Allow/Deny Crontab access to users

KodeKloud Engineer
#1

In the task we have to allow crontab access to one user and deny to another. I created cron.allow and cron.deny in /etc/cron.d/ directory and added respective user names and restarted the crond service. Task is still failing. Am I missing something? These are the commands I used:

id siva
uid=1002(siva) gid=1002(siva) groups=1002(siva)
id jerome
uid=1003(jerome) gid=1003(jerome) groups=1003(jerome)

sudo su
systemctl status crond.service
● crond.service - Command Scheduler
   Loaded: loaded (/usr/lib/systemd/system/crond.service; enabled; vendor preset: enabled)
   Active: active (running) since Mon 2023-07-31 12:16:38 UTC; 6min ago

ls /etc/cron.d/
0hourly

touch /etc/cron.d/cron.deny
touch /etc/cron.d/cron.allow

ls /etc/cron.d/
0hourly  cron.allow  cron.deny

vi /etc/cron.d/cron.allow
vi /etc/cron.d/cron.deny 

cat /etc/cron.d/cron.allow
siva
cat /etc/cron.d/cron.deny
jerome

systemctl restart crond.service

systemctl status crond.service
● crond.service - Command Scheduler
   Loaded: loaded (/usr/lib/systemd/system/crond.service; enabled; vendor preset: enabled)
   Active: active (running)
#2

You must put usernames in /etc/cron.allow and /etc/cron.deny respectively.

1 Like
#3

Thanks a lot. I must be getting old to not read the man page.

#5

hello pls i need help i added usernames i still failed.
ALLOW/DENY Crontab access to users
ssh tony@stapp02
id john
id garrett
sudo -i
systemctl status crond.service
ls /etc/cron.d/
touch /etc/cron.d/cron.deny
touch /etc/cron.d/cron.allow
ls /etc/cron.d/
vi /etc/cron.d/cron.allow
usernames john
vi /etc/cron.d/cron.deny
usernames garrett

cat /etc/cron.d/cron.allow

cat /etc/cron.d/cron.deny

systemctl restart crond.service
systemctl status crond.service

#6

You have same mistake. You must put usernames in /etc/cron.allow and /etc/cron.deny respectively.
Not in /etc/cron.d/cron.allow and /etc/cron.d/cron.deny.

1 Like
#7

I see two issues here

  1. the file to be updated is /etc/cron.allow and not /etc/cron.d/cron.allow
  2. use sudo in systemctl
    sudo systemctl restart crond.service
1 Like
#8

id siva
id jerome

sudo su -

echo “siva” >> /etc/cron.allow

echo “jerome” >> /etc/cron.deny

sudo - siva

sudo - jerome

#10

touch /etc/cron.allow
touch /etc/cron.deny
vi /etc/cron.allow
rose
vi /etc/cron.deny
eric

systemctl restart crond.service
systemctl status crond.service

#11

For me, it only worked when I also removed or renamed the user’s crontab:

mv -vi /var/spool/cron/crontabs/jerome /var/spool/cron/crontabs/jerome.disabled