Using multiple users in crontab script, silently fails when changing users

Question

I'm trying to run a bash script on a centos server. I've running the script as the root user (both for file permissions), but I also need to use the aws service permissions that belong to a service account. We have decided not to give the root account access to the AWS environment.

If I run the script manually ./disk-arcive.sh it works without a problem. When I run it from my crontab it silently fails when changing to the aws-cli-user. No error message, and only when started by cron.

How it is being called in Crontab sudo crontab -e:

0 20 * * * /bin/sh /etc/disk-arcive.sh

Summary of shell file:

#!/bin/sh
PATH=/sbin:/bin:/usr/sbin:/usr/bin    <<Same as root

find (old stuff) >> /old-stuff.temp 
while read line; do
    /opt/bin/encryption-tool "$line">> /encrypt_logfile.log     << key access requires root permission
done < /old-stuff.temp

while read line; do
    sudo -u aws-cli-user /usr/local/bin/aws s3 mv "$line.pgp" s3://mybucket"$line.pgp" >> /bucket_logfile.log     #<< switch to user fails, user needed for s3 permissions
    sudo -u aws-cli-user echo "User is now aws-cli-user" >> /bucket_logfile.log   #<< added for debugging, does not work
    echo "looks like $line is done" >> /bucket_logfile.log   #<< added for debugging, Works
done < /old-stuff.temp

exit

UPDATE1 I've updated the "user switching" lines to the following. It appears to fail differently however if I use any aws-s3 options (i.e. --sse or --acl) those are being read a part of the su options.

    su -l aws-cli-user -c '/usr/local/bin/aws s3 mv "$line.pgp" s3://mybucket"$line.pgp" --sse >> /bucket_logfile.log'     #<< switch to user fails, user needed for s3 permissions
    su -l aws-cli-user  -c 'echo "User is now aws-cli-user $(whoami)" >> /bucket_logfile.log'   #<< added for debugging, does not work. enters a blank line into the log file

The output of the echo line shows that the $line is now being passed when the user is switched.

score 0 · Answer 1 · answered Apr 07 '20 at 15:32

OK got this working it took a few changes

su -l username -c command This allowed for the user change in cron The next thing was working with single-quote and dubble-quotes to have the command "compiled" correctly, I only found one reference to this so I may have the terminology incorrect.

su -l aws-cli-user -c '/usr/local/bin/aws s3 mv "$line.pgp" s3://mybucket"$line.pgp" --sse >> /bucket_logfile.log'

The single quote has the user "compile" the command, and it doesn't know what the $line variable is so the command can not find a file reference.

su -l aws-cli-user -c "/usr/local/bin/aws s3 mv '$line.pgp' s3://mybucket'$line.pgp' --sse >> /bucket_logfile.log"

Now with double quotes the Root user compiles the work, including the $line variable, then passes the completed command to the other user to run. Because of this using $(whoami) would always show root even if the other user is performing the command with their permissions.

Using multiple users in crontab script, silently fails when changing users

1 Answers1