Changing Oracle Permission to alter crontab

[Adam Strobel]

I'm running HPUX 11i
I'm trying to change crontab under the user Oracle but Oracle still doesn’t have permissions to alter its own crontab

Any help with changing these permission would be greatly appreciated.


Adam

[spex]

Hi Adam,

# crontab -e

PCS

[Jeff Schussele · Accepted solution]

Hi Adam,

You need to add the user oracle to
/var/adm/cron/cron.allow
file.
Only root can do this.

HTH,
Jeff

[Patrick Wallek]

Add the oracle user to the /var/adm/cron/cron.allow file.

[Adam Strobel]

Yes, thank you but I'm getting an access denied under Oracle when I try and use this command.

It appears Oracle does not have the right permissions to edit this file. Root works just fine.

Any suggestions?

[Jeff_Traigle]

Add the Oracle user to /var/adm/cron/cron.allow. That will give it access to edit it's own crontab file with the crontab command. See crontab(1).

[Adam Strobel]

thanks everyone for your quick responses and hellp.

[A. Clay Stephenson]

I assume that you are not trying to edit the crontab files themseleves directly -- even as root. The cron daemon won't have a clue that anything is changed. I also assume that you have put user oracle in /var/adm/cron/cron.allow.

All the files in /var/spool/cron/crontabs should be owned by root and have mode set to 400 -- so that only root can edit them -- this is normal and desired. -- and regular uses can still nonetheless alter them.

Next, do an ls -l /usr/bin/crontab and make sure that the setuid bit is set and that the file is owned by root. It should have mode 4555 (-r-sr-xr-x) set.

Now as user oracle:
crontab -l > oracle.cron
Edit oracle.cron as user oracle, make any changes and save the file.
crontab < oracle.cron

Now to make certain, your changes were recogized (and still as user oracle):
crontab -l # this will display oracle's crontab on stdout.

The setuid bit and crontab's being owned by root is what allows a regular user to alter a file that only root is normally able to alter.