Permission to run cron jobs

[M_7]

What's the correct way to give users permission to run cron jobs?

/var/adm/cron/cron.allow only has read permissions, so would like to know if there's a different way than change permissions on the file and edit.

Thanks.

[Alan Wyskowski]

You shouldn't have to change permissions on the file. Add the login whom you want to grant cron access to in that file "format one login per line"

Man the "crontab" manpage for more information.

[James R. Ferguson]

Hi Mona:

The correct way to grant permissions to use 'cron' (or 'at') is to declare the user(name) in the ".allow" or ".deny" file. For instance, a valid /var/adm/cron/cron.allow file would have permissions of -r--r--r-- and would be owned by "bin:bin" and would contain lines looking like:

root
user1
user2
user3

This file would enable root, user1, user2 and user3 to schedule 'cron' tasks.

Thus, from the man pages for 'crontab':

You can execute crontab if your name appears in the file /var/adm/cron/cron.allow. If that file does not exist, you can use crontab if your name does not appear in the file /var/adm/cron/cron.deny. If only cron.deny exists and is empty, all users can use crontab. If neither file exists, only the root user can use crontab. The allow/deny files consist of one user name per line.

...JRF...

[Rob Smith]

Put the users who you want to run cron jobs in the cron.allow file. The permissions are 444 so only root can write to it, has nothing to do with who can and cannot submit cron jobs. Hope this helps.

Rob

[M_7]

So, to confirm:

as it's r--r--r--, (and yes, owned by bin:bin), there's no way around but to change to be writable and add my user(s).

I understand the files (cron.deny, cron.allow), just thought there might be a different way (ie through SAM).

Thanks.

[Rob Smith]

That's correct and you don't have to change it to be writable. When you done entering users as root instead of wq to write and quit, do a wq! to force a save. Hope this helps.

Rob

[James R. Ferguson]

Hi Mona:

You don't need to change ownership or permissions. Edit the appropriate file with 'vi' and use "wq!" [instead of merely "wq"] to override the readonly permission.

...JRF...