I want to install cron on my live web server to run a daily backup script of a local folder. Are there any security considerations I need to be aware of when installing cron?
My web server uses Ubuntu Linux 10.10.
I want to install cron on my live web server to run a daily backup script of a local folder. Are there any security considerations I need to be aware of when installing cron?
My web server uses Ubuntu Linux 10.10.
In essence it's secure, but also it is another way for an attacker to, once compromised the system, make some backdoor persistent and/or auto-open it anytime you close it.
You can use the files /etc/cron.allow
and /etc/cron.deny
to just make your user able to use it. Both have the same format: 1 username per line.
/etc/cron.allow
exists, only the users listed there would be able to have a crontab. No more files are taken into account. Kind of a whitelist./etc/cron.allow
does not exist, but /etc/cron.deny
does, then anyone but those listed there can have a crontab. Kind of a blacklist.In ubuntu by default /etc/cron.deny
exists. You can create /etc/cron.allow
and put there just your user.
Take into account that these files only manage the users allowed to have a personal crontab (ie. execute crontab -e
). The system-wide crontab (/etc/crontab
, /etc/cron.d/*
, /etc/cron.daily/*
. /etc/cron.weekly/*
, /etc/cron.monthly/*
) will work regardless of the cron.allow
/cron.deny
files.
Yes, it's secure. Just make sure the scripts you run with it are secure. Review them yourself and give them only the rights they need.