Discussion between Owen Blacker and oHessling

Stack Exchange

13:17

0

A: Frustrating issue where neither cron nor su -c runs my job (permissions?)

Is crond running? Try one of these commands: pidof crond pgrep -l crond ps caxf | grep -6 crond --color output of last command: 11881 ? S 0:00 \_ httpd 11882 ? S 0:00 \_ httpd 11883 ? S 0:00 \_ httpd 11884 ? S 0:00 \_ httpd 11885 ? S 0:00 \_ httpd 11886 ? S 0:00 \_ httpd 2098 ? Ss 0:01...

Owen Blacker

It does appear to be: [blackero@XXXXXXXXXXX to]$ ps cax | grep crond gives me 2098 ? Ss 0:01 crond

oHessling

Please give me the output of ps caxf | grep -6 crond --color in your question. => Please edit your question

Owen Blacker

``11881 ? S 0:00 \_ httpd``
``11882 ? S 0:00 \_ httpd``
``11883 ? S 0:00 \_ httpd``
``11884 ? S 0:00 \_ httpd``
``11885 ? S 0:00 \_ httpd``
``11886 ? S 0:00 \_ httpd``
``2098 ? Ss 0:01 crond``
``2125 ? Ss 0:00 sudoscriptd``
``2127 ? Ss 0:00 \_ sudoscriptd``
``2136 tty2 Ss+ 0:00 mingetty``
``2137 tty3 Ss+ 0:00 mingetty``
``2138 tty4 Ss+ 0:00 mingetty``
2139 tty5 Ss+ 0:00 mingetty`

Hmm, that doesn't format well. There is a line reading 2098 ? Ss 0:01 crond, with crond in red.

Looking at /etc/sysconfig/crond, it would seem CRONDARGS=, if that makes a difference, too.

locate cron.allow comes up with no files. locate cron.deny does come up with /etc/cron.deny, but that file is empty.

oHessling

perfect, this is correct to be allowed. I still do not see what is wrong. Can you restart the crond deamon? What say the crondlog?

you can add CRONDARGS=-p this permit any crontab even if /etc/crontab has to many permissions (should be writable for root only). crond usually uses sendmail by default. You can also check whether sendmail is available...

Owen Blacker

Ìt's not my server, so I can't set CRONDARGS=-p without getting t he hosting provider upset (they're responsible for security). sendmail is running, though. How else can I tell if crond is actually running jobs?

oHessling

13:32

What a pity you cannot have control on crond...

I am pretty sure the issue is well explain within the crond logs

Do you have an administrator contact?

Owen Blacker

I can access the cron logs; I'm just trying to do s now

oHessling

crond logs may not be readable (only for root)

Owen Blacker

There's a bunch of lines reading: ERROR: failed to open PAM security session: Success

(I can sudo and sudo su root, I'm just not allowed to change security things)

These three lines seem t o appear each time it tries to run:
`crond[29522]: Authentication service cannot retrieve authentication info`
`crond[29522]: CRON (cronuser) ERROR: failed to open PAM security session: Success`
`crond[29522]: CRON (cronuser) ERROR: cannot set security context`

oHessling

Do you use Red Hat, Ubuntu ?

Owen Blacker

RedHat

`[blackero@XXXXXXXXXXXXXXX init.d]$ uname -a`
`Linux XXXXXXXXXXXXXXX.gs2.bt.ip-soft.net 2.6.18-238.12.1.el5 #1 SMP Sat May 7 20:18:50 EDT 2011 x86_64 x86_64 x86_64 GNU/Linux`

oHessling

13:38

Therefore PAM is configured at /etc/pam.d/crond

Owen Blacker

auth sufficient pam_env.so
auth required pam_rootok.so
auth include system-auth
account required pam_access.so
account include system-auth
session required pam_loginuid.so
session include system-auth

oHessling

best is to use cat /etc/issue

Owen Blacker

?

oHessling

To known what distro you use => cat /etc/issue

uname -a does not tell much about distro

Owen Blacker

`[blackero@XXXXXXXXXXXXX init.d]$ cat /etc/issue`
`Red Hat Enterprise Linux Server release 5.6 (Tikanga)`
`Kernel \r on an \m`

Ah, I see. Yes, I was thinking that, but didn't know how to get that info :)

oHessling

13:40

it was ok ;-)

I am pretty sure PAM does not allow crond to run commands for your user...

But I am not an expert on PAM and other administration security things

Owen Blacker

I noticed that cronuser does not have a home directory, so it might be that the user is misconfigured. How should I resolve that? If I look in /etc/passwd, they show up as cronuser:x:506:507:cron user:/home/cronuser:/bin/bash -- does that look right?

oHessling

What say the PAM logs ?

Owen Blacker

Should I sudo mkdir /home/cronuser or something?

oHessling

cronuser does not need a /home

Owen Blacker

I can't see any log for pam. locate log | grep --color pam doesn't return me anything that looks like a logfile

oHessling

13:45

Because cronuser never runs crontab with user = cronuser

cronuser always runs crontab using other users

Owen Blacker

(Only /etc/pam.d/login, some files in /lib/ and /lib64/ plus some stuff in /usr/share/)

oHessling

I do not remember where PAM logs are...

Owen Blacker

Ah, of course

There's nothing in /var/log/secure dated today, which is the only logfile I could see in a quick Google

I'm stupid

I was looking at the head of /var/log/secure, not the tail

I last tried to test cron at 1209 local time and there are no entries between a sudo for me at 12:08:14 and another sudo for me at 12:20:21, so nothing is hitting /var/log/secure from the failed cron jobs

oHessling

I am sorry I have no clue after that point...

Owen Blacker

Fair enough. Thank you for helping.

So what is it that I need to ask for further help on?

oHessling

13:50

This is grate you find some stuff in crond logs.

Owen Blacker

It's those three lines in the crond logs that I want to post a new question about, right?

oHessling

Yes, I think this a good idea.

Maybe you will find another similar question on SO...

Owen Blacker

Thank you again :)

oHessling

More skilled experts will answer to your accurate new question for sure

bye bye

Owen Blacker

Bye

Transcript for

Discussion between Owen Blacker and o…