1

There is an odd CRONTAB behavior difference between Ubuntu and RHEL-derived (say, Rocky 8.x) distros. And, because security I need to understand it better. I've tested this issue in Ubuntu 18.04 and 20.04, with identical behavior in both.

If I use a cron.allow file to allow specified users to use CRONTAB, that file must have 644 permissions. (Or at least, world-readable.) If I set the permission on /etc/cron.allow to 600, CRONTAB is unavailable to any non-root user.

In Rocky 8.x, CRONTAB works fine with a cron.allow file with 600 permission.

The reason I'm asking this is that my security team is more or less demanding that /etc/cron.allow be 600 permission, or at best 640. The problem is that CRONTAB is completely unavailable to allowed users (which means, only root can use CRONTAB) in Ubuntu with either of these permission levels.

  1. Is there a way to change CRONTAB settings to use a 600 or 640 permission on cron.allow and, you know, make it actually work?

  2. Is there any other way to whitelist users for CRONTAB other than cron.allow?

  3. Any idea why this is so different in Ubuntu than in Rocky?

1
  • @user68186 Yes, I tested the alternative of putting cron.allow in /etc/cron.d instead of /etc. There was no change in behavior.
    – dsideriu
    Nov 21, 2022 at 14:14

1 Answer 1

1

The resolution we found is to change the group of the cron.allow file to the crontab group and then adding the relevant users to that group:

  1. Ensure that the crontab group exists
grep crontab /etc/group)  # should return crontab:x:105 and possibly a list of users
  1. Change group of the cron allow and set read permission:
sudo chgrp crontab /etc/cron.allow
sudo chmod 0640 /etc/cron.allow
  1. Add users to the crontab group
sudo usermod -aG crontab *username*  # replace *username* with the relevant username

and repeat for all desired users

The end result is that the /etc/cron.allow file is readable by all users in the crontab group, which is necessary when cron.allow is used to restrict cron to certain users.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .