Answers.Body: <p>It's better to limit the cron user to the minimum permissions - but I'm not 100% sure what those permissions are.  E.g. if you don't give access to CiviEvent, can you use smart groups based on participant status?</p>
  
  <p>The reason why it's unsafe to give a full admin user cron access is because you're leaving an API key (essentially a password) in plaintext on a server.  Depending on how <code>wget</code> is configured (with HTTP <code>GET</code> instead of <code>POST</code>) you're also leaving the api key in the server logs.  Someone who accesses one of those can escalate their permissions.  This is especially true if you're using <code>wget</code> from a remote server.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-10-30T06:41:03.427Z
Answers.LastActivityDate: 2017-10-30T06:41:03.427Z
Answers.UserDisplayName: Jon G - Megaphone Tech
Body: <p>I recently set up cron jobs with CiviCRM using wget url method through Cpanel.  I set up an administrator account and used that accounts username and password. My concern is if there is any security risk with this method and if its best practice to limit that user's account to just the bare civicrm permissions - "view all contacts", "access CiviCRM", "access CiviMail".  </p>
  
  <p>Your feedback is appreciated.</p>
  
  <p>Using latest wordpress and civicrm releases.</p>
  
Tags: <cron-job><cron>
Title: Safe to run cron jobs using wget and user with full admin rights?
ThreadText: # Safe to run cron jobs using wget and user with full admin rights?
  
  (Asked by: username_0 on 2017-10-30)
  
  I recently set up cron jobs with CiviCRM using wget url method through Cpanel. I set up an administrator account and used that accounts username and password. My concern is if there is any security risk with this method and if its best practice to limit that user's account to just the bare civicrm permissions - "view all contacts", "access CiviCRM", "access CiviMail".
  
  Your feedback is appreciated.
  
  Using latest wordpress and civicrm releases.
  
  **Tags:** cron-job, cron
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2017-10-30. Score: 2 | Accepted answer
  
  It's better to limit the cron user to the minimum permissions - but I'm not 100% sure what those permissions are. E.g. if you don't give access to CiviEvent, can you use smart groups based on participant status?
  
  The reason why it's unsafe to give a full admin user cron access is because you're leaving an API key (essentially a password) in plaintext on a server. Depending on how `wget` is configured (with HTTP `GET` instead of `POST`) you're also leaving the api key in the server logs. Someone who accesses one of those can escalate their permissions. This is especially true if you're using `wget` from a remote server.
  
  
  ---
  
  