Discussion between Owen Blacker and oHessling - 2012-02-08

last day (15 days later) »

1:17 PM

0

A: Frustrating issue where neither cron nor su -c runs my job (permissions?)

Is crond running? Try one of these commands: pidof crond pgrep -l crond ps caxf | grep -6 crond --color output of last command: 11881 ? S 0:00 \_ httpd 11882 ? S 0:00 \_ httpd 11883 ? S 0:00 \_ httpd 11884 ? S 0:00 \_ httpd 11885 ? S 0:00 \_ httpd 11886 ? S 0:00 \_ httpd 2098 ? Ss 0:01...

It does appear to be: [blackero@XXXXXXXXXXX to]$ ps cax | grep crond gives me 2098 ? Ss 0:01 crond

Please give me the output of ps caxf | grep -6 crond --color in your question. => Please edit your question

``11881 ? S 0:00 \_ httpd``
``11882 ? S 0:00 \_ httpd``
``11883 ? S 0:00 \_ httpd``
``11884 ? S 0:00 \_ httpd``
``11885 ? S 0:00 \_ httpd``
``11886 ? S 0:00 \_ httpd``
``2098 ? Ss 0:01 crond``
``2125 ? Ss 0:00 sudoscriptd``
``2127 ? Ss 0:00 \_ sudoscriptd``
``2136 tty2 Ss+ 0:00 mingetty``
``2137 tty3 Ss+ 0:00 mingetty``
``2138 tty4 Ss+ 0:00 mingetty``
2139 tty5 Ss+ 0:00 mingetty`

Hmm, that doesn't format well. There is a line reading 2098 ? Ss 0:01 crond, with crond in red.

Looking at /etc/sysconfig/crond, it would seem CRONDARGS=, if that makes a difference, too.

locate cron.allow comes up with no files. locate cron.deny does come up with /etc/cron.deny, but that file is empty.

perfect, this is correct to be allowed. I still do not see what is wrong. Can you restart the crond deamon? What say the crondlog?

you can add CRONDARGS=-p this permit any crontab even if /etc/crontab has to many permissions (should be writable for root only). crond usually uses sendmail by default. You can also check whether sendmail is available...

Ìt's not my server, so I can't set CRONDARGS=-p without getting t he hosting provider upset (they're responsible for security). sendmail is running, though. How else can I tell if crond is actually running jobs?

1:32 PM

What a pity you cannot have control on crond...

I am pretty sure the issue is well explain within the crond logs

Do you have an administrator contact?

I can access the cron logs; I'm just trying to do s now

crond logs may not be readable (only for root)

There's a bunch of lines reading: ERROR: failed to open PAM security session: Success

(I can sudo and sudo su root, I'm just not allowed to change security things)

These three lines seem t o appear each time it tries to run:
`crond[29522]: Authentication service cannot retrieve authentication info`
`crond[29522]: CRON (cronuser) ERROR: failed to open PAM security session: Success`
`crond[29522]: CRON (cronuser) ERROR: cannot set security context`

Do you use Red Hat, Ubuntu ?

RedHat

`[blackero@XXXXXXXXXXXXXXX init.d]$ uname -a`
`Linux XXXXXXXXXXXXXXX.gs2.bt.ip-soft.net 2.6.18-238.12.1.el5 #1 SMP Sat May 7 20:18:50 EDT 2011 x86_64 x86_64 x86_64 GNU/Linux`

1:38 PM

Therefore PAM is configured at /etc/pam.d/crond

auth sufficient pam_env.so
auth required pam_rootok.so
auth include system-auth
account required pam_access.so
account include system-auth
session required pam_loginuid.so
session include system-auth

best is to use cat /etc/issue

?

To known what distro you use => cat /etc/issue

uname -a does not tell much about distro

`[blackero@XXXXXXXXXXXXX init.d]$ cat /etc/issue`
`Red Hat Enterprise Linux Server release 5.6 (Tikanga)`
`Kernel \r on an \m`

Ah, I see. Yes, I was thinking that, but didn't know how to get that info :)

1:40 PM

it was ok ;-)

I am pretty sure PAM does not allow crond to run commands for your user...

But I am not an expert on PAM and other administration security things

I noticed that cronuser does not have a home directory, so it might be that the user is misconfigured. How should I resolve that? If I look in /etc/passwd, they show up as cronuser:x:506:507:cron user:/home/cronuser:/bin/bash -- does that look right?

What say the PAM logs ?

Should I sudo mkdir /home/cronuser or something?

cronuser does not need a /home

I can't see any log for pam. locate log | grep --color pam doesn't return me anything that looks like a logfile

1:45 PM

Because cronuser never runs crontab with user = cronuser

cronuser always runs crontab using other users

(Only /etc/pam.d/login, some files in /lib/ and /lib64/ plus some stuff in /usr/share/)

I do not remember where PAM logs are...

Ah, of course

There's nothing in /var/log/secure dated today, which is the only logfile I could see in a quick Google

I'm stupid

I was looking at the head of /var/log/secure, not the tail

I last tried to test cron at 1209 local time and there are no entries between a sudo for me at 12:08:14 and another sudo for me at 12:20:21, so nothing is hitting /var/log/secure from the failed cron jobs

I am sorry I have no clue after that point...

Fair enough. Thank you for helping.

So what is it that I need to ask for further help on?

1:50 PM

This is grate you find some stuff in crond logs.

It's those three lines in the crond logs that I want to post a new question about, right?

Yes, I think this a good idea.

Maybe you will find another similar question on SO...

Thank you again :)

More skilled experts will answer to your accurate new question for sure

bye bye

Bye

last day (15 days later) »

Transcript for

Feb '128

Discussion between Owen Blacker and o…

Imported from a comment discussion on unix.stackexchange.com/q...

cron permissions

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile