✅ Check Cron Jobs for All Users on Your VPS or Dedicated Server

By /

Cron jobs are automated tasks scheduled to run at specific times or intervals. Checking them regularly helps you monitor automated processes and detect suspicious or outdated entries.

📌 Why Check Cron Jobs?

  • Ensure critical maintenance tasks (backups, updates) are running.
  • Spot and remove malicious or unauthorized scripts.
  • Audit user activities on your server.

🛠️ How to List Cron Jobs for All Users

  1. Connect to your server via SSH.
  2. Run the following command:for u in $(cut -d: -f1 /etc/passwd); do crontab -l -u "$u" 2>/dev/null done
    • This command:
      • Loops through every user listed in /etc/passwd.
      • Lists the crontab entries for each user.
      • Suppresses error messages for users without a crontab.
  3. Review the output:
    • Each user’s cron jobs will display in sequence.
    • Look for any unexpected or suspicious commands.

✅ Example Output

# crontab for root
0 3 * * * /usr/local/backup.sh

# crontab for www-data
*/5 * * * * /usr/local/check-website.sh

🔎 Notes

  • For systems with many users, consider piping the output to a file for easier review: for u in $(cut -d: -f1 /etc/passwd); do crontab -l -u "$u" 2>/dev/null done > /root/all-cronjobs.txt
  • Security Tip: Disable or investigate cron jobs you don’t recognize.

Automating a cron jobs audit report via email is a smart way to stay on top of server activity. Here’s a script that collects all users’ cron jobs, saves them to a file, and emails the report to your address.

📜 Script: Collect and Email All Users’ Cron Jobs

  1. Create the script file, e.g. /root/check-crons.sh:
#!/bin/bash

# Set the email address to receive the report
EMAIL="[email protected]"

# Temporary file to store cron jobs
OUTPUT="/tmp/all-cronjobs-$(date +%Y%m%d-%H%M%S).txt"

# Collect all cron jobs
echo "Cron jobs report generated on: $(date)" > "$OUTPUT"
echo "==========================================" >> "$OUTPUT"

for u in $(cut -d: -f1 /etc/passwd); do
    CRONS=$(crontab -l -u "$u" 2>/dev/null)
    if [[ -n "$CRONS" ]]; then
        echo -e "\n# Cron jobs for user: $u" >> "$OUTPUT"
        echo "$CRONS" >> "$OUTPUT"
    fi
done

# Email the report
mail -s "Cron Jobs Report from $(hostname)" "$EMAIL" < "$OUTPUT"

# Clean up
rm -f "$OUTPUT"
  1. Make the script executable:
chmod +x /root/check-crons.sh
  1. Test it manually:
/root/check-crons.sh
  1. (Optional) Schedule it to run automatically once a day via root’s crontab:
crontab -e

Add:

0 4 * * * /root/check-crons.sh

This example will run the script every day at 4 AM and send the report.

🔔 Notes

✅ The script uses the mail command. If your server doesn’t have it installed, install a simple mail utility first:

  • On AlmaLinux/RHEL/CentOS: yum install mailx -y
  • On Debian/Ubuntu: apt install mailutils -y

✅ Replace [email protected] with your real email address.

✅ Consider using an SMTP relay (like SendGrid, Amazon SES, etc.) if your server cannot send mail directly or if emails land in spam.

Reliable email delivery is crucial, especially if your server’s direct emails end up in spam or fail to send. Below is a step-by-step guide on setting up your server to relay mail through an SMTP provider (e.g., Gmail, SendGrid, Amazon SES) using sSMTP or msmtp, which are lightweight and simple for sending emails via scripts like your cron jobs report.

✅ Option 1: Using msmtp (recommended — actively maintained)

1️⃣ Install msmtp

On AlmaLinux/RHEL/CentOS:

yum install msmtp msmtp-mta -y

On Debian/Ubuntu:

apt install msmtp msmtp-mta -y

2️⃣ Configure msmtp

Edit /etc/msmtprc (create it if it doesn’t exist):

nano /etc/msmtprc

Example configuration for Gmail SMTP:

defaults
auth           on
tls            on
tls_trust_file /etc/ssl/certs/ca-bundle.crt
logfile        /var/log/msmtp.log

account        default
host           smtp.gmail.com
port           587
from           [email protected]
user           [email protected]
password       your-app-password

🔹 Important: If you use Gmail, enable 2FA on your Google account and create an App Password — don’t use your main Gmail password.

3️⃣ Test sending an email

echo "Test email body" | msmtp [email protected]

4️⃣ Update your script

Replace the mail command with msmtp:

msmtp "$EMAIL" < "$OUTPUT"

✅ Option 2: Using sSMTP (if msmtp is unavailable)

🔴 Note: sSMTP is deprecated but still works in many distributions.

1️⃣ Install sSMTP

yum install ssmtp -y

2️⃣ Configure sSMTP

Edit /etc/ssmtp/ssmtp.conf:

[email protected]
mailhub=smtp.gmail.com:587
[email protected]
AuthPass=your-app-password
UseSTARTTLS=YES
FromLineOverride=YES

3️⃣ Test it:

echo "Test email" | ssmtp [email protected]

4️⃣ Update your script

Replace the mail command with ssmtp:

ssmtp "$EMAIL" < "$OUTPUT"

✅ Check the logs

  • For msmtp, view logs: tail -f /var/log/msmtp.log
  • For sSMTP, check /var/log/maillog or /var/log/syslog.

🔒 Security Tips

✅ Only store app-specific passwords in /etc/msmtprc or /etc/ssmtp/ssmtp.conf with restricted permissions:

chmod 600 /etc/msmtprc

✅ Avoid using your main email password; always use App Passwords when possible.

Scroll to Top