[20150821]cron使用问题.txt
--昨天检查服务器发现一个shell脚本，使用cron调用，但是很奇怪，无法执行。
--我检查/var/log/cron发现：
Aug 21 11:28:01 dm01dbadm01 crond[109288]: CRON (oracle) ERROR: failed to open PAM security session: Success
Aug 21 11:28:01 dm01dbadm01 crond[109288]: CRON (oracle) ERROR: cannot set security context
Aug 21 11:29:01 dm01dbadm01 crond[110554]: Authentication token is no longer valid; new one required
Aug 21 11:29:01 dm01dbadm01 crond[110554]: CRON (oracle) ERROR: failed to open PAM security session: Success
Aug 21 11:29:01 dm01dbadm01 crond[110554]: CRON (oracle) ERROR: cannot set security context
Aug 21 11:30:01 dm01dbadm01 crond[112190]: Authentication token is no longer valid; new one required
Aug 21 11:30:01 dm01dbadm01 crond[112190]: CRON (oracle) ERROR: failed to open PAM security session: Success
Aug 21 11:30:01 dm01dbadm01 crond[112190]: CRON (oracle) ERROR: cannot set security context
--什么问题！百度看了一下：
http://blog.itpub.net/751371/viewspace-1062511/
--原来是口令到期的问题。
# egrep '^root|oracle' /etc/shadow
root:$XXXXXXXXXXX:14132:0:99999:7:::
oracle:$XXXXXXXXXXX:16353:1:90:7:::
# man shadow
DESCRIPTION
shadow manipulates the contents of the shadow password file, /etc/shadow. The structure in the #include file is:
struct spwd {
char *sp_namp; /* user login name */
char *sp_pwdp; /* encrypted password */
long int sp_lstchg; /* last password change */
long int sp_min; /* days until change allowed. */
long int sp_max; /* days before change required */
long int sp_warn; /* days warning for expiration */
long int sp_inact; /* days before account inactive */
long int sp_expire; /* date when account expires */
unsigned long int sp_flag; /* reserved for future use */
}
The meanings of each field are:
. sp_namp - pointer to null-terminated user name
. sp_pwdp - pointer to null-terminated password
. sp_lstchg - days since Jan 1, 1970 password was last changed
. sp_min - days before which password may not be changed
. sp_max - days after which password must be changed
. sp_warn - days before password is to expire that user is warned of pending password expiration
. sp_inact - days after password expires that account is considered inactive and disabled
. sp_expire - days since Jan 1, 1970 when account will be disabled
. sp_flag - reserved for future use
--估计一些版本使用了安全加固的原因。或者是前一阵子搞安全加固，加入的东西，TMD也不相互通气，更没人检查哎！
# grep "^PASS_" /etc/login.defs
PASS_MAX_DAYS 90
PASS_MIN_DAYS 1
PASS_MIN_LEN 8
PASS_WARN_AGE 7
--修改口令后。
# passwd oracle
--延长1点时间，避免再次出现问题。
# passwd -x 999 oracle
Adjusting aging data for user oracle.
passwd: Success
# egrep '^root|oracle' /etc/shadow
root:xxxxxxxxxxxl:14132:0:99999:7:::
oracle:XXXXXXXXXXX:16668:1:999:7:::
--再次检查/var/log/cron正常！
Aug 21 11:54:01 dm01dbadm01 crond[13926]: CRON (oracle) ERROR: cannot set security context
Aug 21 11:55:01 dm01dbadm01 crond[15566]: (oracle) CMD (/home/oracle/bin/xxx.sh > /dev/null 2>&1)
