1

I have a user with highly restricted rights.

While I'm allowed to modify my crontab, the default editor is nano, which can become a real problem when you are used to vi and don't want to screw a production environment.

I can't export a variable, nor declare one, so export EDITOR='vi' or EDITOR=vi crontab -e just don't work ... and I'm not even allowed to run vi (or nano) directly, so I have no idea how I actually could handle that.

Is there a way to circumvent those restrictions ?


To give an idea of my limitations, the login message is :

You are in a limited shell.
Type '?' or 'help' to get the list of allowed commands

and the result of the "?" command is

cd  clear  crontab  exit  help  history  lpath  ls  lsudo  php  pwd

EDIT : Forgot to look for my OS version

/proc/version tells me that :
Linux version 2.6.26-2-amd64 (Debian 2.6.26-29) (dannf@debian.org) (gcc version 4.1.3 20080704 (prerelease) (Debian 4.1.2-25)) #1 SMP Sun Mar 4 21:48:06 UTC 2012

... and cat /etc/debian_version tells me 5.0.10 (What ?!)

I'm more used to play with Ubuntu now, but am still a bit surprised.

  • If you are able to transfer a text file to the system, you can load it with crontab somefile. That would replace the current crontab for that user though. – Kusalananda Sep 5 '17 at 12:59
  • What error message (if any) do you get with VISUAL=vi crontab -e? – Fox Sep 5 '17 at 13:12
  • @Kusalananda Gotta (backup my crontab and) try this. Btw, I wasn't surprised to discover that this command replaces the crontab file with the specified target :) Yet, just tried out on some non-important account, and guess it should work fine. Consider making this an answer. – Balmipour Sep 5 '17 at 13:14
  • And the error message is *** unknown command: VISUAL='vi' – Balmipour Sep 5 '17 at 13:15
1

Judging by the usage message, you're running lshell. This is not a Bourne-style shell like bash, ksh, zsh, BusyBox and others. It isn't even a restricted shell like rksh or rbash. It doesn't have variables, redirections or any other feature beyond executing a fixed set of commands with some arguments.

If you're able to run vi, that means either there's a bug in lshell or it's been misconfigured. It's designed to prevent running arbitrary commands.

Since you can run php, you may be able to work around it. But obviously the administrators don't intend you to.

A crontab is usually short, so if you want to edit it with a different editor, open a terminal that's large enough, copy the whole thing to your local machine through the GUI clipboard, edit and copy in the other direction. In nano, make sure that automatic line wrapping is turned off (Alt+L to toggle), as well as (but this one shouldn't matter for a crontab) automatic indentation (Alt+I).

  • I'll try not to forget this alt+L. The automatic wrapping is the first thing I noticed, and made me "panic quit" immediately. While I'm sure learning nano basics remains useful too, I was really looking for a way to circumvent this. Guess loading the crontab like Kusalananda suggested will be the way. Just waiting for the go to actually try it on the prod server now ! – Balmipour Sep 6 '17 at 8:19
0

If you are able to transfer files in and out of the system, make a backup of the current crontab:

$ crontab -l >crontab.txt

If you're unable to perform redirections, just do crontab -l and copy-and-paste the crontab (making sure everything is identical).

Then, with the crontab text file on a not-so-locked down system, update it in an editor.

Transfer the file back and do

$ crontab crontab.txt

This should be properly tested on an identical development server, including whether the job specifications are correct, before implementation on a production server. Note that loading a crontab into crontab in this way replaces the current crontab.

I take no responsibility.

  • Restricted Bourne-style shells don't allow redirection. And here this doesn't look like a Bourne-style shell at all (no ? command in sh), so you can't expect an sh construct such as redirection. – Gilles 'SO- stop being evil' Sep 5 '17 at 22:22
  • @Gilles Yes, this is why I wasn't sure redirection would be working. See, I said try it and if it doesn't work, do copy and paste, exactly like you wrote in your answer. – Kusalananda Sep 6 '17 at 6:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.