I have Debian VPS and I gave FTP access to somebody, say John. I don't want to give John SSH access, but he needs to put tasks into crontab.

What are my possible variants?

  • This may get closed as too broad What problem are you trying to solve (rather than giving us a solution and asking how it can be implemented). Mar 5 '16 at 11:51
  • @EightBitTony Thank for the input. I agree that there are may be many solutions. I guess I found one of them. I posted it a minute ago
    – Oleg
    Mar 5 '16 at 12:06

Another solution would be a symlink from /etc/cron.d/ (or /var/spool/cron/) to a file on which he has access via the ftp server.

BUT: You know that by giving him access to cron, he can run EVERY command - in case of /etc/cron.d/, as you are doing now, even as root?

  • Yes, I know that access to the file inside /etc/cron.d gives the ability to run commands under root. But I don't give him direct access to it. I generate cron file myself with values he provide me (Note that he can't set user, the user is always john). As for /var/spool/cron/ - this is an interesting solution, and I have already tried it. But in case user uses WIndows as his host OS, files edited via FTP would have Windows-specific characters, which might make cron file invalid. So the solution I provided in my answer seems to be most acceptable to me. But thanks anyway @mifritscher!
    – Oleg
    Mar 5 '16 at 14:01
  • Ah, ok. I think the biggest problem with Windows users are the \r characters. I assume that you have a white list for the commands? Else john can e.g. send a string like ls\n * * * * * root <the bad command> as command ;-) Btw. similiar is possible with the sec/min/hour etc. fields as well if not correctly escaped. Mar 5 '16 at 14:08
  • Certainly, the user input data must be carefully escaped. Thanks!
    – Oleg
    Mar 5 '16 at 14:15

I guess I found a solution (one of). I can create an HTML form with 6 inputs (minute, hour, day, month, dayofweek, command), and let John use it.

After submit I generate a cron file with these 6 values (+ john as username), validate it with this Python script, and put it to /etc/cron.d directory.

There is a difficulty with putting this file to cron.d since the webserver runs under a non-privileged user. This can be solved with setuid'ed C++ program.

  • 1
    So, can John create a cronjob entry which runs that setuid program to give himself SSH access? Or maybe just give himself a root login shell? Mar 5 '16 at 14:43
  • @EightBitTony of course not. setuid program is used only to move generated cron file (which would contain entries with john user only) to /etc/cron.d
    – Oleg
    Mar 5 '16 at 15:11
  • 1
    It's confusing because you're building a system which is complex, and has built in risks, to avoid giving someone an ssh account, which is inherently locked to their user ID. If you're worried about what they can do, then a chroot jail or restricted shell are usually more common solutions. Mar 5 '16 at 23:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.