Home / server / Questions / 462516
In Process
nitins
Asked: 2013-01-03 23:27:08 +0800 CST

Checking for changes to cronjobs

  • 772

Any way check and notify if some one made a change/addition to cronjobs for a particular user on a Linux server?

Is it possible to know the changes made too?

linux

4 Answers

  1. [user@user-ld ~]$ sudo tail /var/log/cron | grep RELOAD
Jan  3 00:19:01 user-ld crond[3074]: (user) RELOAD (/var/spool/cron/user)

    grep for 'RELOAD' in cron log (/var/log/cron). So if some one edit/add a cron job, you can see above kind of thing in cron log.

    Write a monitoring script for this log file and using which sent an alert to your email ID.

    If you want you can use following script for monitoring a particular users cron entries:

    #!/bin/bash
echo 'YOURPASSWORD_SUDO' | sudo -S crontab -l -u user > current_status_`date +"%m%d%y%s"`
diff <(cat `ls -1tr current_status_*| tail -1`) <(cat `ls -1tr current_status_* | tail -2 | head -1`)
if [[ $? == 0 ]] ; then 
    echo "no change in cron"
else
    echo "cron changed"
fi
    • 4

  2. If someone edits his per-user crontab file via crontab -e a log entry gets written to /var/log/syslog. Examples:

    user alex edited his own crontab file:

    Jan  3 08:42:47 localhost crontab[4278]: (alex) BEGIN EDIT (alex)
Jan  3 08:42:50 localhost crontab[4278]: (alex) END EDIT (alex)

    user root edited the crontab file of user alex:

    Jan  3 08:49:06 localhost crontab[4557]: (root) BEGIN EDIT (alex)
Jan  3 08:49:07 localhost crontab[4557]: (root) END EDIT (alex)

    If the crontab gets changed by an external editor, then the following example log entry appears in /var/log/syslog:

    Jan  3 08:46:01 localhost cron[1146]: (*system*) RELOAD (/etc/crontab)

    This logging mechanism is probably configurable but is activated by default at least on Debian and Ubuntu and I suppose most other distributions, too.

    • 2

  3. Lots of them, but (afaik) nothing intrinsic to cron. I would probably use tripwire on the server, and make sure that /var/spool/cron was tripwired.

    • 1

  4. You can use incron which is similar to cron but handles file system events (changes to files/folders) instead of handling events based on time. You can monitor the folder /var/spool/cron/crontabs for changes and invoke a script to log them and do whatever you want.

    • 0