2

I'm examining a particular setup, and they have their crontab as follows:

 0 * * * * lynx http://www.example.com/cron/scriptA.php

Of course, this relies on the 'security-by-obscurity' precept, because any person on the internet, knowing where those files are located, can call them and potentially overload the server.

Besides that, is there anything inherently wrong with the above 'model' of running that script.

When I tested lynx http://www.example.com/cron/scriptA.php from the command prompt as root, it prompted me to download a session cookie, so I'm thinking I should atleast be modifying the above to:

lynx -accept_all_cookies http://www.example.com/cron/scriptA.php

Or should I be using:

wget -q -O /dev/nul http://www.example.com/cron/scriptA.php
siliconpi
  • 1,807
  • 6
  • 32
  • 46

1 Answers1

2

If you want to secure those files, you can configure your web server to allow connections to those particular scripts only from localhost. You didn't mention what webserver you use, but for example in Apache this could be done with the combination of Directory and Allow/Deny parameters, something like

<Directory /cron>
    Order deny,allow
    Deny from all
    Allow from localhost
</Directory>

For additional security you may modify your cron scripts to check the client address. If it's other than localhost, refuse to do the cron magic and return something else.

When it comes to tools, lynx and wget are both fine. When I use lynx in cron, I tend to use it with -dump flag, though.

Janne Pikkarainen
  • 31,852
  • 4
  • 58
  • 81
  • thanks for the Apache input! That is very insightful! About the -dump option - why are you using that? how would you be notified if something went wrong? – siliconpi Oct 29 '10 at 08:19
  • 1
    I don't know why I'm using -dump (or -source) options, must be some old habit. Gotta try what happens _without_ them ... one way to get notified if something went wrong would be to configure your cron script to return some string like "SUCCESS", and then grep for it. If that string is missing, then send out an e-mail. For example, 'lynx -dump http://www.example.com/cron/scriptA.php | grep "SUCCESS" && echo "OK" || ( echo "Not OK" | mail -s 'Something went wrong' swatteam@example.com' ) – Janne Pikkarainen Oct 29 '10 at 08:29