< back to series
DAY 3

Cron, Sudo Allowlist, and Sysadmin Tooling

Mar 20, 2026

Scheduled tasks with cron

Day 3 added a scheduled 5am job for daily prospect searches and action plan updates:

bashopenclaw cron add \
  --name "morning-brief" \
  --schedule "0 5 * * *" \
  --tz "America/Chicago" \
  --message "Search for parking lot striping prospects. Review notes and prepare an action plan." \
  --deliver telegram

Jobs are stored in ~/.openclaw/cron/jobs.json and use the announce delivery mode to send outputs to Telegram.

Sudo allowlist setup

The tito user was granted NOPASSWD sudo for specific commands under /etc/sudoers.d/tito-openclaw:

sudoersCmnd_Alias TITO_PKG = /usr/bin/apt, /usr/bin/apt-get, /usr/bin/dpkg
Cmnd_Alias TITO_SYSTEMD = /usr/bin/systemctl, /usr/bin/journalctl
Cmnd_Alias TITO_NET = /usr/sbin/ss, /usr/bin/tcpdump, /usr/bin/ngrep
Cmnd_Alias TITO_MISC = /usr/bin/tee, /usr/bin/install

TITO ALL=(root) NOPASSWD: TITO_PKG, TITO_SYSTEMD, TITO_NET, TITO_MISC

Validated with visudo -cf to ensure no syntax errors.

Sysadmin tools installed

With apt access, these packages were added:

  • Network tools: tcpdump, tshark, iftop
  • Host monitoring: htop, lsof, sysstat
  • Security: ufw, fail2ban, aide

These tools provided visibility into host activity, traffic, and baseline security state.

Architecture at the end of day 3