How to protect files (cron files) frome being executed by everyone?

Question

I wonder what read / write permissions should I set on my cron files (php files) so they can be executed only by our server.

We're using CentOS 5.9 - 64bit and cPanel / WHM + Apache.

Thanks!

Answer 1

Are these cron files going to be executed by root or are they going to be executed by a specific user such as apache? Normally I either log into a specific user (bob) and then run "crontab -e" to edit Bob's crontab. For these cron jobs to run, you just need to ensure that bob has execute writes to the script in question. However if these are going to be more administrative scripts for apache or root, then you may want to just put them in "/etc/crontab". From here, you can set how often the script runs and what user should run the script. Then just be sure whatever user you set to run the script has the appropriate rights to execute it. So if only root needs to run it, just chown the file to root only and you can 744 it so only root can execute the file.

Answer 2

Typically your apache webserver will run as www-data or apache or similar (look at top to see which user is running it). So if the files need to be executable by the webserver make them

sudo chown www-data:www-data somefile.php sudo chmod 770 somefile.php

This will make somefile.php belong to the www-data user and group with read/write/execute permissions only for the www-data user or members of the www-data group.

Then make the crontab as crontab -e -u www-data. I would hesitate making them owned by root (as then the php file will run as root when executed).