topic Re: providing crontab access for a user by sudo in Operating System - HP-UX

providing crontab access for a user by sudo

gany59 — Mon, 25 Apr 2011 08:41:27 GMT

I want to give the permission to run the crontab command for the user called naraguna. So the below line is correct for putting the entry in the /etc/sudoers file.

naraguna ALL=(root)NOPASSWD:/usr/bin/crontab

Correct me if i am wrong.. Thanks in advance!

Re: providing crontab access for a user by sudo

Johnson Punniyalingam — Mon, 25 Apr 2011 09:10:00 GMT

see below has example

user1 ALL = NOPASSWD:/housekeep/scripts/wintel/cleanup

Re: providing crontab access for a user by sudo

gany59 — Mon, 25 Apr 2011 11:01:34 GMT

can i know what is the meaning of ALL.

and i some forums i have seen the % symbol in front of the user name in /etc/sudoers file. what might be the reason for that. Please clarify Johnson..

Thanks!
Simhan

Re: providing crontab access for a user by sudo

Matti_Kurkela — Mon, 25 Apr 2011 11:24:31 GMT

The word ALL before the = sign in the examples above means the sudoers line is in effect in all hosts that have it in their sudoers file.

If you choose to manage your sudoers file centrally, and use the same file in many hosts, you can use host names in that place to create sudoers definitions that apply in some specific hosts.

The % sign in front of a name means it's a group name, not an user name.

MK

Re: providing crontab access for a user by sudo

Ralph Grothe — Tue, 26 Apr 2011 05:17:06 GMT

> naraguna ALL=(root)NOPASSWD:/usr/bin/crontab

Is that really your intention?
Consider that thus user naraguna is allowed to edit root's crontab, enabling them to schedule any (possibly nefarious) script or program to be executed as root.
If instead it was only intended for naraguna to peek into root's scheduled cronjobs, it maybe would be wiser to change the sudoers line into:

naraguna ALL = NOPASSWD /usr/bin/crontab -l