DragonFlyBSD

# $FreeBSD: src/usr.sbin/cron/cron/Makefile,v 1.16 2007/06/17 17:25:53 yar Exp $

CFLAGS+=-DLOGIN_CAP -DPAM

DPADD=	${LIBCRON} ${LIBPAM} ${LIBUTIL}

LDADD=	${LIBCRON} -lpam -lutil

.\" $FreeBSD: src/usr.sbin/cron/cron/cron.8,v 1.25 2007/06/17 17:25:53 yar Exp $

.Dd June 17, 2007

.Pp

command to see if it should be run in the current minute.  

Before running a command from a per-account crontab file,

.Nm

checks the status of the account with

.Xr pam 3

and skips the command if the account is unavailable,

e.g., locked out or expired.

Commands from

.Pa /etc/crontab

bypass this check.

When executing

.Sh FILES

.Bl -tag -width /etc/pam.d/cron -compact

.It Pa /etc/crontab

System crontab file

.It Pa /etc/pam.d/cron

.Xr pam.conf 5

configuration file for

.Nm

.It Pa /var/cron/tabs

Directory for personal crontab files

.El

.Xr pam 3 ,

.Xr crontab 5 ,

.Xr pam.conf 5

 * $FreeBSD: src/usr.sbin/cron/cron/cron.h,v 1.17 2007/06/17 17:25:53 yar Exp $

#define	SYS_NAME	"*system*" /* magic owner name for system crontab */

		process_crontab("root", SYS_NAME,

	if (strcmp(fname, SYS_NAME) && !(pw = getpwnam(uname))) {

 * $FreeBSD: src/usr.sbin/cron/cron/do_command.c,v 1.27 2007/06/17 17:25:53 yar Exp $

#ifdef PAM

# include <security/pam_appl.h>

# include <security/openpam.h>

#endif

#ifdef PAM

	/* use PAM to see if the user's account is available,

	 * i.e., not locked or expired or whatever.  skip this

	 * for system tasks from /etc/crontab -- they can run

	 * as any user.

	 */

	if (strcmp(u->name, SYS_NAME)) {	/* not equal */

		pam_handle_t *pamh = NULL;

		int pam_err;

		struct pam_conv pamc = {

			.conv = openpam_nullconv,

			.appdata_ptr = NULL

		};

		Debug(DPROC, ("[%d] checking account with PAM\n", getpid()))

		/* u->name keeps crontab owner name while LOGNAME is the name

		 * of user to run command on behalf of.  they should be the

		 * same for a task from a per-user crontab.

		 */

		if (strcmp(u->name, usernm)) {

			log_it(usernm, getpid(), "username ambiguity", u->name);

			exit(ERROR_EXIT);

		}

		pam_err = pam_start("cron", usernm, &pamc, &pamh);

		if (pam_err != PAM_SUCCESS) {

			log_it("CRON", getpid(), "error", "can't start PAM");

			exit(ERROR_EXIT);

		}

		pam_err = pam_acct_mgmt(pamh, PAM_SILENT);

		/* Expired password shouldn't prevent the job from running. */

		if (pam_err != PAM_SUCCESS && pam_err != PAM_NEW_AUTHTOK_REQD) {

			log_it(usernm, getpid(), "USER", "account unavailable");

			exit(ERROR_EXIT);

		}

		pam_end(pamh, pam_err);

	}

#endif