To ensure compliance with security standards, the Nautilus project team is implementing restrictions on crontab access, specifically dictating which users are permitted to create or modify cron jobs. The assignment is to limit crontab access on App Server 2 according to the following criteria:
Grant crontab access to the sam user while denying access to the kodekloud_cap user.
Solution
Step 1: Connect to App Server 2 (stapp02)
ssh steve@stapp02
# Password: Am3ric@
Step 2: Switch to root
sudo su -
# Password: Am3ric@
Step 3: Configure crontab access
# Allow sam user
echo "sam" > /etc/cron.allow
# Deny kodekloud_cap user
echo "kodekloud_cap" > /etc/cron.deny
Step 4: Verify configuration
# Check files
cat /etc/cron.allow
cat /etc/cron.deny
# Test sam access (should work)
su - sam -c "crontab -l" 2>&1
# Test kodekloud_cap access (should be denied)
su - kodekloud_cap -c "crontab -l" 2>&1
One-Line Command (Run from jump host)
echo 'Am3ric@' | ssh steve@stapp02 "sudo -S bash -c 'echo sam > /etc/cron.allow && echo kodekloud_cap > /etc/cron.deny && cat /etc/cron.allow && cat /etc/cron.deny'"
Expected Output
[root@stapp02 ~]# cat /etc/cron.allow
sam
[root@stapp02 ~]# cat /etc/cron.deny
kodekloud_cap
[root@stapp02 ~]# su - sam -c "crontab -l"
no crontab for sam
[root@stapp02 ~]# su - kodekloud_cap -c "crontab -l"
You (kodekloud_cap) are not allowed to use this program (crontab)
See crontab(1) for more information
Verification Commands
# Check cron.allow contents
cat /etc/cron.allow
# Check cron.deny contents
cat /etc/cron.deny
# Test sam access
sudo -u sam crontab -l
# Test kodekloud_cap access (should fail)
sudo -u kodekloud_cap crontab -l
# Verify file permissions
ls -la /etc/cron.allow /etc/cron.deny
Summary
- ✅ sam added to
/etc/cron.allow(granted access) - ✅ kodekloud_cap added to
/etc/cron.deny(denied access) - ✅ Access verified for both users
Crontab access restrictions are now in place on App Server 2.
Top comments (0)