Lock down the cron script
A root cron job runs /opt/backup/backup.sh every minute, and that script is world-writable — any user could make root run their commands.
Inspect the job and the script, then remove write access for everyone but root.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
`ls -l /opt/backup/backup.sh` shows it is writable by everyone (777).
`sudo chmod 755 /opt/backup/backup.sh` leaves only root able to write it.
Solution explanation
The cron job ran a root-owned script that anyone could rewrite — so anyone could run code as root. sudo chmod 755 /opt/backup/backup.sh removed write access for group and other, leaving only root able to change it. Whenever a privileged job runs a file, check that neither the file nor its directory is writable by non-root users.
Show solution
cd /home/student
cat /etc/cron.d/backup
ls -l /opt/backup/backup.sh
sudo chmod 755 /opt/backup/backup.sh
ls -l /opt/backup/backup.sh