How to enable cron for a locked account in Linux?

In my environment, there are times when locked application/databases accounts need to run some cron jobs. In linux, by default, a locked account can not run the cron job until a specific setting is disabled in /etc/pam.d/crond file. Here is the detail:

 # cat /etc/pam.d/crond 
#
# The PAM configuration file for the cron daemon
#
#
auth       sufficient pam_rootok.so
auth       required   pam_stack.so service=system-auth
auth       required   pam_env.so
account    required   pam_stack.so service=system-auth
# account    required   pam_access.so
session    required   pam_limits.so
session    required   pam_loginuid.so

This example is good for at least Redhat Linux 4U7. In the /etc/pam.d/crond file, I had to disable "account required pam_access.so" line and boom! The cron started working for the locked account as well.

Cron jobs not running & showing "bad user" in logs /var/cron/log

My user informed that the application user (locked) account's cron jobs were not running even after initial setup/ allowing in cron.allow file by system administrator. When I checked the log file (/var/cron/log) in Solaris 10, I could see some entries like:

>  CMD: /bin/touch /tmp/kjsdfhsdjk
>  appuser 4193 c Wed May 13 03:27:00 2009
! bad user (appuser) Wed May 13 03:27:00 2009
<  appuser 4193 c Wed May 13 03:27:00 2009 rc=1
>  CMD: /bin/touch /tmp/kjsdfhsdjk
>  appuser 4252 c Wed May 13 03:28:00 2009
! bad user (appuser) Wed May 13 03:28:00 2009
<  appuser 4252 c Wed May 13 03:28:00 2009 rc=1

Solution was to change "*LK*" to "*LOCKED*" in /etc/shadow file.

# diff shadow shadow-ori
136c136
< appuser:*LOCKED*:14293::::::
---
> appuser:*LK*:14293::::::

This change happened in Solaris 10 only because prior to Solaris 10, the locked accounts used to have "*LK*" in /etc/shadow entries.


If in NIS, then make the maps again by running /var/yp/make. The following is applicable ONLY & ONLY in case of NIS. (Think twice before doing this!!)

# cd /var/yp; ./make
updated netid
pushed netid
updated passwd.adjunct
`group.adjunct.time' is up to date.
pushed passwd.adjunct
`group.adjunct.time' is up to date.
#