設定密碼過期

1. 帳號密碼過期設定，password_expire_max 設定密碼有效的最大天數。

   ceuser@deyu:~/ansible_pb$ ansible-doc user | grep -A5 '^- password_expire_max'
   - password_expire_max
           Maximum number of days between password change.
           Supported on Linux only.
           [Default: (null)]
           type: int
           added in: version 2.11 of ansible-core
   

2. users2.yml 腳本，增加設定密碼 10 天後過期。

   ceuser@deyu:~/ansible_pb$ vi users2.yml
   ceuser@deyu:~/ansible_pb$ cat users2.yml
   ---
   - hosts: dev
     tasks:
     - name: Ensure group "sharegrp" exists
       ansible.builtin.group:
         name: sharegrp
         state: present
     - name: Remove user 'james'
       ansible.builtin.user:
         name: james
         state: absent
         remove: yes
     - name: Add user 'james'
       ansible.builtin.user:
         name: james
         groups: sharegrp
         password: "{{ '123qwe' | password_hash('sha512') }}"
         password_expire_max: 10
   

3. ansible-playbook 執行 users2.yml 腳本。

   ceuser@deyu:~/ansible_pb$ ansible-playbook user2.yml
   
   PLAY [dev] *********************************************************************
   
   TASK [Gathering Facts] *********************************************************
   ok: [kvm11]
   
   TASK [Ensure group "sharegrp" exists] ******************************************
   ok: [kvm11]
   
   TASK [Remove user 'james'] *****************************************************
   changed: [kvm11]
   
   TASK [Add user 'james'] ********************************************************
   [DEPRECATION WARNING]: Encryption using the Python crypt module is deprecated.
   The Python crypt module is deprecated and will be removed from Python 3.13.
   Install the passlib library for continued encryption functionality. This
   feature will be removed in version 2.17. Deprecation warnings can be disabled
   by setting deprecation_warnings=False in ansible.cfg.
   changed: [kvm11]
   
   PLAY RECAP *********************************************************************
   kvm11 : ok=4 changed=2  unreachable=0  failed=0  skipped=0  rescued=0  ignored=0
   

4. 查看 kvm11 帳號 james，密碼於 10 天後 2023/06/06 過期。

   ceuser@deyu:~/ansible_pb$ ansible dev -m shell -a "chage -l james"
   kvm11 | CHANGED | rc=0 >>
   Last password change					: May 06, 2026
   Password expires					: May 16, 2026
   Password inactive					: never
   Account expires						: never
   Minimum number of days between password change		: 0
   Maximum number of days between password change		: 10
   Number of days of warning before password expires	: 7