Linux – Change Other Users Crontab

cronlinuxpermissionsunix

I've got a (deployment) script, that runs under my user 'me' and it should change the crontab of user 'ruby-server'. Am I right that the -u option (of crontab) doesn't help me much unless I use sudo or su? Is there a way, I can change an other users crontab without sudo or su. (I've got access to the entire system. )

Why this problem you ask? Answer: If I deploy an application as 'me' and run it as 'ruby-server', obviously I want to write the crontab as 'me' but the commands should be in the crontab of the 'ruby-server'. Because if someone else deploys, we should change the same crontab of the same user

[edit 1]

I've a group of users (the 'deployers') that have access to a server. I have one user ('ruby-server') that has via ssh and private key access to an other server to get some files. This copy is scripted via rsync and should be run every day. Now, I think, it would be cool if the 'deployers' could write to the 'ruby-server's crontab to specify / change the way the files are copied. Ideas?

Best Answer

If your system has ACL you can grant access to the cronfile to the developers. If all the deployers are all part of a group named "deployers" you can modify the crontab file with the command displayed below, that would allow members of the group to modify it.

setfacl -m g:wheel:rx /var/spool/cron/ # Grant read access to the directory
setfacl -m g:deployers:rw /var/spool/cron/ruby-server

Keep in mind that /var/spool/cron/ruby-server must have the proper permissions: "chmod 0600 /var/spool/cron/ruby-server" will fix it if you see "BAD FILE MODE" messages in /var/log/cron

Also, the filesystem must have ACL enabled, running something like "tune2fs -l /dev/mapper/blah | grep -i acl" should be enough (substitute /dev/mapper/blah for the partition containing your /var/spool/cron directory)

Related Solutions

Cron Job – How to Run a Cron Job Manually and Immediately

Here's what I did, and it seems to work in this situation. At least, it shows me an error, whereas running from the command line as the user doesn't show the error.

Step 1: I put this line temporarily in the user's crontab:

* * * * *   /usr/bin/env > /home/username/tmp/cron-env

then took it out once the file was written.

Step 2: Made myself a little run-as-cron bash script containing:

#!/bin/bash
/usr/bin/env -i $(cat /home/username/tmp/cron-env) "$@"

So then, as the user in question, I was able to

run-as-cron /the/problematic/script --with arguments --and parameters

This solution could obviously be expanded to make use of sudo or such for more flexibility.

Hope this helps others.

Linux – How to run a server on port 80 as a normal user on Linux

Short answer: you can't. Ports below 1024 can be opened only by root. As per comment - well, you can, using CAP_NET_BIND_SERVICE, but that approach, applied to java bin will make any java program to be run with this setting, which is undesirable, if not a security risk.

The long answer: you can redirect connections on port 80 to some other port you can open as normal user.

Run as root:

# iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

As loopback devices (like localhost) do not use the prerouting rules, if you need to use localhost, etc., add this rule as well (thanks @Francesco):

# iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport 80 -j REDIRECT --to-ports 8080

NOTE: The above solution is not well suited for multi-user systems, as any user can open port 8080 (or any other high port you decide to use), thus intercepting the traffic. (Credits to CesarB).

EDIT: as per comment question - to delete the above rule:

# iptables -t nat --line-numbers -n -L

This will output something like:

Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination         
1    REDIRECT   tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8080 redir ports 8088
2    REDIRECT   tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80 redir ports 8080

The rule you are interested in is nr. 2, so to delete it:

# iptables -t nat -D PREROUTING 2

Best Answer

Related Solutions

Cron Job – How to Run a Cron Job Manually and Immediately

Linux – How to run a server on port 80 as a normal user on Linux

Related Topic