Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a temp directory set up where users can place whatever files they need to send to other users via HTTP. The owner of this directory is an SFTP user, and cannot run cron jobs.

I have one shell user that can run cron jobs, but does not have permission to edit files in the SFTP user's directory.

I have an admin user that can access the SFTP user's directory when using sudo, but can't (read: I'd really rather not) run cron jobs.

So, here's the conundrum. How do I get a nightly cron job to run as a shell user to delete files older than 1 week within the SFTP user's directory, with the admin user's privileges?

share|improve this question
    
And the reason why can't you run a system cron job as the SFTP user is ...? –  jw013 Sep 21 '12 at 21:50
    
No shell access –  Ed Marty Sep 21 '12 at 21:51
    
What is your preferred approach? –  artistoex Sep 22 '12 at 0:55
add comment

1 Answer

up vote 4 down vote accepted

Edit the /etc/sudoers file (use visudo!) and add an entry that allows the shell user to have sufficient privileges to run a specific command, without having to enter a password. If you use a script, make sure the script cannot by edited by anyone but root.

In /etc/sudoers, where shelluser is the shell user name:

shelluser ALL=NOPASSWD: /usr/bin/clean-up-sftp-temp-directory

In a /usr/bin/clean-up-sftp-temp-directory script, you can put something like:

#!/bin/sh
rm -f /home/sftpuser/will-be-deleted/*

After making the script executable, you should be able to call sudo clean-up-sftp-temp-directory and add it to the shell user's crontab.

share|improve this answer
    
Awesome, thanks. For some reason I was having lots of trouble with the sudoers file before I posted the question (kept complaining about a syntax error). Copying your line almost verbatim fixed the problem nice and quick. –  Ed Marty Sep 23 '12 at 2:13
1  
Make sure, nobody can replace "will-be-deleted" with a symlink to /etc/ for instance. Also, if it doesn't need root priviledge, don't give it root privilege (use sudo -u the-user-who-as-the-right and replace the ALL with that user in sudoers) –  Stéphane Chazelas Oct 31 '12 at 20:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.