4

Ok, here's the situation (you're welcome for the earworm):

I am running a multi-server RHEL 7 environment with SELinux enabled. Due to DoD STIG controls, I do not have root access, but I do have a few local accounts that I can sudo as to do the work on the servers. These local accounts have passwords set, but the accounts have been locked. Due to a STIG control, the account passwords cannot be set to not expire even though the accounts are locked.

The issue that I run into is that the passwords in the local accounts expire every 60 days which causes all the tasks scheduled via crontab to stop running and causes the following error to display when I try to run the crontab command:

You (localaccount) are not allowed to access to (crontab) because of pam configuration.

Does anyone have any idea how I can get this fixed permanently? Currently, whenever the tasks stop working, I have to submit a ticket to have the Linux admins reset the password on each server (40+). This is less than optimal, to say the least.

Thanks in Advance!

  • What do you mean by that? The local service accounts that we have configured have to comply with the DoD STIGs, which can be contradictory at times. The service accounts have to be locked and have to have passwords that expire. – Sean Burgess Jul 10 '18 at 13:33
  • Knowing the account password isn't an issue because the accounts are locked, so you can't login as them directly. If the answer below isn't allowed under the STIGs, I think I am going to work with the security team to see if we can go the exception route and allow locked service accounts to have non-expiring passwords. – Sean Burgess Jul 10 '18 at 14:08
  • 1
    Well, since the accounts are locked, the passwords never needed to be changed until we ran into this crontab issue. – Sean Burgess Jul 10 '18 at 14:17
1

Edit /etc/pam.d/crond to change the line:

account    required    pam_access.so

to:

account    sufficient  pam_access.so

Cron jobs will now work for expired user accounts

  • Thanks for that information. I will see if there is a STIG that prevents that change from being implemented. – Sean Burgess Jul 10 '18 at 13:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.