LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 06-24-2005, 02:28 PM   #1
Temujin_12
Member
 
Registered: Sep 2003
Location: Washington
Distribution: Kubuntu Dapper
Posts: 99

Rep: Reputation: 15
How to safely automate use of root PW


I have a cron job that needs to use the root password. I can enter the root password into the actual crontab entry but my concern is:

1- does cron use a file to store jobs?
2- if it does, is the crontab file encrypted or not?

If cron uses a file and it is encrypted then I feel comfortable having the root password stored in root's cron file (since you have to be root to access the cron file anyways).

However, if the crontab file is not encrypted then I don't feel comfortable storing the password in the crontab. If this is the situation, what are secure alternatives to utilizing the root password in automated jobs?
 
Old 06-24-2005, 03:05 PM   #2
Matir
LQ Guru
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Debian, Arch
Posts: 8,507

Rep: Reputation: 128Reputation: 128
The crontab file is NOT encrypted.
 
Old 06-24-2005, 03:32 PM   #3
peter72
Member
 
Registered: Oct 2002
Location: Charlottesville, VA
Distribution: Ubuntu (home), SLES (work)
Posts: 196
Blog Entries: 1

Rep: Reputation: 30
In most cases, each user on the system has access to their own crontab. If you su to root and do a crontab -e, this will be roots crontab file. Another solution is just placing the sh script ( or whatever language ) in the /etc/cron.hourly directory. You should not script any passwords in any script, nor should you have to. Each crontab is run as that user. I usually use the cron directories on linux, but on other unix boxes, they don't usually have them. If you want to see the setup of the crontab file do a: man -S 5 crontab
 
Old 06-24-2005, 05:38 PM   #4
Temujin_12
Member
 
Registered: Sep 2003
Location: Washington
Distribution: Kubuntu Dapper
Posts: 99

Original Poster
Rep: Reputation: 15
Another situation that I have is I want to do a master mysqldump of all of my tables. I already have a working script that will do it. However, that script requires the password to be typed into the actual command that is run. I know that the Linux root password is not the same as the MySQL password but the problem is the same. I don't want to have the password to a MySQL user, that has access to every table, written in a plain text file.

Is there a way to do this securely?
 
Old 06-25-2005, 08:50 AM   #5
Hangdog42
LQ Veteran
 
Registered: Feb 2003
Location: Maryland
Distribution: Slackware
Posts: 7,803
Blog Entries: 1

Rep: Reputation: 422Reputation: 422Reputation: 422Reputation: 422Reputation: 422
How about creating a mysql user that only has sufficient permissions to run mysqldump? That way if the password escaped into the wild, no real damage could occur.
 
Old 06-28-2005, 06:58 PM   #6
tkedwards
Senior Member
 
Registered: Aug 2004
Location: Munich, Germany
Distribution: Opensuse 11.2
Posts: 1,549

Rep: Reputation: 52
This kind of thing should be avoided if possible. However if you really must have this user have passwordless root priveleges and you have to set it up in sudo:
#visudo
Code:
# Allow user to run certain programs as root
username ALL=(ALL) NOPASSWD: /usr/bin/program,/usr/sbin/program
or (avoid this if possible as it basically gives that user full root priveleges)

Code:
# Allow user to run certain programs as root
username ALL=(ALL) NOPASSWD: ALL
 
Old 06-29-2005, 07:12 AM   #7
Hangdog42
LQ Veteran
 
Registered: Feb 2003
Location: Maryland
Distribution: Slackware
Posts: 7,803
Blog Entries: 1

Rep: Reputation: 422Reputation: 422Reputation: 422Reputation: 422Reputation: 422
Actually sudo may not be applicable to this particular problem. The users we are talking about are mysql users, which are not the same thing as system users and sudo doesn't work with mysql users.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How to safely re-partition squinn Linux - Newbie 3 08-23-2005 02:38 PM
How to remove old kernels safely satimis Fedora 11 08-21-2004 08:06 AM
how to safely upgrade perl? hlozo Linux - Software 0 03-03-2004 04:17 PM
How can I safely repartition.... BajaNick Linux - Software 5 12-30-2003 05:01 PM
Safely Erasing a HDD with dd R4z0r Linux - General 1 06-29-2003 06:27 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 08:10 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration