Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to install cron on my live web server to run a daily backup script of a local folder. Are there any security considerations I need to be aware of when installing cron?

My web server uses Ubuntu Linux 10.10.

share|improve this question

migrated from stackoverflow.com Sep 8 '11 at 10:59

This question came from our site for professional and enthusiast programmers.

    
What are you afraid of? –  sanmai Sep 8 '11 at 10:45
2  
Which OS? Please be specific. Windows Cron is as insecure as Windows. Linux cron is still Linux and has all the security of the OS installation. –  S.Lott Sep 8 '11 at 10:45
    
Maybe I'm just a bit paranoid because it is the live system. It did not came pre-installed, so I was unsure if there are some security considerations that needed to be made. –  Frank Vilea Sep 8 '11 at 10:50
1  
@S.Lott Windows isn't insecure. Bad Windows admins make Windows insecure. If you let me admin a linux box it'll get broken into in about 2 minutes. –  mrdenny Sep 8 '11 at 11:21
    
@mrdenny♦: "Windows Cron is as insecure as Windows" can be read as "Windows Cron is as secure as Windows". It sure seemed like a trivial isomorphism. –  S.Lott Sep 8 '11 at 11:58

2 Answers 2

up vote 4 down vote accepted

In essence it's secure, but also it is another way for an attacker to, once compromised the system, make some backdoor persistent and/or auto-open it anytime you close it.

You can use the files /etc/cron.allow and /etc/cron.deny to just make your user able to use it. Both have the same format: 1 username per line.

  1. If /etc/cron.allow exists, only the users listed there would be able to have a crontab. No more files are taken into account. Kind of a whitelist.
  2. If /etc/cron.allow does not exist, but /etc/cron.deny does, then anyone but those listed there can have a crontab. Kind of a blacklist.
  3. If neither of them exist, then anyone can use it.

In ubuntu by default /etc/cron.deny exists. You can create /etc/cron.allow and put there just your user.

Take into account that these files only manage the users allowed to have a personal crontab (ie. execute crontab -e). The system-wide crontab (/etc/crontab, /etc/cron.d/*, /etc/cron.daily/*. /etc/cron.weekly/*, /etc/cron.monthly/*) will work regardless of the cron.allow/cron.deny files.

share|improve this answer

Yes, it's secure. Just make sure the scripts you run with it are secure. Review them yourself and give them only the rights they need.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.