Ability of non root user to modify root cron

[Mike Kapsak]

A user has a sign-on to gl and jobtrack apps only. He is responsible for several entries in the root cron. From time to time he requests changes to these entries. The changes are then taken care of by a root user. Can this user be setup to modify the root cron without giving him root capability.

Thanks

[Ron Cornwell]

To give someone acces to root's crontab you just have to modify the permissions on the file itself /var/adm/cron/root. THIS IS A HUGE SECURITY RISK. The best way is to modify your current setup so that this users cron jobs run from their own crontab file. This can be done with SUID files and the lot. HTH

[Victor BERRIDGE]

Hi,
If that person has to modify the root cronfile, you could use sudo (download it from your favorite porting center) to let him be root while executing crontab (sudo /usr/bin/su root -c /usr/bin/crontab...)...


All the best

Victor

[Alan Riggs]

This is simply a bad idea.

The ability to modify root's cron is the ability to run a root kit at will. At the most I would recommend allowing the person to see a copy of the cronfile and modify it accordingly. A root user could then compare the changes, make sure they are safe, then activate teh cronfile.

Even this is a security risk if any command executed by the cronfile is modifiable by the user(s) in question, but it is better than just opening up root cron directly.

[Darrell Allen]

Hi Mike,

First, root's crontab is powerful. I wouldn't want anyone but a sysadmin modifying it. Do you really want to let a user run anything he wants as root? Not a good thing.

You could let / help the user set up his own crontab and use sudo or possibly a setuid script / program (and this is dangerous - don't let it be writable) if his tasks have to be performed as root. Even then, I'd only do so if the tasks absolutely had to run as root and I wouldn't allow him to modify the script. In the end you come back to having a sysadmin make the change anyway.

It's just a very bad thing to give up root access in any form.

Darrell