up vote 0 down vote favorite
share [g+] share [fb]

I've got a (deployment) script, that runs under my user 'me' and it should change the crontab of user 'ruby-server'. Am I right that the -u option (of crontab) doesn't help me much unless I use sudo or su? Is there a way, I can change an other users crontab without sudo or su. (I've got access to the entire system. )

Why this problem you ask? Answer: If I deploy an application as 'me' and run it as 'ruby-server', obviously I want to write the crontab as 'me' but the commands should be in the crontab of the 'ruby-server'. Because if someone else deploys, we should change the same crontab of the same user

[edit 1]

I've a group of users (the 'deployers') that have access to a server. I have one user ('ruby-server') that has via ssh and private key access to an other server to get some files. This copy is scripted via rsync and should be run every day. Now, I think, it would be cool if the 'deployers' could write to the 'ruby-server's crontab to specify / change the way the files are copied. Ideas?

link|improve this question
And why not change the crontab of the system? That's where system crons belong to. – mailq Aug 29 '11 at 8:57
yes, but it's not a system cron, it's just a users cron. The application server is running with a specific 'ruby-server' user, this user has the cron. There are other application server users on this machine, which do not have access to the ruby-server – Beffa Aug 29 '11 at 9:37
I still see no need for a user's cron. A system cron runs under the specified user. And if you want to configure something then make it outside of cron. – mailq Aug 29 '11 at 10:31
I see your point. Because the whole system was designed to use cron, I will use cron. When I design the next system, I'll remember you statement and do it outside of cron. – Beffa Aug 29 '11 at 21:32
1  
This is not what I recommended. I only said that the configuration for the cron script must be outside of the cron command line! – mailq Aug 29 '11 at 21:39
feedback

2 Answers

up vote 2 down vote accepted

If your system has ACL you can grant access to the cronfile to the developers. If all the deployers are all part of a group named "deployers" you can modify the crontab file with the command displayed below, that would allow members of the group to modify it.

setfacl -m g:wheel:rx /var/spool/cron/ # Grant read access to the directory
setfacl -m g:deployers:rw /var/spool/cron/ruby-server

Keep in mind that /var/spool/cron/ruby-server must have the proper permissions: "chmod 0600 /var/spool/cron/ruby-server" will fix it if you see "BAD FILE MODE" messages in /var/log/cron

Also, the filesystem must have ACL enabled, running something like "tune2fs -l /dev/mapper/blah | grep -i acl" should be enough (substitute /dev/mapper/blah for the partition containing your /var/spool/cron directory)

link|improve this answer
feedback
up vote 1 down vote

Is there a way, I can change an other users crontab without sudo or su

AFAIK, there is no way. You need sudo permission to switch to another user first and creates cron jobs. Why you don't want to use su or sudo while you have full access to the system?

link|improve this answer
good point. actually I don't need full access to the system, I just have a group of people that deploys an application to the same folder / user 'ruby-server' and this 'ruby-server' user has the right to access an other folder on a other server where some import files are. – Beffa Aug 29 '11 at 9:27
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.