Re: Cron Security

blmblm@xxxxxxxxxxxxx wrote:
In article <5W4vh.66890$qO4.14995@xxxxxxxxxxxxxxxxxxxxxxxxxx>,
Allen Kistler <ackistler@xxxxxxxxx> wrote:
Jenny wrote:
We have a request from our Database Administrator where they wanted us
to grant them the access to submit cron job using the oracle ID. Just
wondering, is there any security issue if we allow oracle ID to be able
to submit cron job? Please advise.
The rule of thumb is to deny access to crond by everyone except root.
crond runs as root, so allowing others access provides an opportunity
for a local root compromise.

Can you say a little more about what kind of compromise you have in
mind here? Experiment (on an FC4 system) suggests that a cron job
submitted by a non-root user runs with that user's ID and can only
do things permitted to that user, which is how I'd think it would be.
So you must have in mind something more sophisticated -- ?

[snip]


cron runs as root, so anything that provides input to it can potentially
compromise root. cron "su"s to the user after (after, after, after...)
reading the user's crontab.
.

Relevant Pages

  • Re: Dying processes (inetd, cron, syslogd, sshd)
    ... > rsync command that is used. ... if you used to have a command like this running on boxaa: ... Who's cron job calls the shots? ... uid = root ...
    (comp.unix.sco.misc)
  • Re: Cron Security
    ... to grant them the access to submit cron job using the oracle ID. ... The rule of thumb is to deny access to crond by everyone except root. ...
    (comp.os.linux.security)
  • Re: Cron Security
    ... to grant them the access to submit cron job using the oracle ID. ... The rule of thumb is to deny access to crond by everyone except root. ... So you must have in mind something more sophisticated --? ...
    (comp.os.linux.security)
  • Re: [Newbie] Strange background process of find
    ... The find is usually the result of a root cron job. ... Doing a full ps may allow you to see which cron script is running the ... Another thing to check on is that you may have some directory structure which ...
    (comp.unix.bsd.freebsd.misc)
  • Re: Time Sync
    ... You could create a cron job in root and have it run daily. ... # crontab crontab.txt ... You can verify that it is set by typing... ...
    (Fedora)