Skip to content

Commit cf5f9d3

Browse files
cwickertcwickert
committed
New tasks about restricting the cron and at daemons
1 parent 3a9c2ac commit cf5f9d3

File tree

4 files changed

+512
-0
lines changed

4 files changed

+512
-0
lines changed

‎DC-task-restrict-at

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# This file originates from the project https://github.com/openSUSE/doc-kit
2+
# This file can be edited downstream.
3+
4+
MAIN="task-restrict-at.xml"
5+
ROOTID="task-restrict-at"
6+
7+
PROFCONDITION="suse-product"
8+
#PROFCONDITION="suse-product;beta"
9+
#PROFCONDITION="community-project"
10+
11+
STYLEROOT="/usr/share/xml/docbook/stylesheet/suse2021-ns"
12+
FALLBACK_STYLEROOT="/usr/share/xml/docbook/stylesheet/suse-ns"

‎DC-task-restrict-cron

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# This file originates from the project https://github.com/openSUSE/doc-kit
2+
# This file can be edited downstream.
3+
4+
MAIN="task-restrict-cron.xml"
5+
ROOTID="task-restrict-cron"
6+
7+
PROFCONDITION="suse-product"
8+
#PROFCONDITION="suse-product;beta"
9+
#PROFCONDITION="community-project"
10+
11+
STYLEROOT="/usr/share/xml/docbook/stylesheet/suse2021-ns"
12+
FALLBACK_STYLEROOT="/usr/share/xml/docbook/stylesheet/suse-ns"

‎xml/task-restrict-at.xml

Lines changed: 229 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,229 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!-- This file originates from the project https://github.com/openSUSE/doc-kit -->
3+
<!-- This file can be edited downstream. -->
4+
5+
<?xml-stylesheet href="urn:x-suse:xslt:profiling:docbook51-profile.xsl"
6+
type="text/xml"
7+
title="Profiling step"?>
8+
<!DOCTYPE article
9+
[
10+
<!ENTITY % entities SYSTEM "generic-entities.ent">
11+
%entities;
12+
]>
13+
14+
<!--metadata
15+
* product(s): SLES, SLED, SLE-HA, SLES-SAP, SLE-HPC, SLE-RT
16+
* product version(s): 15 SP3, 15 SP2, 15 GA
17+
* topic category/ies: system administration, security
18+
* target group(s): system administrators
19+
* initially published: ?
20+
* last modified: 2021-11-26 -->
21+
22+
<article xml:id="task-restrict-at" xml:lang="en"
23+
role="task"
24+
xmlns="http://docbook.org/ns/docbook" version="5.1"
25+
xmlns:its="http://www.w3.org/2005/11/its"
26+
xmlns:xi="http://www.w3.org/2001/XInclude"
27+
xmlns:xlink="http://www.w3.org/1999/xlink">
28+
29+
<info>
30+
<title>Restricting the <systemitem class="daemon">at</systemitem> scheduler</title>
31+
<dm:docmanager xmlns:dm="urn:x-suse:ns:docmanager">
32+
<dm:bugtracker>
33+
<dm:url>https://bugzilla.suse.com/enter_bug.cgi</dm:url>
34+
<dm:component>Smart Docs</dm:component>
35+
<dm:product>Documentation</dm:product>
36+
<dm:assignee>[email protected]</dm:assignee>
37+
</dm:bugtracker>
38+
<dm:translation>no</dm:translation>
39+
</dm:docmanager>
40+
</info>
41+
42+
<section xml:id="environment-restrict-at">
43+
<title>Environment</title>
44+
<para>This document applies to the following products and product versions:</para>
45+
<itemizedlist>
46+
<listitem>
47+
<para>&sles;&nbsp;15&nbsp;SP3, 15&nbsp;SP2, 15&nbsp;SP1, 15&nbsp;GA, 12&nbsp;SP5, 12&nbsp;SP4, 12&nbsp;SP3</para>
48+
</listitem>
49+
<listitem>
50+
<para>&sles4sap;&nbsp;15&nbsp;SP3, 15&nbsp;SP2, 15&nbsp;SP1, 15&nbsp;GA, 12&nbsp;SP5, 12&nbsp;SP4, 12&nbsp;SP3</para>
51+
</listitem>
52+
<listitem>
53+
<para>&sleha;&nbsp;15&nbsp;SP3, 15&nbsp;SP2, 15&nbsp;SP1, 15&nbsp;GA, 12&nbsp;SP5, 12&nbsp;SP4, 12&nbsp;SP3</para>
54+
</listitem>
55+
<listitem>
56+
<para>&slehpc;&nbsp;15&nbsp;SP3, 15&nbsp;SP2, 15&nbsp;SP1, 15&nbsp;GA</para>
57+
</listitem>
58+
<listitem>
59+
<para>&sled;&nbsp;15&nbsp;SP3, 15&nbsp;SP2, 15&nbsp;SP1, 15&nbsp;GA, 12&nbsp;SP5, 12&nbsp;SP4, 12&nbsp;SP3</para>
60+
</listitem>
61+
<listitem>
62+
<para>&slert;&nbsp;15&nbsp;SP3, 15&nbsp;SP2, 15&nbsp;SP1, 15&nbsp;GA, 12&nbsp;SP5, 12&nbsp;SP4, 12&nbsp;SP3</para>
63+
</listitem>
64+
</itemizedlist>
65+
</section>
66+
67+
<section xml:id="introduction-restrict-at">
68+
<title>Introduction</title>
69+
<para>
70+
The <systemitem class="daemon">at</systemitem> job execution system allows
71+
users to schedule one-time running jobs. The <filename>at.allow</filename>
72+
file specifies a list of users that are allowed to schedule jobs via
73+
<systemitem class="daemon">at</systemitem>. The file does not exist by
74+
default, so all users can schedule <systemitem class="daemon">at</systemitem>
75+
jobs&mdash;except for those listed in <filename>at.deny</filename>)
76+
</para>
77+
</section>
78+
79+
<section xml:id="requirements-restrict-at">
80+
<title>Requirements</title>
81+
<itemizedlist>
82+
<listitem>
83+
<para>
84+
You have installed your product and your system is up and running.
85+
</para>
86+
</listitem>
87+
<listitem>
88+
<para>
89+
The <package>at</package> package is installed. If not, run
90+
<command>zypper in at</command> to install it.
91+
</para>
92+
</listitem>
93+
</itemizedlist>
94+
<!-- cwickert 2021-10-05: No idea why the template contains another <para> here.
95+
<para>
96+
A paragraph of text.
97+
</para>
98+
-->
99+
</section>
100+
101+
<section xml:id="restrict-at">
102+
<title>Restrict access to the <systemitem class="daemon">at</systemitem> scheduler</title>
103+
<!-- cwickert 2021-10-05: No idea why the template has two introductions, one
104+
before and one at the beginning of the procedure.
105+
<para>
106+
To prevent users except for root from scheduling jobs with <systemitem
107+
class="daemon">at</systemitem>, perform the following steps.
108+
</para>
109+
-->
110+
<procedure>
111+
<para>
112+
To prevent users except for &rootuser; from scheduling jobs with <systemitem
113+
class="daemon">at</systemitem>, perform the following steps.
114+
</para>
115+
<step>
116+
<para>
117+
Create an empty file <filename>/etc/at.allow</filename>:
118+
</para>
119+
<screen>&prompt.sudo;<command>touch</command> /etc/at.allow</screen>
120+
</step>
121+
<step>
122+
<para>
123+
Allow users to schedule jobs with <systemitem
124+
class="daemon">at</systemitem> by adding their usernames to the file:
125+
</para>
126+
<screen>&prompt.sudo;<command>echo</command> "&exampleuser_plain;" >> /etc/at.allow</screen>
127+
</step>
128+
<step>
129+
<para>
130+
To verify, try scheduling a job as non-root user listed in
131+
<filename>at.allow</filename>:
132+
</para>
133+
<screen>&prompt.user;<command>at 00:00</command>
134+
at></screen>
135+
<para>
136+
Quit the <systemitem class="daemon">at</systemitem>prompt with
137+
<keycombo><keycap function="control"/><keycap>C</keycap></keycombo> and
138+
try the same with a user <emphasis>not</emphasis> listed in
139+
<filename>/etc/at.allow</filename> (or before adding them the file in step
140+
2 of this procedure):
141+
</para>
142+
<screen>&prompt.user2;<command>at 00:00</command>
143+
You do not have permission to use at.</screen>
144+
</step>
145+
</procedure>
146+
</section>
147+
148+
<section xml:id="summary-restrict-at">
149+
<title>Summary</title>
150+
<para>
151+
You have now restricted scheduling jobs with <systemitem
152+
class="daemon">at</systemitem> for non-root users.
153+
</para>
154+
</section>
155+
156+
<section xml:id="troubleshooting-restrict-at">
157+
<title>Troubleshooting</title>
158+
<para>When implementing <filename>/etc/at.allow</filename>, there are
159+
basically just two problems that can occur:
160+
</para>
161+
<variablelist>
162+
<varlistentry>
163+
<term>A user <emphasis>can</emphasis> schedule a job with <systemitem
164+
class="daemon">at</systemitem> although they should
165+
<emphasis>not</emphasis>.</term>
166+
<listitem>
167+
<para>
168+
Check that the username in <filename>/etc/at.allow</filename> matches
169+
the actual username.
170+
</para>
171+
</listitem>
172+
</varlistentry>
173+
<varlistentry>
174+
<term>A user can <emphasis>not</emphasis> schedule a job with <systemitem
175+
class="daemon">at</systemitem> jobs although they
176+
<emphasis>should</emphasis>.</term>
177+
<listitem>
178+
<para>
179+
If the user is correctly listed in <filename>/etc/at.allow</filename>
180+
but cannot schedule <systemitem class="daemon">at</systemitem> jobs,
181+
check if they are also listed in <filename>/etc/at.deny</filename>. If
182+
the user appears in both files, <filename>/etc/at.deny</filename> wins.
183+
Remove the user from the file to allow them to schedule <systemitem
184+
class="daemon">at</systemitem> jobs.
185+
</para>
186+
</listitem>
187+
</varlistentry>
188+
</variablelist>
189+
</section>
190+
191+
<section xml:id="next-restrict-at">
192+
<title>Next steps</title>
193+
<itemizedlist>
194+
<listitem>
195+
<para>
196+
<systemitem class="daemon">at</systemitem> is not widely used anymore.
197+
If you do not have valid use cases, consider uninstalling the daemon instead
198+
of just restricting its access.
199+
</para>
200+
</listitem>
201+
<listitem>
202+
<para>
203+
To further improve security, also consider restricting access to the
204+
<systemitem class="daemon">cron</systemitem> daemon.
205+
</para>
206+
</listitem>
207+
</itemizedlist>
208+
</section>
209+
210+
<section xml:id="related-restrict-at">
211+
<title>Related topics</title>
212+
<itemizedlist>
213+
<listitem>
214+
<para>
215+
Restricting the <systemitem class="daemon">at</systemitem> scheduler
216+
<!-- cwickert 2021-10-05: Once we can link smartdocs, use this link instead
217+
<xref linkend="task-restrict-at"/> -->
218+
</para>
219+
</listitem>
220+
<listitem>
221+
<para>
222+
<link xlink:href="https://documentation.suse.com/smart/linux/html/task-create-systemd-timers/">Create &systemd; timers</link>
223+
<!-- cwickert 2021-10-05: Once we can link smartdocs, use this link instead
224+
<xref linkend="task-create-systemd-timers"/> -->
225+
</para>
226+
</listitem>
227+
</itemizedlist>
228+
</section>
229+
</article>

0 commit comments

Comments
 (0)