- [Narrator] As system administrators,
we may want to limit who gets to create at or cron jobs.
If so, we have four files at our disposal,
at.allow and cron.allow for allowing access
to the at and cron services.
We have at.deny and cron.deny for denying access
to at and cron services.
The allow and deny files serve the exact same purposes
for the respective services.
When I reference the deny file,
you can substitute either at.deny or cron.deny
according to the service.
When I reference the allow file,
you can substitute either at.allow or cron.allow.
The deny file's job is to deny users by name
from using the service.
By default, the deny file exists and is empty.
The result is that nobody is denied
so everyone can create at and cron jobs.
If the deny file exists and has usernames in it
then those users are denied.
The allow file's job is to allow users by name.
The allow file overrides the deny file.
By default, the allow file does not exist
so all users are allowed,
unless they've been named in the deny file.
However, if the allow file exists and is empty,
nobody can use at or cron.
It might seem odd that an empty file can deny users,
but the allow file's job is to allow
and if the list has nobody in it then nobody is allowed.
If the allow file exists and has usernames in it
then those users are allowed to use at or cron.
Since the allow file overrides the deny file,
a user in both files will be allowed.
If neither the allow file or the deny file exist
then nobody is allowed to use the service.
It's important to note that the root user
can create at or cron jobs no matter what
because they are the super user.
We can also control access to the cron service
using pluggable authentication modules or PAM.
PAM provides a modular authentication system
for all Linux services.
The PAM module we'll be using is PAM_access.
Its configuration file is /etc/security/access.conf.
Let's load this into VI by typing in sudo space vi space
/etc/security/access.conf and hit Enter.
Type in your password and hit Enter again.
Let's go into insert mode by pressing the Insert key
and then go to the last one.
We'll create a brand new line
and in that line we'll put hyphen colon capital ALL space
capital EXCEPT space root colon cron.
This file has three columns,
access control, username, and service.
The first character is a hyphen,
meaning we're taking permissions away.
The usernames are taking permissions away from all users
except for root.
For the service, we've specified cron.
In this example, this allows all users but root
to create cron jobs.
The cron.allow and cron.deny files are easier to manage,
but the access.conf file gives us a great deal more power.
For my system,
I'm not going to use PAM to manage access control over cron
so I'm going to exit VI without saving.
To do so, press Escape colon q! and hit Enter.
To learn more about the access.conf file,
view its man page by typing in man space access.conf
and hit Enter.