Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have some cron jobs that I am running - mostly backup related stuff.

I am having to backup stuck like /etc/apache2/sites/available etc, which require root access.

I have a couple of questions:

When running on a headless server:

  1. Which user is the script run under (assuming I do not specify a user in the cron job entry)?
  2. Is it ok to run the backup script as root - or does that pose a security question?

BTW, my server is running Ubuntu 10.0.4 LTS

share|improve this question

3 Answers 3

up vote 11 down vote accepted

If you have secured access to the script sufficiently and made sensible precautions, running something from roots crontab is not usually a security risk.

But don't run a script as root that a non root user can edit or overwrite. This applies to jobs run from cron as well as interactively.

If that script includes other files same applies to them too.

If in doubt always use the principle of least privilege. If you are still unsure you can always ask specific questions on forums and in IRC.


There is (nearly) always a way to run something as a non root user. If all else fails using sudo to limit a user to specific commands also limits the potential to do harm.

So with the example you gave of backing up /etc/apache2/sites-available, that file is by default readable by anyone, so that implies it is access to the destination that is writeable by root only.

You could fix that by

  • create a group called backupadmins (for example)
  • set the group on the destination directory to backupadmins
  • add a user called backupuser (for example)
  • add the user backupuser to the group backupadmins.
  • make the directory writeable by the backupadmins group
  • run the cron job from backupuser's crontab.
share|improve this answer
    
+1 for the useful, step by step instructions. Your answer has been extremely helpful. I was intending to go down this path anyway, but since it was the first time I was doing it, it is reassuring to see that it is being recommended on here (and quite a few people seem to agree with your recommendation). –  user35402 Aug 7 '10 at 7:03
    
BTW, if I create the user group and user as you suggest, will I be able to access /etc/apache/sites-available and other folders which are (quite rightly), limited to root access only?. How do I get around that problem? –  user35402 Aug 7 '10 at 7:08

It depends what the scripts are doing. If they are backing stuff up then it's probably fine them being root - if a malicious user overwrites these scripts you've probably got bigger problems anyway.

If they do stupid things like executing files found in directories, or anything that could be influenced by the content of the web directories, then you probably need to look into alternatives.

share|improve this answer

Millions of cron jobs all over the world are being run as root every day (or whatever period they're set to run).

The important thing is that proper permissions are set. If you're running something that's writable by everybody, then a malicious user or process could change what it's doing.

Cron jobs are run by the owner of the crontab, generally speaking. A user crontab might be in /var/spool/cron/crontabs/username for example. Cronjobs that are in /etc/crontab, /etc/cron.d/ or /etc/cron.hourly (daily, weekly, monthly) will be run by root. It's important that the ownership and permissions are correct for these crontab files, too.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.