In this lesson, you will learn how to audit crontab ownership and permissions to prevent attackers from escalating privileges through automated tasks.
When you configure a cron job, you are effectively telling the system to execute commands on your behalf at specific intervals. If the configuration files themselves are insecurely permissioned, you open a backdoor for privilege escalation.
The Risk of Excessive Permissivity
The primary security risk occurs when a crontab file (located in /var/spool/cron/crontabs/ or system-wide in /etc/cron.d/) is world-writable. If an attacker can modify a cron job file, they can inject malicious scripts that execute with the privileges of the file owner—often root for system tasks.
Auditing Ownership and Permissions
To maintain a secure environment, every crontab must be owned by the user it serves and restricted so that only that user can modify it. A secure configuration generally adheres to these constraints:
- Ownership: The file should be owned by the specific user (or root).
- Permissions: The file should have permissions set to
0600(read/write for owner only).
You can audit these settings using the ls -l command. For example, to check the system-wide cron directory:
ls -l /etc/cron.d/
If you see permissions like -rw-rw-rw- or ownership assigned to a non-privileged user while running a root task, you are vulnerable. If you identify a file with overly permissive settings, tighten them immediately:
# Correcting permissions to read/write for owner only
chmod 600 /etc/cron.d/my_scheduled_task
# Ensuring correct ownership
chown root:root /etc/cron.d/my_scheduled_task
Why This Matters
If a cron job runs a script located in a directory where a standard user has write access, an attacker could replace your legitimate script with a malicious payload. Even if the crontab file itself is secure, the target script must also have restricted permissions. Always ensure that the scripts executed by cron are not writable by any user other than the one running the job. By auditing these file permissions, you close a common path used by local attackers to gain elevated system access.
Key Takeaway: Regularly audit crontab files and their associated execution scripts to ensure they are owned by the intended user and restricted to 0600 permissions to prevent unauthorized modification and privilege escalation.