設定密碼過期

1. 帳號密碼過期設定，password_expire_max 設定密碼有效的最大天數。

   [deyu1@kvm19 10827000]$ ansible-doc user | grep -A5 '^- password_expire_max'
   - password_expire_max
           Maximum number of days between password change.
           Supported on Linux only.
           [Default: (null)]
           type: int
           added in: version 2.11 of ansible-core
   --
   - password_expire_max
           Maximum number of days during which a password is valid.
   
           returned: When user exists
           sample: 20
   

2. users2.yml 腳本，增加設定密碼 10 天後過期。

   [deyu1@kvm19 10827000]$ vim users2.yml
   [deyu1@kvm19 10827000]$ cat users2.yml
   ---
   - hosts: dev
     tasks:
     - name: Ensure group "sharegrp" exists
       ansible.builtin.group:
         name: sharegrp
         state: present
     - name: Remove user 'james'
       ansible.builtin.user:
         name: james
         state: absent
         remove: yes
     - name: Add user 'james'
       ansible.builtin.user:
         name: james
         groups: sharegrp
         password: "{{ '123qwe' | password_hash('sha512') }}"
         password_expire_max: 10
   

3. ansible-playbook 執行 users2.yml 腳本。

   [deyu1@kvm19 10827000]$ ansible-playbook users2.yml
   
   PLAY [dev] **********************************************************************
   
   TASK [Gathering Facts] **********************************************************
   ok: [kvm11]
   
   TASK [Ensure group "sharegrp" exists] *******************************************
   ok: [kvm11]
   
   TASK [Remove user 'james'] ******************************************************
   changed: [kvm11]
   
   TASK [Add user 'james'] *********************************************************
   changed: [kvm11]
   
   PLAY RECAP **********************************************************************
   kvm11:  ok=4  changed=2  unreachable=0  failed=0  skipped=0  rescued=0  ignored=0
   

4. 查看 kvm11 帳號 james，密碼於 10 天後 2023/06/06 過期。

   [deyu1@kvm19 10827000]$ ansible dev -m shell -a "chage -l james"
   kvm11 | CHANGED | rc=0 >>
   Last password change					: May 27, 2023
   Password expires					: Jun 06, 2023
   Password inactive					: never
   Account expires						: never
   Minimum number of days between password change		: 0
   Maximum number of days between password change		: 10
   Number of days of warning before password expires	: 7