Search code examples
ubuntucron

Authentication issue with cron job on Ubuntu 18.04


I have a clean install of Ubuntu 18.04 and I'm having trouble getting a cron job to execute a script.

Crontab -l contains the following:

# Edit this file to introduce tasks to be run by cron.
#
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
#
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
# and day of week (dow) or use '*' in these fields (for 'any').#
# Notice that tasks will be started based on the cron's system
# daemon's notion of time and timezones.
#
# Output of the crontab jobs (including errors) is sent through
# email to the user the crontab file belongs to (unless redirected).
#
# For example, you can run a backup of all your user accounts
# at 5 a.m every week with:
# 0 5 * * 1 tar -zcf /var/backups/home.tgz /home/
#
# For more information see the manual pages of crontab(5) and cron(8)
#
# m h  dom mon dow   command

SHELL=/bin/bash
PATH=/usr/local/bin:/usr/bin:/user/local/sbin:/usr/sbin:/home/rob/scripts

*/1 * * * * /bin/bash /home/rob/scripts/scan2.sh >> /home/rob/scripts/scan.log 2>&1
0 1 * * * /bin/bash /home/rob/scripts/trimdb.sh
0 1 * * * /bin/bash /home/rob/scripts/sortf.sh

I can see that the cron job is being executed at the correct times within /var/log/syslog as below without any errors:

May 28 21:38:01 net CRON[1899]: (rob) CMD (/bin/bash /home/rob/scripts/scan2.sh >> /home/rob/scripts/scan.log 2>&1)
May 28 21:39:01 net CRON[1915]: (rob) CMD (/bin/bash /home/rob/scripts/scan2.sh >> /home/rob/scripts/scan.log 2>&1)
May 28 21:40:01 net CRON[1931]: (rob) CMD (/bin/bash /home/rob/scripts/scan2.sh >> /home/rob/scripts/scan.log 2>&1)
May 28 21:41:01 net CRON[1947]: (rob) CMD (/bin/bash /home/rob/scripts/scan2.sh >> /home/rob/scripts/scan.log 2>&1)

However when I check the cron service, I can see there is a auth error:

May 28 21:46:01 net sudo[2146]: pam_unix(sudo:auth): conversation failed
May 28 21:46:01 net sudo[2146]: pam_unix(sudo:auth): auth could not identify password for [rob]
May 28 21:46:01 net CRON[2134]: pam_unix(cron:session): session closed for user rob
May 28 21:47:01 net CRON[2152]: pam_unix(cron:session): session opened for user rob by (uid=0)
May 28 21:47:01 net CRON[2153]: (rob) CMD (/bin/bash /home/rob/scripts/scan2.sh >> /home/rob/scripts/scan.log 2>&1)
May 28 21:47:01 net sudo[2164]: pam_unix(sudo:auth): conversation failed
May 28 21:47:01 net sudo[2164]: pam_unix(sudo:auth): auth could not identify password for [rob]
May 28 21:47:01 net CRON[2152]: pam_unix(cron:session): session closed for user rob

The script runs perfectly when running it manually.

Thanks for the assistance.

Contents of scan.log:

sudo: no tty present and no askpass program specified
/home/rob/scripts/scan2.sh: line 43: grep: command not found
/home/rob/scripts/scan2.sh: line 1: date: command not found
/home/rob/scripts/scan2.sh: line 2: date: command not found
/home/rob/scripts/scan2.sh: line 3: date: command not found
/home/rob/scripts/scan2.sh: line 5: date: command not found
/home/rob/scripts/scan2.sh: line 6: date: command not found
/home/rob/scripts/scan2.sh: line 7: date: command not found
/home/rob/scripts/scan2.sh: line 41: grep: command not found

Solution

  • It looks like something in scan2.sh is trying to run sudo, and that sudo wants your password for authentication. However, sudo can not obtain your password because the cron job is not associated with a terminal and therefore pam_auth (which is the library that sudo uses to prompt for a password) reports a failure.

    To get around this you can use sudo -A with a $SUDO_ASKPASS environment variable set to the name of a program (it can be just a shell script) that will provide your password. If you do that, make certain that only your UID is able to read, write and run your password-provider program.