How to Create CRON Jobs that Require SUDO Permissions

I'm on Ubuntu 19.04 (Disco Dingo). I've added my regular user acc. in SUDOERS and only use root when I'm bound to.

Now, I've created a basic script to automate my updates and free up some space. It looks like:

#!/bin/bash
#LOGS = /home/rubaiat/updates.log
#logs are enabled by aliasing, see alias
echo -e "\n$(date "+%d-%m-%Y --- %T") --- Starting \n"
apt-get update
apt-get -y upgrade
apt-get -y autoremove
apt-get autoclean
echo -e "\n$(date "+%T") \t Script Terminated"

I've enabled x permission for this and can run this by:

$ sudo ./sys-maintainer.sh
[sudo] password for rubaiat:

I've refrained from adding sudo inside the script, as I'd be required to store the password in plaintext.

I've created an alias as:

alias sys-maintainer='sudo ./sys-maintainer.sh >> updates.log 2>&1 && tail -7 updates.log'

Now I can just type

$ sys-maintainer
[sudo] password for rubaiat: 

..and run my script alongside storing the terminal outputs into a simple text file. My idea was to grep this file for the desired info whenever I require it.

Now, here goes the problem-

As I don't want to invoke this script manually, I wanted to put it into CRONTAB. But the problem is, I can't designate jobs that require SUDO into my regular user's CRONTAB, as the process will pause asking for the password.

I know I can do this from my root account's CRONTAB. But I don't want to go that way unless its the only one.

So, how can I add my script inside the CRONTAB of my regular user? Bear in mind that it requires SUDO for executing the atomic commands.

I understand that I might be missing some standard/key techniques. It'd help if anyone can shed some light onto these matters as well.

NB: Thanks if you read this. I know its kinda long. Also, it's my first post here; so hopefully I didn't do anything inappropriate.

1 Answer

I've created a basic script to automate my updates and free up some space.

You've reinvented the unattended-upgrades service.

But the problem is, I can't designate jobs that require SUDO into my regular user's CRONTAB.

Well, you can – just add sudo to the command.

However, since cron cannot prompt you for the password, you need to designate those commands to be passwordless through /etc/sudoers. This line would allow cron to sudo your script:

rubaiat ALL=(root) NOPASSWD: /home/rubaiat/bin/sys-maintainer.sh

(Note: in sudoers, the last match wins. So make sure to add such exceptions at the end of /etc/sudoers, or in any case below the generic "ALL=(ALL) ALL" lines.)