简介
本文档介绍恢复过程 cloud-user 云本地部署平台(CNDP)策略控制功能(PCF)中的密码。
先决条件
要求
Cisco 建议您了解以下主题：
注意：思科建议您必须拥有对PCF CLI的云用户和权限根访问权限。
使用的组件
本文档中的信息基于以下软件和硬件版本：
本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您的网络处于活动状态，请确保您了解所有命令的潜在影响。
背景信息
用户 cloud-user 用于CLI访问PCF设置，以便运行和维护(OAM)工作。根据所有产品的思科安全策略，默认情况下密码的最大期限设置为90天。
问题
假设您以用户身份访问PCF设置 cloud-user 发布密码到期日期，然后PCF拒绝您访问该日期。在这种情况下，您必须首先恢复云用户用户的密码，然后要求将密码到期设置为“never”。
在PCF中恢复云用户密码的过程
以worker-15节点为例 cloud-user 密码已过期.
步骤1:登录到Cluster Manager，并从那里通过ssh访问worker-15。
它会要求更改密码，然后您必须提供新密码。新密码必须与旧密码不同。现在必须能够登录worker-15。
以后，您可以将密码改回旧密码。
§cloud-user@pcf-cm-1:~$ ssh xx.xx.xx.xx //worker-15 IP address
§Authorized uses only. All activity may be monitored and reported.
§Password:
§You are required to change your password immediately (password aged)
§Changing password for cloud-user.
§(current) UNIX password:
§New password:
§Retype new password:
§Retype new password:
§Welcome to Ubuntu 18.04.5 LTS (GNU/Linux 5.4.0-49-generic x86_64)
§
§ * Documentation: https://help.ubuntu.com
§ * Management: https://landscape.canonical.com
§ * Support: https://ubuntu.com/advantage
§
§ * Canonical Livepatch is available for installation.
§ - Reduce system reboots and improve kernel security. Activate at:
§ https://ubuntu.com/livepatch
§
§9 packages can be updated.
§0 of these updates are security updates.
§To see these additional updates run: apt list --upgradable
§
§Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
§cloud-user@pcf-worker-15:~$
第二步：备份 common-password 和 pwquality.conf 文件。
cloud-user@pcf-worker-15:~$ cd /etc/pam.d/
cloud-user@pcf-worker-15:/etc/pam.d$ ls -lrt common-password
-rw-r--r-- 1 cloud-user cloud-user 1770 Apr 19 08:01 common-password
cloud-user@pcf-worker-15:/etc/pam.d$ cp common-password common-password_bkp
cloud-user@pcf-worker-15:/etc/pam.d$ cd /etc/security/
cloud-user@pcf-worker-15:/etc/security$ ls -lrt pwquality.conf
-rw-r--r-- 1 cloud-user cloud-user 2172 Apr 19 08:00 pwquality.conf
cloud-user@pcf-worker-15:/etc/security$ cp pwquality.conf pwquality.conf_bkp
cloud-user@pcf-worker-15:~$
第三步：编辑 common-password 和 pwquality.conf 文件。
§cloud-user@pcf-worker-15:/etc/security$
§cloud-user@pcf-worker-15:/etc/security# sudo sed -i 's/14/8/' pwquality.conf
§cloud-user@pcf-worker-15:/etc/security# cat pwquality.conf | grep "minlen"
§# minlen = 8
§minlen = 8 //This line must contain minlen =8
§cloud-user@pcf-worker-15:/etc/security#
§cloud-user@pcf-worker-15:/etc/security# cd /etc/pam.d/
§cloud-user@pcf-worker-15:/etc/pam.d# sudo sed -i '26 s/password/#password/' common-password
§cloud-user@pcf-worker-15:/etc/pam.d# sudo sed -i '28 s/password/#password/' common-password
§cloud-user@pcf-worker-15:/etc/pam.d# cat common-password | grep password
§# /etc/pam.d/common-password - password-related modules common to all services
§# used to change user passwords. The default is pam_unix.
§# The "sha512" option enables salted SHA512 passwords. Without this option,
§password requisite pam_pwquality.so retry=3 minlen=8 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 enforce_for_root
§#password requisite pam_pwhistory.so remember=5 use_authtok
§password requisite pam_pwquality.so try_first_pass retry=3
§#password required pam_pwhistory.so use_authtok remember=5
§password [success=1 default=ignore] pam_unix.so obscure try_first_pass sha512
§password requisite pam_deny.so
§password required pam_permit.so
§cloud-user@pcf-worker-15:/etc/pam.d#
第四步：更改的密码策略 cloud-user 用户.验证当前密码到期日期。
cloud-user@pcf-worker-15:~$ sudo chage -l cloud-user
Last password change : May 21, 2021
Password expires : Aug 19, 2021
Password inactive : Sep 18, 2021
Account expires : never
Minimum number of days between password change : 7
Maximum number of days between password change : 90
Number of days of warning before password expires : 7
cloud-user@pcf-worker-15:~$
必须将密码到期更改为 never 通过此命令。
cloud-user@pcf-worker-15:~$
cloud-user@pcf-worker-15:~$ sudo chage -m 0 -M -1 cloud-user
验证密码到期已更改为 never.
cloud-user@pcf-worker-15:~$ sudo chage -l cloud-user
Last password change : May 21, 2021
Password expires : never
Password inactive : never
Account expires : never
Minimum number of days between password change : 0
Maximum number of days between password change : -1
Number of days of warning before password expires : 7
cloud-user@pcf-worker-15:~$
5.更改 cloud-user 旧密码的密码。
§cloud-user@pcf-worker-15:~# sudo passwd cloud-user
§New password:
§Retype new password:
§Retype new password:
§passwd: password updated successfully
§cloud-user@pcf-worker-15:~#
可以应用此过程恢复已定义的CNDP PCF中其他用户的密码。
反馈