There is an odd CRONTAB behavior difference between Ubuntu and RHEL-derived (say, Rocky 8.x) distros. And, because security I need to understand it better. I've tested this issue in Ubuntu 18.04 and 20.04, with identical behavior in both.
If I use a cron.allow file to allow specified users to use CRONTAB, that file must have 644 permissions. (Or at least, world-readable.) If I set the permission on /etc/cron.allow to 600, CRONTAB is unavailable to any non-root user.
In Rocky 8.x, CRONTAB works fine with a cron.allow file with 600 permission.
The reason I'm asking this is that my security team is more or less demanding that /etc/cron.allow be 600 permission, or at best 640. The problem is that CRONTAB is completely unavailable to allowed users (which means, only root can use CRONTAB) in Ubuntu with either of these permission levels.
Is there a way to change CRONTAB settings to use a 600 or 640 permission on cron.allow and, you know, make it actually work?
Is there any other way to whitelist users for CRONTAB other than cron.allow?
Any idea why this is so different in Ubuntu than in Rocky?
cron.allow
in /etc/cron.d instead of /etc. There was no change in behavior.