Hi. Allowing anyone to use cron can be a security risk,... So the default should be to ship a cron.allow with just root. What do you think? Chris. ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.
tags 511784 wontfix moreinfo thanks You said: I do not agree here, if you do not trust your users then they should not have shell access to your system (which is the only way they can setup crontabs). If users are already able to execute a shell in the system and they have malicious intentions there is no different whether you allow them to use the crontab or not, disabling them the use of the at/crontab does not prevent them from running scheduled jobs: setting up a time bomb with a simple python/perl script is really easy to do. I'm not convinced that the default setup of cron should be disallowing access to any user besides root and I'm not inclined to change the current setup. I will mark this bug as wontfix, if I have do not hear any more arguments for this option (preferably, backed up with a consensus in the debian-devel and/or debian-security mailing lists) I will close this bug. Regards Javier
Good point, especially as any user can make his own cron... Yeah... However, those processes can be easier spottet (running with user uid, which cron does not)... and one could think of security frameworks, that kill long running user-processes after some time.. But ok,.. I agree that this is not reason enough to change the well known default... A "solution" could be to add a debconf question at high level, where the user is asked whether only root should be allowed or not (or perhaps even which users are allowed...)... And the default could be simply everyone as right now. Cheers, Chris.
I could consider this a option. But this question should not be a high priority question, as the default works fine for most users. Regards Javier
Ah... I meant low.... I always mix that up ^^ Cheers, Chris.