I have a temp directory set up where users can place whatever files they need to send to other users via HTTP. The owner of this directory is an SFTP user, and cannot run cron jobs.

I have one shell user that can run cron jobs, but does not have permission to edit files in the SFTP user's directory.

I have an admin user that can access the SFTP user's directory when using sudo, but can't (read: I'd really rather not) run cron jobs.

So, here's the conundrum. How do I get a nightly cron job to run as a shell user to delete files older than 1 week within the SFTP user's directory, with the admin user's privileges?

  • And the reason why can't you run a system cron job as the SFTP user is ...? – jw013 Sep 21 '12 at 21:50
  • No shell access – Ed Marty Sep 21 '12 at 21:51
  • What is your preferred approach? – artistoex Sep 22 '12 at 0:55

Edit the /etc/sudoers file (use visudo!) and add an entry that allows the shell user to have sufficient privileges to run a specific command, without having to enter a password. If you use a script, make sure the script cannot by edited by anyone but root.

In /etc/sudoers, where shelluser is the shell user name:

shelluser ALL=NOPASSWD: /usr/bin/clean-up-sftp-temp-directory

In a /usr/bin/clean-up-sftp-temp-directory script, you can put something like:

rm -f /home/sftpuser/will-be-deleted/*

After making the script executable, you should be able to call sudo clean-up-sftp-temp-directory and add it to the shell user's crontab.

  • Awesome, thanks. For some reason I was having lots of trouble with the sudoers file before I posted the question (kept complaining about a syntax error). Copying your line almost verbatim fixed the problem nice and quick. – Ed Marty Sep 23 '12 at 2:13
  • 1
    Make sure, nobody can replace "will-be-deleted" with a symlink to /etc/ for instance. Also, if it doesn't need root priviledge, don't give it root privilege (use sudo -u the-user-who-as-the-right and replace the ALL with that user in sudoers) – Stéphane Chazelas Oct 31 '12 at 20:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.