centos 7 crond 密码过期

Question

我是 CentOS 的新手，每当我尝试重新启动 puppet 服务 - pe-puppetdb、pe-puppetserver 等时，我都会收到以下错误：

Jun 23 04:03:01 abc.xyz.com crond[12117]: pam_unix(crond:account): expired     password for user root (root enforced)
Jun 23 04:03:01 abc.xyz.com crond[12117]: (root) PAM ERROR (Authentication token is no longer valid; new one required)
Jun 23 04:03:01 abc.xyz.com crond[12117]: (root) FAILED to authorize user with PAM (Authentication token is no longer valid; new one required)

以下是 /etc/pam.d/crond 中的条目：

account    required   pam_access.so
account    include    password-auth
session    required   pam_loginuid.so
session    include    password-auth
auth       include    password-auth

我认为这里需要做两件事：

1. 重置 crond 用户的密码（使用 passwd 命令）
2. 确保密码永不过期

我在这里找到了一个解决方案https://www.centos.org/forums/viewtopic.php?t=17634，但由于该帖子已有 6 年历史，所以我想知道是否有其他方法可以解决该问题。

请指教。

编辑 - 我什至尝试更改 crond 用户的密码，但收到以下错误：

[root@abc ~]# chage -l crond
chage: user 'crond' does not exist in /etc/passwd
[root@abc ~]# chage -M 99999 -m 99999 crond
chage: user 'crond' does not exist in /etc/passwd

Edit2 - 在 /etc/pam.d/crond 中添加以下行并启动 puppetdb 服务：

account    sufficient pam_succeed_if.so uid = 0

还是服务没有启动，出现如下错误（journalctl -xe）：

-- Unit session-11.scope has begun starting up.
Jun 23 10:28:01 abc.xyz.com CROND[30598]: (root) CMD (/var/awslogs/bin/awslogs-nanny.sh > /dev/null 2>&1)
Jun 23 10:28:02 abc.xyz.com systemd[1]: Removed slice user-0.slice.
-- Subject: Unit user-0.slice has finished shutting down
-- Defined-By: systemd
--
-- Unit user-0.slice has finished shutting down.
Jun 23 10:28:02 abc.xyz.com systemd[1]: Stopping user-0.slice.
-- Subject: Unit user-0.slice has begun shutting down
-- Defined-By: systemd
--
-- Unit user-0.slice has begun shutting down.
Jun 23 10:28:05 abc.xyz.com amazon-ssm-agent[845]: 2017-06-23 10:28:05 ERROR      [instanceID=i-0a9865085e27f6862] [MessageProcessor] [Association] error when calling AWS APIs. error details - AccessDeniedException: User: arn:aws:sts::045981373300:assumed-role/ServerLabServer/i-0a9865085e27f6862 is not authorized to perform: ssm:ListInstanceAssociations on resource:     arn:aws:ec2:ap-southeast-1:045981373300:instance/i-0a9865085e27f6862

Answer 1

问题在初始错误中得到了很好的描述。 crond 使用的用户 root 的密码已过期。

使用sudo chage -l root 检查密码状态。如果密码已过期，请使用sudo passwd 进行更改。您还可以使用sudo chage root 更改过期设置。