Linux / UNIX Restrict at / cron Usage To Authorized Users

To restrict the usage of the at and cron commands to authorized users on Linux/UNIX systems, you can use the following steps:

1. Create a group for authorized users:

   sudo groupadd atcronusers

2. Add the authorized users to the group:

   sudo usermod -a -G atcronusers user1
   sudo usermod -a -G atcronusers user2
   ...

3. Modify the permissions of the at and cron commands:

   sudo chown root:atcronusers /usr/bin/atrnsudo chmod 750 /usr/bin/atrnrnsudo chown root:atcronusers /usr/bin/crontabrnsudo chmod 750 /usr/bin/crontab

   These commands set the group ownership of the at and cron commands to atcronusers and set the permissions so that only the root user and members of the atcronusers group can execute them.

4. Edit the /etc/at.allow and /etc/cron.allow files to include the names of the authorized users or group:

   # /etc/at.allow
   atcronusersrn
   # /etc/cron.allow
   atcronusers

   These files allow only the users or group listed in them to use the at and cron commands.

5. Optionally, you can also edit the /etc/at.deny and /etc/cron.deny files to deny access to specific users or groups:

   # /etc/at.deny
   user3
   
   # /etc/cron.deny
   user3

   These files deny access to the users or group listed in them.

rnNote that if the at.deny or cron.deny files exist, only users not listed in these files are allowed to use at or cron. If neither allow nor deny files exist, access to at and cron is granted to all users.

After completing these steps, only the authorized users or group will be able to use the at and cron commands on the system.