Who deleted crontab?

Shell Programming and Scripting
1

We are using SunOS 5.10 and Korn Shell. If we need to figure out who deleted our crontab file for a particular user what do we do.

Thanks in Advance!!

---------- Post updated at 08:08 AM ---------- Previous update was at 07:19 AM ----------

Friends,
Please help....

2

There are a number of ways of accidently deleting a crontab. Figuring out who deleted it
should not be too difficult - either it was the user or somebody with elevated privledges.
One place to start is to look at the modification time of the particular crontab spool directory
as it changes everytime the crontab is changed.

Either rewrite the crontab entry or restore the file from a backup.

3

my best guess would be, the user himself - executing crontab without the '-l'. This removes the crontab and is on my environments the most common reason for disappearing crontabs. They want to look at it and remove it in error.

Hope that helps
zxmaus

4

In debian kind of systems, we use /etc/crontab to specify cron entries along with the user name.

So the user will not have permission to remove, and the super user can maintain his cron entry as you asked for.

Sample cron entry..

* * * * * john /bin/ls /home/john >> /tmp/test-etc-cron

Note: 6 th field is user name with which it will get executed.

For more refer, Advanced Crontab section of
https://help.ubuntu.com/community/CronHowto

5

Just to make sure that even if one runs a crontab -r to remove the crontab, it remains affected... in a way to undone it.....

Please tell me if we can do something like this>>

When one issues crontab-r , it calls a script which replaces the original crontab entries back in place.... such that the crontab entries remain and the crontab -r command is ignored in this way. Also in the script it sends a mail to the admin with the userid, timestamp.

Thanks in Advance!!

6

Restore from backup is about the only solution.

IF you have a group of users who misuse the crontab command all the time, then create a crontab alias for that group in /etc/profile for example:

alias crontab='/usr/local/bin/mycrontab.sh'

Make sure the users cannot edit the mycrontab.sh file mycrontab.sh is wrapper for crontab that blocks the -r option.

This is a most strange request - is your system wide open so that anybody can delete somebody else's crontab? Allowing anyone to change any crontab is a huge security hole.