2

I recently set up cron jobs with CiviCRM using wget url method through Cpanel. I set up an administrator account and used that accounts username and password. My concern is if there is any security risk with this method and if its best practice to limit that user's account to just the bare civicrm permissions - "view all contacts", "access CiviCRM", "access CiviMail".

Your feedback is appreciated.

Using latest wordpress and civicrm releases.

1 Answer 1

2

It's better to limit the cron user to the minimum permissions - but I'm not 100% sure what those permissions are. E.g. if you don't give access to CiviEvent, can you use smart groups based on participant status?

The reason why it's unsafe to give a full admin user cron access is because you're leaving an API key (essentially a password) in plaintext on a server. Depending on how wget is configured (with HTTP GET instead of POST) you're also leaving the api key in the server logs. Someone who accesses one of those can escalate their permissions. This is especially true if you're using wget from a remote server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.