Re: Discuss: Daily/weekly cron jobs best practices

[Tim Brown <tmb () 65535 com>]

On Wednesday 06 January 2016 23:06:20 halfdog wrote:

> Are there more variants, arguments? In my opinion, b) is a good
> trade-off between maintainability and security.

Create scripts with secure permissions, write only to properly secured 
locations and execute as dedicated users with minimal privileges. Yes, there 
will still be problems but a lot of the most significant pain points go away.

> Currently the cron scripts seem to be a weak point. I looked at the 8
> daily scripts on my machine, 2 of them belonged to the "daemon"
> example class from above and both were vulnerable to daemon to root
> privilege escalation, see e.g. [1].

Not uncommon, we pop almost every UNIX box we touch this way, I assume you've 
seen unix-privesc-check?

Tim
-- 
Tim Brown
<mailto:tmb () 65535 com>

Attachment: signature.asc
Description: This is a digitally signed message part.