Is CRON secure?

Question

I want to install cron on my live web server to run a daily backup script of a local folder. Are there any security considerations I need to be aware of when installing cron?

My web server uses Ubuntu Linux 10.10.

Answer 1

In essence it's secure, but also it is another way for an attacker to, once compromised the system, make some backdoor persistent and/or auto-open it anytime you close it.

You can use the files /etc/cron.allow and /etc/cron.deny to just make your user able to use it. Both have the same format: 1 username per line.

1. If /etc/cron.allow exists, only the users listed there would be able to have a crontab. No more files are taken into account. Kind of a whitelist.
2. If /etc/cron.allow does not exist, but /etc/cron.deny does, then anyone but those listed there can have a crontab. Kind of a blacklist.
3. If neither of them exist, then anyone can use it.

In ubuntu by default /etc/cron.deny exists. You can create /etc/cron.allow and put there just your user.

Take into account that these files only manage the users allowed to have a personal crontab (ie. execute crontab -e). The system-wide crontab (/etc/crontab, /etc/cron.d/*, /etc/cron.daily/*. /etc/cron.weekly/*, /etc/cron.monthly/*) will work regardless of the cron.allow/cron.deny files.

Answer 2

Yes, it's secure. Just make sure the scripts you run with it are secure. Review them yourself and give them only the rights they need.