Hello. I am transitioning from a system that used Solaris to one that uses a Linux flavor (CentOS). For the Solaris system, I was not an administrator, but will be for the Linux system. In order to run cron jobs, our users had to "su" to a role (not account) that was set-up to run cron jobs. Individual accounts were not permitted to run cron jobs, one reason being if someone left, the system continued to run after the account was disabled.

What is the similar paradigm in Linux? Do I create a no login user/no ssh user, where users can only "su" to this account? Something else? Thanks.

It's up to you. Personally, I let my users set up cron jobs on their own accounts, I really don't see the harm in it. If you're going to go to the trouble of disabling the user's account when they leave, why not just comment out their cron entries at the same time? It takes all of five seconds. I assume you would be commenting out their entries on this dedicated cron account anyway, right? So what's the difference?

Going through the hassle of setting up a dedicated user just for running cron jobs, and the hassle of your users having to use this special account for all cron jobs (what if they need a job run in their home directory? Aren't permissions a nightmare?) just seems like a roundabout "solution" to a non-existent problem to me. *shrug*

Hello.

Thank you for the response. This answered my question, in that there doesn't appear to be a best practice.

In this particular case "best practice" is what the site decides.

In one instance where I worked, there was a designated production user. The account itself couldn't be logged in, BUT staff users that were authorized to use the account could get logged by first authenticating via Kerberos, then they could their personal credentials to remotely login to the account.

In this way, we had control over the account, and audit logs of who, when, and from where, they logged in. Without Kerberos, there is no auditing of who is getting logged in. sudo can SORT of do it, but not all information can be recorded (specifically, the "from where").

ssh logins using RSA can also sort of do it... but it then depends on the security of the users workstation to protect the private keys...