From cf5f9d378cda7ac33ca611ad6cc8ab68233eebc6 Mon Sep 17 00:00:00 2001 From: Christoph Wickert Date: Fri, 26 Nov 2021 10:56:56 +0100 Subject: [PATCH 1/2] New tasks about restricting the cron and at daemons --- DC-task-restrict-at | 12 ++ DC-task-restrict-cron | 12 ++ xml/task-restrict-at.xml | 229 ++++++++++++++++++++++++++++++++ xml/task-restrict-cron.xml | 259 +++++++++++++++++++++++++++++++++++++ 4 files changed, 512 insertions(+) create mode 100644 DC-task-restrict-at create mode 100644 DC-task-restrict-cron create mode 100644 xml/task-restrict-at.xml create mode 100644 xml/task-restrict-cron.xml diff --git a/DC-task-restrict-at b/DC-task-restrict-at new file mode 100644 index 000000000..b0501ff36 --- /dev/null +++ b/DC-task-restrict-at @@ -0,0 +1,12 @@ +# This file originates from the project https://github.com/openSUSE/doc-kit +# This file can be edited downstream. + +MAIN="task-restrict-at.xml" +ROOTID="task-restrict-at" + +PROFCONDITION="suse-product" +#PROFCONDITION="suse-product;beta" +#PROFCONDITION="community-project" + +STYLEROOT="/usr/share/xml/docbook/stylesheet/suse2021-ns" +FALLBACK_STYLEROOT="/usr/share/xml/docbook/stylesheet/suse-ns" diff --git a/DC-task-restrict-cron b/DC-task-restrict-cron new file mode 100644 index 000000000..7cdd5dba8 --- /dev/null +++ b/DC-task-restrict-cron @@ -0,0 +1,12 @@ +# This file originates from the project https://github.com/openSUSE/doc-kit +# This file can be edited downstream. + +MAIN="task-restrict-cron.xml" +ROOTID="task-restrict-cron" + +PROFCONDITION="suse-product" +#PROFCONDITION="suse-product;beta" +#PROFCONDITION="community-project" + +STYLEROOT="/usr/share/xml/docbook/stylesheet/suse2021-ns" +FALLBACK_STYLEROOT="/usr/share/xml/docbook/stylesheet/suse-ns" diff --git a/xml/task-restrict-at.xml b/xml/task-restrict-at.xml new file mode 100644 index 000000000..5a708238f --- /dev/null +++ b/xml/task-restrict-at.xml @@ -0,0 +1,229 @@ + + + + + + + %entities; +]> + + + +
+ + + Restricting the <systemitem class="daemon">at</systemitem> scheduler + + + https://bugzilla.suse.com/enter_bug.cgi + Smart Docs + Documentation + cwickert@suse.com + + no + + + +
+ Environment + This document applies to the following products and product versions: + + + &sles; 15 SP3, 15 SP2, 15 SP1, 15 GA, 12 SP5, 12 SP4, 12 SP3 + + + &sles4sap; 15 SP3, 15 SP2, 15 SP1, 15 GA, 12 SP5, 12 SP4, 12 SP3 + + + &sleha; 15 SP3, 15 SP2, 15 SP1, 15 GA, 12 SP5, 12 SP4, 12 SP3 + + + &slehpc; 15 SP3, 15 SP2, 15 SP1, 15 GA + + + &sled; 15 SP3, 15 SP2, 15 SP1, 15 GA, 12 SP5, 12 SP4, 12 SP3 + + + &slert; 15 SP3, 15 SP2, 15 SP1, 15 GA, 12 SP5, 12 SP4, 12 SP3 + + +
+ +
+ Introduction + + The at job execution system allows + users to schedule one-time running jobs. The at.allow + file specifies a list of users that are allowed to schedule jobs via + at. The file does not exist by + default, so all users can schedule at + jobs—except for those listed in at.deny) + +
+ +
+ Requirements + + + + You have installed your product and your system is up and running. + + + + + The at package is installed. If not, run + zypper in at to install it. + + + + +
+ +
+ Restrict access to the <systemitem class="daemon">at</systemitem> scheduler + + + + To prevent users except for &rootuser; from scheduling jobs with at, perform the following steps. + + + + Create an empty file /etc/at.allow: + +&prompt.sudo;touch /etc/at.allow + + + + Allow users to schedule jobs with at by adding their usernames to the file: + +&prompt.sudo;echo "&exampleuser_plain;" >> /etc/at.allow + + + + To verify, try scheduling a job as non-root user listed in + at.allow: + +&prompt.user;at 00:00 +at> + + Quit the atprompt with + C and + try the same with a user not listed in + /etc/at.allow (or before adding them the file in step + 2 of this procedure): + +&prompt.user2;at 00:00 +You do not have permission to use at. + + +
+ +
+ Summary + + You have now restricted scheduling jobs with at for non-root users. + +
+ +
+ Troubleshooting + When implementing /etc/at.allow, there are + basically just two problems that can occur: + + + + A user can schedule a job with at although they should + not. + + + Check that the username in /etc/at.allow matches + the actual username. + + + + + A user can not schedule a job with at jobs although they + should. + + + If the user is correctly listed in /etc/at.allow + but cannot schedule at jobs, + check if they are also listed in /etc/at.deny. If + the user appears in both files, /etc/at.deny wins. + Remove the user from the file to allow them to schedule at jobs. + + + + +
+ +
+ Next steps + + + + at is not widely used anymore. + If you do not have valid use cases, consider uninstalling the daemon instead + of just restricting its access. + + + + + To further improve security, also consider restricting access to the + cron daemon. + + + +
+ +
+ Related topics + + + + Restricting the at scheduler + + + + + + Create &systemd; timers + + + + +
+
diff --git a/xml/task-restrict-cron.xml b/xml/task-restrict-cron.xml new file mode 100644 index 000000000..37e6527a6 --- /dev/null +++ b/xml/task-restrict-cron.xml @@ -0,0 +1,259 @@ + + + + + + + %entities; +]> + + + +
+ + + Restricting the <systemitem class="daemon">cron</systemitem> daemon + + + https://bugzilla.suse.com/enter_bug.cgi + Smart Docs + Documentation + cwickert@suse.com + + no + + + +
+ Environment + This document applies to the following products and product versions: + + + &sles; 15 SP3, 15 SP2, 15 SP1, 15 GA, 12 SP5, 12 SP4, 12 SP3 + + + &sles4sap; 15 SP3, 15 SP2, 15 SP1, 15 GA, 12 SP5, 12 SP4, 12 SP3 + + + &sleha; 15 SP3, 15 SP2, 15 SP1, 15 GA, 12 SP5, 12 SP4, 12 SP3 + + + &slehpc; 15 SP3, 15 SP2, 15 SP1, 15 GA + + + &sled; 15 SP3, 15 SP2, 15 SP1, 15 GA, 12 SP5, 12 SP4, 12 SP3 + + + &slert; 15 SP3, 15 SP2, 15 SP1, 15 GA, 12 SP5, 12 SP4, 12 SP3 + + +
+ +
+ Introduction + + The cron system is used to + automatically run commands in the background at predefined times. + + + + The cron.allow file specifies a list of users that are + allowed to execute jobs via cron. + The file does not exist by default, so all users can create + cron jobs—except for those + listed in cron.deny. + +
+ +
+ Requirements + + + + You have installed your product and your system is up and running. + + + + + The cron package is installed. If not, run + zypper in cron to install it. + + + + +
+ +
+ Restrict access to the <systemitem class="daemon">cron</systemitem> daemon + + + + To prevent users except for root from creating cron jobs, perform the following steps. + + + + Create an empty file /etc/cron.allow: + +&prompt.sudo;touch /etc/cron.allow + + + + Allow users to create cron jobs by + adding their usernames to the file: + +&prompt.sudo;echo "&exampleuser_plain;" >> /etc/cron.allow + + + + To verify, try creating a cron job + as non-root user listed in cron.allow. You should see + the message: + +&prompt.user;crontab -e +no crontab for &exampleuser_plain; - using an empty one + + Quit the crontab editor and try the same with a user + not listed in cron.allow (or + before adding them to the file in step 2 of this procedure): + +&prompt.user2;crontab -e +You (&exampleuserII_plain;) are not allowed to use this program (crontab) +See crontab(1) for more information + + +
+ +
+ Summary + + You have now restricted creation of new cron jobs for non-root users. + + + Existing <systemitem class="daemon">cron</systemitem> jobs + + Implementing cron.allow only prevents users from + creating new cron jobs. Existing + jobs will still be run, even for users listed in + cron.deny. To prevent this, create the file as + described and remove existing user crontabs from the directory + /var/spool/cron/tabs to ensure they are not run + anymore. + + +
+ +
+ Troubleshooting + When implementing /etc/cron.allow, there are + basically just two problems that can occur: + + + + A user can create a cron job although they should + not. + + + Check that the username in /etc/cron.allow matches + the actual username. + + + + + A user can not create cron jobs although they + should. + + + If the user is correctly listed in /etc/cron.allow + but cannot create new cron jobs, + check if they are also listed in /etc/cron.deny. If + the user appears in both files, /etc/cron.deny wins. + Remove the user from the file to allow them to create cron jobs. + + + + +
+ +
+ Next steps + + + + To further improve security, also consider restricting access to the + at scheduler. + + + + + You should also consider switching to &systemd; timer units, as they allow + for more powerful and reliable task execution. By default, users cannot use + them to run code when they are not logged in. This limits the way users can + interact with the system while not being connected to it. + + + + +
+ +
+ Related topics + + + + Restricting the at scheduler + + + + + Create &systemd; timers + + + + + + List + + + +
+
From 2b20c8e24f0d3cbae2901cf9bead0f3fc15774db Mon Sep 17 00:00:00 2001 From: Christoph Wickert Date: Wed, 1 Dec 2021 11:16:01 +0100 Subject: [PATCH 2/2] Restrict cron and at: Use entities for 'cron' and 'at', fix some minor issues --- xml/task-restrict-at.xml | 62 ++++++++++++++++++-------------------- xml/task-restrict-cron.xml | 60 +++++++++++++++--------------------- 2 files changed, 54 insertions(+), 68 deletions(-) diff --git a/xml/task-restrict-at.xml b/xml/task-restrict-at.xml index 5a708238f..af1cb020a 100644 --- a/xml/task-restrict-at.xml +++ b/xml/task-restrict-at.xml @@ -9,6 +9,7 @@ [ %entities; + at"> ]> - To prevent users except for &rootuser; from scheduling jobs with at, perform the following steps. + To prevent users except for &rootuser; from scheduling jobs with &atd;, + perform the following steps. @@ -120,8 +120,8 @@ - Allow users to schedule jobs with at by adding their usernames to the file: + Allow users to schedule jobs with &atd; by adding their usernames to the + file: &prompt.sudo;echo "&exampleuser_plain;" >> /etc/at.allow @@ -133,7 +133,7 @@ &prompt.user;at 00:00 at> - Quit the atprompt with + Quit the &atd;prompt with C and try the same with a user not listed in /etc/at.allow (or before adding them the file in step @@ -148,21 +148,20 @@ You do not have permission to use at.
Summary - You have now restricted scheduling jobs with at for non-root users. + You have successfully restricted scheduling jobs with &atd; for non-root + users.
Troubleshooting When implementing /etc/at.allow, there are - basically just two problems that can occur: + basically only two problems that can occur: - A user can schedule a job with at although they should - not. + A user can schedule a job with &atd; although + they should not. Check that the username in /etc/at.allow matches @@ -171,17 +170,15 @@ You do not have permission to use at. - A user can not schedule a job with at jobs although they - should. + A user can not schedule a job with &atd; jobs + although they should. If the user is correctly listed in /etc/at.allow - but cannot schedule at jobs, - check if they are also listed in /etc/at.deny. If - the user appears in both files, /etc/at.deny wins. - Remove the user from the file to allow them to schedule at jobs. + but cannot schedule &atd; jobs, check if they are also listed in + /etc/at.deny. If the user appears in both files, + /etc/at.deny wins. Remove the user from that file to + allow them to schedule &atd; jobs. @@ -193,15 +190,14 @@ You do not have permission to use at. - at is not widely used anymore. - If you do not have valid use cases, consider uninstalling the daemon instead - of just restricting its access. + &atd; is not widely used anymore. If you do not have valid use cases, + consider uninstalling the daemon instead of just restricting its access. To further improve security, also consider restricting access to the - cron daemon. + &crond; daemon. @@ -212,9 +208,9 @@ You do not have permission to use at. - Restricting the at scheduler + Restricting the &crond; scheduler + --> diff --git a/xml/task-restrict-cron.xml b/xml/task-restrict-cron.xml index 37e6527a6..8c977a98d 100644 --- a/xml/task-restrict-cron.xml +++ b/xml/task-restrict-cron.xml @@ -27,7 +27,7 @@ xmlns:xlink="http://www.w3.org/1999/xlink"> - Restricting the <systemitem class="daemon">cron</systemitem> daemon + Restricting the &crond; daemon https://bugzilla.suse.com/enter_bug.cgi @@ -67,18 +67,16 @@
Introduction - The cron system is used to - automatically run commands in the background at predefined times. - + The &crond; system is used to automatically run commands in the background at + predefined times. + The cron.allow file specifies a list of users that are - allowed to execute jobs via cron. - The file does not exist by default, so all users can create - cron jobs—except for those - listed in cron.deny. + allowed to execute jobs via &crond;. The file does not exist by default, so + all users can create &crond; jobs—except for those listed in + cron.deny.
@@ -105,18 +103,18 @@
- Restrict access to the <systemitem class="daemon">cron</systemitem> daemon + Restrict access to the &crond; daemon - To prevent users except for root from creating cron jobs, perform the following steps. + To prevent users except for root from creating &crond; jobs, perform the + following steps. @@ -126,16 +124,14 @@ - Allow users to create cron jobs by - adding their usernames to the file: + Allow users to create &crond; jobs by adding their usernames to the file: &prompt.sudo;echo "&exampleuser_plain;" >> /etc/cron.allow - To verify, try creating a cron job - as non-root user listed in cron.allow. You should see - the message: + To verify, try creating a &crond; job as non-root user listed in + cron.allow. You should see the message: &prompt.user;crontab -e no crontab for &exampleuser_plain; - using an empty one @@ -154,17 +150,16 @@ See crontab(1) for more information
Summary - You have now restricted creation of new cron jobs for non-root users. + You have successfully restricted creation of new &crond; jobs for non-root + users. - Existing <systemitem class="daemon">cron</systemitem> jobs + Existing &crond; jobs Implementing cron.allow only prevents users from - creating new cron jobs. Existing - jobs will still be run, even for users listed in - cron.deny. To prevent this, create the file as - described and remove existing user crontabs from the directory + creating new &crond; jobs. Existing jobs will still be run, even for users + listed in cron.deny. To prevent this, create the file + as described and remove existing user crontabs from the directory /var/spool/cron/tabs to ensure they are not run anymore. @@ -174,7 +169,7 @@ See crontab(1) for more information
Troubleshooting When implementing /etc/cron.allow, there are - basically just two problems that can occur: + basically only two problems that can occur: @@ -195,7 +190,7 @@ See crontab(1) for more information If the user is correctly listed in /etc/cron.allow - but cannot create new cron jobs, + but cannot create new &crond; jobs, check if they are also listed in /etc/cron.deny. If the user appears in both files, /etc/cron.deny wins. Remove the user from the file to allow them to create --> - - - List - -