:44 GMT

Hi,

Thanks for the valuable inputs.
My system does not have cron.deny file, I have added my username in the cron.allow file but I was not able to write to crontab. Is there any explanation for this?

Thanks and regards

Re: Can normal users edit Crontab

Nguyen Anh Tien — Fri, 10 Dec 2004 01:30:48 GMT

If you list username in cron.allow, only these users can use cron. other can not.
When saving cron.allow try to use:"wq!" instead "wq".

Re: Can normal users edit Crontab

Sanjay Kumar Suri — Fri, 10 Dec 2004 02:24:49 GMT

I hope you are using the command

crontab -e

for creating cron entries.

sks

Re: Can normal users edit Crontab

Ivajlo Yanakiev — Fri, 10 Dec 2004 03:20:46 GMT

did you restart crond after you change config files ?

P.S.
Send exact error msg pls ?

Re: Can normal users edit Crontab

Yogeeraj_1 — Fri, 10 Dec 2004 04:49:10 GMT

hi,

also check if the cron daemon is running!

ps -ef|grep cron

regards
Yogeeraj

Re: Can normal users edit Crontab

Ralph Grothe — Fri, 10 Dec 2004 04:59:32 GMT

If you're nuts or you really know what you're doing nobody of course prevents you from giving world write permission to this file

# ll /var/spool/cron/crontabs/root
-r-------- 1 root sys 782 Jan 20 2004 /var/spool/cron/cronta
bs/root

Re: Can normal users edit Crontab

Geoff Wild — Fri, 10 Dec 2004 10:09:01 GMT

As root do:

crontab -e username

Does that work?

Save it, is it in:

/var/spool/cron/crontabs

cron.allow should be in:

/usr/lib/cron/

man crontab for more info

Rgds...Geoff

Re: Can normal users edit Crontab

Patrick Wallek — Fri, 10 Dec 2004 10:20:21 GMT

1) Which crontab file were you trying to write to?

2) How were you editing it?

If you did something like 'vi /var/spool/cron/crontabs/root' as a normal user and tried to modify and save it, then it won't work. You'd have to modify the permissions of the file (which I would NOT recommend) to allow that.

If you do a 'crontab -e' as a normal user then you will edit YOUR OWN crontab file and NOT anyone else's.

What EXACTLY are you trying to accomplish? Whose crontab file do you want normal users to edit?

Re: Can normal users edit Crontab

Henry Chua — Mon, 13 Dec 2004 21:55:22 GMT

Thanks for your valuble advises..

Actually wat I am trying to do is to add an cron job to my system. I have added my username in the cron.allow, and there is no cron.deny file in my system.

However, when I try to create
> crontab -e
and then tried to saved the file with "wq!"

it prompted me this
"Cant create your crontab file in crontab directory"

May I know why this is happening?

thanks!!

Re: Can normal users edit Crontab

Ivajlo Yanakiev — Tue, 14 Dec 2004 07:54:19 GMT

did you change dir access using chmod ???

Re: Can normal users edit Crontab

Geoff Wild — Tue, 14 Dec 2004 09:42:52 GMT

Did you try it as root?

crontab -e yourid

What is permission of

/usr/bin/crontab

Should be:
-r-sr-xr-x 1 root bin 24576 Nov 14 2000 /usr/bin/crontab

Rgds...Geoff