Personal crontabs are created using the command crontab. Personal crontabs are kept in a system-specific directory and are named for the owner:

/usr/spool/cron/crontabs  on some System5 - type systems (like our own hills)

/var/spool/cron  on linux systems

The crontab command has options to edit, list, and remove a user's crontab:

crontab [ -u user ]  [ { -l | -r | -e } ]

Without one of the -l, -r, or -e options, crontab submits the crontab read on standard input as the user's crontab. Note: don't confuse the -r option with read. I have.

The historical location of the master system crontab for root is /etc/crontab. On some systems today, this has been removed and the personal crontab for root substituted. On RHEL6 (and perhaps other later versions of linux), cron understands the format of the anacron jobs in /etc/anacrontab and runs those jobs at appropriate times.

Controlling access to crontab

Access to cron is actually controlled by controlling access to the crontab command. If access to the crontab command is denied, the user is not able to create a new crontab. They are also not able to remove or edit an existing crontab, so the administrator must take care to delete any existing crontabs if she wants to deny access to cron to a user who has previously been allowed access. In other words, denying access to crontab does not affect the existence or function of existing crontab files. 

Access to crontab is controlled through the use of two files: cron.allow and cron.deny. Usually these files are kept in /etc, but some systems may place them in the restricted area that contains the crontabs themselves. Each file consists of a list of usernames, one per line.

• if cron.allow exists, then only the users listed in it are allowed to use crontab.
• if cron.allow does not exist, but cron.deny does, then all users are allowed to use crontab except those listed in cron.deny.
• if neither cron.allow nor cron.deny exist, only root can use crontab (i.e., it is the same as an empty cron.allow).

Remember, the names cron.{allow,deny} are misleading. They have nothing to do with whether the user can use cron. They only affect the modification of a personal crontab by that user.

Copyright 2011 Greg Boyd - All Rights Reserved.