0

Last year I checkout a server where I found some exploit bash script in /tmp folder which download a binary file from 3rd party server. When I further checked it, I found apache user's cron entry for downloading and executing of bash script. After removing entry from cron, It added again after few days.

Then I consulted with system admin and He did not like the idea of apache user cron and he disable it. After that we did not get further same binary file or bash script on system. Then I assume their would be some exploit which used by hacker and then he found apache cron enabled. That make me cautious about crontab as apache.

After one year, I working on other project which requires to run cron from apache user, But I hesitated to use it after last year incident. Then i consulted alternative solution at https://stackoverflow.com/questions/33472905/right-way-to-implement-schedule-cron . But here I get that community are not negative about this and take as usual practice of using it.

Now concern is that If enable apache user cron is really a big security issue ?

  • You are talking about shared server security ? if it is a dedicated server i don't see how it can be exploited, if you have info about it i would like to know (for security issues)...Anyway why your script need to be run with apache user ? – Froggiz Nov 4 '15 at 12:17
  • @Froggiz Application is based on Pimcore where I need to run some heavy schedule tasks. As pimcore store data version at file system that folders have only apache writable permissions. Now My script also created some data by api calls so that also need to store at folders. I discussed options at linked stackoverflow post. – kuldeep.kamboj Nov 4 '15 at 12:48
  • @Froggiz It would be dedicated server. – kuldeep.kamboj Nov 4 '15 at 12:49
  • if it is dedicated, it would not be a security threat. If there is a threat it would come from coding, not from cron web user. Any way that s just my point of view, my servers never get hacked, and most of securities issues available i saw are for shared server or code security breach (or missconfiguration). Maybe you can wait for a securty pro for confirmation. – Froggiz Nov 4 '15 at 13:00

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.