I have a permissions issue on my CentOS 5.6 machine with regards to the cron user.

On my test/staging environment my cron user (picco-cron) is a member of one group - picco-cron, as below:

[crmpicco@1872-stage1 downloads]$ id picco-cron
uid=601(picco-cron) gid=601(picco-cron) groups=601(picco-cron)

Whereas, my development environment the same user, is a member of the dev group.

[root@dev53 dev_crmpicco]# id picco-cron
uid=503(picco-cron) gid=503(picco-cron) groups=503(picco-cron),555(dev)

The problem I have is that my PHP web application directories have a group of dev, which is correct, so on my development environment I can write/read to and from these directories as expected. However, on the test/staging environment I cannot as picco-cron is not a member of the dev group.

My question is - is there a security issue around letting the "cron" user have access to writing to 90% of the directories in my application? Is it as simple as to add picco-cron to the dev group or is there a security concern here?

  • 2
    What is a "cron-user"? You can have a crontab for every user... – Nils Jan 3 '13 at 20:17
  • My cron user is pretty much exactly what it sounds like. A user created for the purposes solely of running cron jobs. – crmpicco Jan 4 '13 at 9:14
  • 1
    @crmpicco, better use the regular user. Using a "generic cron user" forces to make that one able to access all sort of stuff, and that (if using tradicional ugo permission model) opens up stuff to all users, and... – vonbrand Jan 26 '13 at 3:08
  • I agree with vonbrand, using a generic cron user is a significant security hole. Having the web user run it's own cron jobs is the "right" way. Also note that if this is a pure security question, there's security.stackexchange.com which will be more than happy to point out every last little detail :-) – Patrick Feb 4 '14 at 5:36

You have a very special setup there.

IMHO a staging environment should not give developers a write access.

So there are two roles involved:

  • Your web-Server - lets call its username "apache"
  • A technical php-administator that keeps the php-web-application current "phpadm"

Now the phpadm should be able to write the files that the webserver delivers. Let us build a common group "www" for that purpose.

PHP-files belong to user phpadm, group www. Your webserver runs as user apache, group www. Static files are rw for phpadm and ro for www.

In that scenario your picco-cron has to get the www-group, if you want to run backups (i.e. read) with it.

  • Or just run cron jobs as phpadm. – vonbrand Jan 26 '13 at 3:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.