Home

A simple script to scan user cron jobs

Some user abusing your cron jobs and you don't know who the owner is?

I have a simple script to scan users cron jobs and email you the report.

Required: root access

Let start...

  1. Login to your server via SSH
  2. Type:
    cd /root
  3. Type:
    pico scanCron.sh

    If pico doesn't work for you, try:
    nano scanCron.sh
  4. Copy paste the following:
    #!/bin/sh
emailAddress=$1
if [ -n "$emailAddress" ] ; then
        mycrontmp=/root/scanCron.tmp.$$
        for i in `cat /etc/passwd | cut -f1 -d ':' | grep -v '#'`; do
                echo "--------------------------------------------------"
                echo "Username: ${i}"
                echo "--------------------------------------------------"
                crontab -u ${i} -l 2>&1
                echo "--------------------------------------------------"
        done > $mycrontmp
        cat $mycrontmp | mail -s "Cron jobs report for `hostname`" ${emailAddress}
        rm -f $mycrontmp
else
        echo "Please supply a valid email address."
        exit
fi
  5. Press "Ctrl" + "O" to save.
  6. Type:
    chmod +x scanCron.sh

To run it, just type:

./scanCron.sh emailAddress@domain.com

You can automate this by adding it to cron job. Below is how:

  1. Type:
    crontab -e
  2. Insert the following after the last line:
    10 1 * * * /root/scanCron.sh emailAddress@domain.com

    This will run everyday at 1:10am.

    This can be applied to cPanel server.

    Good luck Salute