You can control access to the crontab command by using
two files in the /etc/cron.d directory: cron.deny and cron.allow. These files permit only specified users to perform crontab command tasks such as creating, editing, displaying, or removing
their own crontab files.
The cron.deny and cron.allow files
consist of a list of user names, one user name per line. These access control files
work together as follows:
If cron.allow exists, only the users who are listed
in this file can create, edit, display, or remove crontab files.
If cron.allow does not exist, all users can submit crontab files, except for users who are listed in cron.deny.
If neither cron.allow nor cron.deny exists, superuser privileges are required to run the crontab command.
Superuser privileges are required to edit or create the cron.deny and cron.allow files.
The cron.deny file, which is created during SunOS
software installation, contains the following user names:
$ cat /etc/cron.d/cron.deny
daemon
bin
smtp
nuucp
listen
nobody
noaccess
None of the user names in the default cron.deny file can
access the crontab command. You can edit this file to add other
user names that will be denied access to the crontab command.
No default cron.allow file is supplied. So, after
Solaris software installation, all users (except users who are listed in the default cron.deny file) can access the crontab command. If you
create a cron.allow file, only these users can access the crontab command.
How to Deny crontab Command Access
Become superuser or assume an equivalent role.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services .
Edit the /etc/cron.d/cron.deny file and add user
names, one user per line. Include users who will be denied access to the crontab commands.
daemon bin smtp nuucp listen nobody noaccessusername1username2username3. . .
Verify that the /etc/cron.d/cron.deny file contains the new entries.
# cat /etc/cron.d/cron.deny
daemon
bin
nuucp
listen
nobody
noaccess
How to Limit crontab Command Access to Specified Users
Become superuser or assume an equivalent role.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services .
Create the /etc/cron.d/cron.allow file.
Add the root user name into
the cron.allow file.
If you do not add root to the file, superuser access to crontab commands
will be denied.
Add the user names, one user name per line. Include users that will be allowed to use the crontab command.
rootusername1username2username3...
Example 15.6. Limiting crontab Command Access to Specified Users
The following example shows a cron.deny file that prevents
user names jones, temp, and visitor from accessing the crontab command.
$ cat /etc/cron.d/cron.deny
daemon
bin
smtp
nuucp
listen
nobody
noaccess
jones
temp
visitor
The following example shows a cron.allow file. The
users root, jones, lp, and smith are the only users who can access the crontab command.
$ cat /etc/cron.d/cron.allow
root
jones
lp
smith
To verify if a specific user can access the crontab command, use the crontab -l command while you are logged into the user account.
$ crontab -l
If the user can access the crontab command, and already
has created a crontab file, the file is displayed. Otherwise,
if the user can access the crontab command but no crontab file exists, a message similar to the following message is displayed:
crontab: can't open your crontab file
Either this user either is listed in the cron.allow file
(if the file exists), or the user is not listed in the cron.deny file.
If the user cannot access the crontab command, the following message is displayed whether or not a previous crontab file exists:
crontab: you are not authorized to use cron. Sorry.
This message means that either the user is not listed in the cron.allow file (if the file exists), or the user is listed in the cron.deny file.