DEV Community

Janak Shrestha
Janak Shrestha

Posted on

Restrict Cron Access

#linux

In alignment with security compliance standards, the Nautilus project team has opted to impose restrictions on crontab access. Specifically, only designated users will be permitted to create or update cron jobs.

Configure crontab access on App Server 3 as follows: Allow crontab access to rose user while denying access to the rod user.

Solution

Step 1: Connect to App Server 3 (stapp03) 

ssh banner@stapp03
# Password: BigGr33n
Enter fullscreen mode Exit fullscreen mode

Step 2: Switch to root or use sudo 

sudo su -
# Password: BigGr33n
Enter fullscreen mode Exit fullscreen mode

Step 3: Create the cron.allow file with user rose 

echo "rose" > /etc/cron.allow
Enter fullscreen mode Exit fullscreen mode

Step 4: Add rod to cron.deny file (optional but ensures denial) 

echo "rod" >> /etc/cron.deny
Enter fullscreen mode Exit fullscreen mode

Note: If cron.allow exists, cron.deny is ignored. However, it's good practice to maintain both.

Step 5: Verify the configuration 

# Check cron.allow file
cat /etc/cron.allow

# Check cron.deny file
cat /etc/cron.deny

# Test rose user access
su - rose -c "crontab -l" 2>&1

# Test rod user access
su - rod -c "crontab -l" 2>&1
Enter fullscreen mode Exit fullscreen mode

Complete One-Line Commands

From jump host with password: 

echo 'BigGr33n' | ssh banner@stapp03 "sudo -S bash -c 'echo rose > /etc/cron.allow && echo rod > /etc/cron.deny && echo \"=== cron.allow ===\" && cat /etc/cron.allow && echo \"=== cron.deny ===\" && cat /etc/cron.deny'"
Enter fullscreen mode Exit fullscreen mode

From jump host using heredoc: 

ssh banner@stapp03 << 'EOF'
echo 'BigGr33n' | sudo -S bash -c '
echo "Creating cron.allow with rose..."
echo "rose" > /etc/cron.allow

echo "Creating cron.deny with rod..."
echo "rod" > /etc/cron.deny

echo ""
echo "=== Verification ==="
echo "cron.allow contents:"
cat /etc/cron.allow

echo ""
echo "cron.deny contents:"
cat /etc/cron.deny

echo ""
echo "Testing rose user (should have access):"
su - rose -c "crontab -l" 2>&1 || echo "No crontab for rose (expected)"

echo ""
echo "Testing rod user (should be denied):"
su - rod -c "crontab -l" 2>&1
'
EOF
Enter fullscreen mode Exit fullscreen mode

Step-by-Step Interactive Commands 

# Connect to stapp03
ssh banner@stapp03
# Enter password: BigGr33n

# Become root
sudo su -
# Enter password: BigGr33n

# Step 1: Check if cron.allow or cron.deny already exist
ls -la /etc/cron.allow /etc/cron.deny 2>/dev/null

# Step 2: View current cron.allow if exists
cat /etc/cron.allow 2>/dev/null || echo "cron.allow does not exist"

# Step 3: View current cron.deny if exists
cat /etc/cron.deny 2>/dev/null || echo "cron.deny does not exist"

# Step 4: Create cron.allow with rose
echo "rose" > /etc/cron.allow

# Step 5: Create cron.deny with rod
echo "rod" > /etc/cron.deny

# Step 6: Verify files
echo "=== cron.allow ==="
cat /etc/cron.allow

echo "=== cron.deny ==="
cat /etc/cron.deny

# Step 7: Test rose user access (should work)
echo "Testing rose user..."
su - rose -c "crontab -l" 2>&1
# If rose has no crontab, it will show: no crontab for rose

# Step 8: Test rod user access (should be denied)
echo "Testing rod user..."
su - rod -c "crontab -l" 2>&1
# Should show: You (rod) are not allowed to use this program (crontab)

# Step 9: Test creating a crontab for rose (if needed)
echo "Testing crontab creation for rose..."
su - rose -c "echo '* * * * * echo test' | crontab -"
su - rose -c "crontab -l"

# Clean up test crontab if created
su - rose -c "crontab -r"

# Exit back
exit
exit
Enter fullscreen mode Exit fullscreen mode

Expected Output 

[root@stapp03 ~]# echo "rose" > /etc/cron.allow
[root@stapp03 ~]# echo "rod" > /etc/cron.deny

[root@stapp03 ~]# cat /etc/cron.allow
rose

[root@stapp03 ~]# cat /etc/cron.deny
rod

[root@stapp03 ~]# su - rose -c "crontab -l"
no crontab for rose

[root@stapp03 ~]# su - rod -c "crontab -l"
You (rod) are not allowed to use this program (crontab)
See crontab(1) for more information
Enter fullscreen mode Exit fullscreen mode

Understanding Crontab Access Files

cron.allow File Format: 

# Format: one username per line
rose
# Additional users can be added
# james
# mary
Enter fullscreen mode Exit fullscreen mode

cron.deny File Format: 

# Format: one username per line
rod
# Additional users can be added
# john
# kareem
Enter fullscreen mode Exit fullscreen mode

Advanced Configuration Examples

1. Add multiple users to cron.allow: 

cat > /etc/cron.allow << EOF
rose
james
mary
alice
EOF
Enter fullscreen mode Exit fullscreen mode

2. Add multiple users to cron.deny: 

cat > /etc/cron.deny << EOF
rod
john
bob
charlie
EOF
Enter fullscreen mode Exit fullscreen mode

3. Allow only specific users (override): 

# If cron.allow exists, only users listed there can use crontab
echo "rose" > /etc/cron.allow
# Even if rod is in cron.deny, it's ignored
Enter fullscreen mode Exit fullscreen mode

4. Remove restrictions (allow all users): 

rm -f /etc/cron.allow /etc/cron.deny
Enter fullscreen mode Exit fullscreen mode

5. Block all users except root: 

# Create empty cron.allow
> /etc/cron.allow
# Only root can use crontab now
Enter fullscreen mode Exit fullscreen mode

Verification Commands

Run these to confirm the configuration:

# 1. Check cron.allow contents
cat /etc/cron.allow

# 2. Check cron.deny contents
cat /etc/cron.deny

# 3. Test rose user access (should work)
sudo -u rose crontab -l

# 4. Test rod user access (should be denied)
sudo -u rod crontab -l

# 5. Check if rose can create crontab
sudo -u rose bash -c "echo '* * * * * echo test' | crontab -"
sudo -u rose crontab -l
sudo -u rose crontab -r

# 6. Check if rod can create crontab (should fail)
sudo -u rod bash -c "echo '* * * * * echo test' | crontab -"
# Should show permission denied

# 7. Check file permissions
ls -la /etc/cron.allow /etc/cron.deny

# 8. Check for error logs
tail -f /var/log/secure | grep crontab
Enter fullscreen mode Exit fullscreen mode

Troubleshooting

  1. "cron.allow file doesn't exist": 
   # Create it
   echo "rose" > /etc/cron.allow
Enter fullscreen mode Exit fullscreen mode
  1. "Permission denied" when creating files: 
   # Use sudo or become root
   sudo su -
Enter fullscreen mode Exit fullscreen mode
  1. Users can still access crontab despite being in cron.deny: 
   # Check if cron.allow exists
   ls -la /etc/cron.allow
   # If it exists, cron.deny is ignored
   # Remove cron.allow or add user to cron.deny
Enter fullscreen mode Exit fullscreen mode
  1. "crontab: command not found": 
   # Install cron if not installed
   yum install -y cronie
   # or
   apt-get install -y cron
Enter fullscreen mode Exit fullscreen mode
  1. Test with specific commands: 
   # Test as a specific user
   sudo -u rose /usr/bin/crontab -l
Enter fullscreen mode Exit fullscreen mode

Complete Script for Cron Access Management

Create a script manage_cron_access.sh:

#!/bin/bash
# manage_cron_access.sh

# Configuration
ALLOW_USERS=("rose")
DENY_USERS=("rod")

# Function to configure cron access
configure_cron_access() {
    echo "Configuring crontab access..."

    # Clear existing files
    > /etc/cron.allow
    > /etc/cron.deny

    # Add allowed users
    for user in "${ALLOW_USERS[@]}"; do
        if id "$user" &>/dev/null; then
            echo "$user" >> /etc/cron.allow
            echo "✓ Added $user to cron.allow"
        else
            echo "✗ User $user does not exist"
        fi
    done

    # Add denied users
    for user in "${DENY_USERS[@]}"; do
        if id "$user" &>/dev/null; then
            echo "$user" >> /etc/cron.deny
            echo "✓ Added $user to cron.deny"
        else
            echo "✗ User $user does not exist"
        fi
    done

    echo ""
    echo "=== Final Configuration ==="
    echo "cron.allow: $(cat /etc/cron.allow 2>/dev/null | tr '\n' ' ')"
    echo "cron.deny: $(cat /etc/cron.deny 2>/dev/null | tr '\n' ' ')"
}

# Function to test user access
test_user_access() {
    local user=$1
    echo "Testing user: $user"
    sudo -u "$user" crontab -l 2>&1 | head -1
    echo ""
}

# Main execution
if [ "$EUID" -ne 0 ]; then 
    echo "Please run as root or with sudo"
    exit 1
fi

configure_cron_access

echo ""
echo "=== Testing Access ==="
test_user_access "rose"
test_user_access "rod"
Enter fullscreen mode Exit fullscreen mode

Security Best Practices

  1. Always maintain a backup: 
   cp /etc/cron.allow /etc/cron.allow.backup 2>/dev/null
   cp /etc/cron.deny /etc/cron.deny.backup 2>/dev/null
Enter fullscreen mode Exit fullscreen mode
  1. Use cron.allow instead of cron.deny (more secure): 
   # Only allow specific users
   echo "rose" > /etc/cron.allow
   # This implicitly denies everyone else
Enter fullscreen mode Exit fullscreen mode
  1. Regularly audit cron access: 
   # Check who has cron access
   cat /etc/cron.allow 2>/dev/null || echo "All users allowed (except those in cron.deny)"
Enter fullscreen mode Exit fullscreen mode
  1. Monitor cron logs: 
   tail -f /var/log/cron
Enter fullscreen mode Exit fullscreen mode

Complete Solution Summary

The crontab access has been configured on App Server 3 (stapp03):

  • ✅ cron.allow created with user rose (allowed)
  • ✅ cron.deny created with user rod (denied)
  • ✅ Verified rose can access crontab
  • ✅ Verified rod is denied crontab access
  • ✅ Access control follows security compliance standards

The configuration ensures that only designated user rose can create or update cron jobs, while rod is explicitly denied access as per the Nautilus project team's requirements.

Top comments (0)