[20201120]pam_systemd(crondsession) Failed to create session Access denied.txt

--//例行检查，发现一台linux 服务器报错。

# journalctl --unit=crond --since "2020-11-20 10:15:00"
-- Logs begin at Mon 2020-03-02 18:43:25 CST, end at Fri 2020-11-20 10:40:01 CST. --
Nov 20 10:20:01 localhost.localdomain crond[10658]: pam_systemd(crond:session): Failed to create session: Access denied
Nov 20 10:20:01 localhost.localdomain CROND[10660]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Nov 20 10:30:01 localhost.localdomain crond[11195]: pam_systemd(crond:session): Failed to create session: Access denied
Nov 20 10:30:01 localhost.localdomain CROND[11198]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Nov 20 10:40:01 localhost.localdomain crond[11790]: pam_systemd(crond:session): Failed to create session: Access denied
Nov 20 10:40:01 localhost.localdomain CROND[11793]: (root) CMD (/usr/lib64/sa/sa1 1 1)

--//从现象看应该是执行/usr/lib64/sa/sa1 1 1时报错，间隔10分钟。我手工以root用户执行没有问题。

# cat /etc/cron.d/sysstat
# Run system activity accounting tool every 10 minutes
*/10 * * * * root /usr/lib64/sa/sa1 1 1
# 0 * * * * root /usr/lib64/sa/sa1 600 6 &
# Generate a daily summary of process accounting at 23:53
53 23 * * * root /usr/lib64/sa/sa2 -A

# journalctl --unit=crond
...
Nov 19 23:53:01 localhost.localdomain crond[9410]: pam_systemd(crond:session): Failed to create session: Access denied
Nov 19 23:53:01 localhost.localdomain CROND[9413]: (root) CMD (/usr/lib64/sa/sa2 -A)
--//执行/usr/lib64/sa/sa2 -A也是一样报错。

# systemctl cat crond.service
# /usr/lib/systemd/system/crond.service
[Unit]
Description=Command Scheduler
After=syslog.target auditd.service systemd-user-sessions.service time-sync.target

[Service]
EnvironmentFile=/etc/sysconfig/crond
ExecStart=/usr/sbin/crond -n $CRONDARGS
KillMode=process

[Install]
WantedBy=multi-user.target

--//可以发现执行时使用-n 参数。

man crond
   -n  Tells the daemon to run in the foreground.  This can be useful when starting it out of init. With this
       option is needed to change pam setting.  /etc/pam.d/crond must not enable pam_loginuid.so module.

# cat /etc/pam.d/crond
#
# The PAM configuration file for the cron daemon
#
#
# No PAM authentication called, auth modules not needed
account    required   pam_access.so
account    include    password-auth
session    required   pam_loginuid.so
session    include    password-auth
auth       include    password-auth

--//按照介绍必须注解session    required   pam_loginuid.so，但是我尝试注解它没用。
--//先尝试debug crond看看。

# cat /etc/sysconfig/crond
# Settings for the CRON daemon.
# CRONDARGS= :  any extra command-line startup arguments for crond
CRONDARGS= -x ext,sch,proc,pars,load,misc,test,bit
--//加入-x参数。

--//继续上个星期的探究：
# journalctl --unit=crond --since "2020-11-23 08:45:00" | grep -C3  pam_system
Nov 23 08:50:01 localhost.localdomain crond[15590]: user [root:0:0:...] cmd="/bin/date +"\%Y/\%m/\%d \%T"  >> /dev/kmsg"
Nov 23 08:50:01 localhost.localdomain crond[15590]: user [root:0:0:...] cmd="/usr/lib64/sa/sa2 -A"
Nov 23 08:50:01 localhost.localdomain crond[15590]: user [root:0:0:...] cmd="/usr/lib64/sa/sa1 1 1"
Nov 23 08:50:01 localhost.localdomain crond[9407]: pam_systemd(crond:session): Failed to create session: Access denied
Nov 23 08:50:01 localhost.localdomain crond[9406]: pam_systemd(crond:session): Failed to create session: Access denied
Nov 23 08:50:01 localhost.localdomain crond[15590]: [15590] do_command(/bin/date +"\%Y/\%m/\%d \%T"  >> /dev/kmlog_it: (root 9410) CMD (/usr/lib64/sa/sa1 1 1)
Nov 23 08:50:01 localhost.localdomain crond[15590]: log_it: (root 9411) CMD (/bin/date +"%Y/%m/%d %T"  >> /dev/kmsg)
Nov 23 09:00:01 localhost.localdomain crond[10021]: pam_systemd(crond:session): Failed to create session: Access denied
Nov 23 09:00:01 localhost.localdomain CROND[10023]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Nov 23 09:00:01 localhost.localdomain crond[15590]: log_it: (root 10023) CMD (/usr/lib64/sa/sa1 1 1)
Nov 23 09:00:01 localhost.localdomain crond[15590]: sg, (*system*,0,0))
--
Nov 23 09:01:01 localhost.localdomain crond[15590]: [15590] sigchld...pid #10021 died, stat=0
Nov 23 09:01:01 localhost.localdomain crond[15590]: [15590] sigchld...no children
Nov 23 09:01:01 localhost.localdomain crond[15590]: user [root:0:0:...] cmd="run-parts /etc/cron.hourly"
Nov 23 09:01:01 localhost.localdomain crond[10104]: pam_systemd(crond:session): Failed to create session: Access denied
Nov 23 09:01:01 localhost.localdomain CROND[10106]: (root) CMD (run-parts /etc/cron.hourly)
Nov 23 09:01:01 localhost.localdomain crond[15590]: user [root:0:0:...] cmd="/home/oracle/log_it: (root 10106) CMD (run-parts /etc/cron.hourly)
Nov 23 09:10:01 localhost.localdomain crond[10598]: pam_systemd(crond:session): Failed to create session: Access denied
Nov 23 09:10:01 localhost.localdomain CROND[10600]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Nov 23 09:10:01 localhost.localdomain crond[15590]: log_it: (root 10600) CMD (/usr/lib64/sa/sa1 1 1)
Nov 23 09:12:01 localhost.localdomain crond[15590]: orcl_rman.scripts/orclbak.sh > /dev/null 2>&1"

--//换一个思路,看看错误信息来自那个文件。

# strings -f /usr/lib64/security/* | grep -i "Failed to create session"
/usr/lib64/security/pam_systemd.so: Failed to create session: %s

--//错误提示来源/usr/lib64/security/pam_systemd.so。 */

# grep pam_systemd.so /etc/pam.d/*
/etc/pam.d/fingerprint-auth:-session     optional      pam_systemd.so
/etc/pam.d/fingerprint-auth-ac:-session     optional      pam_systemd.so
/etc/pam.d/password-auth:-session     optional      pam_systemd.so
/etc/pam.d/password-auth-ac:-session     optional      pam_systemd.so
/etc/pam.d/runuser-l:-session   optional        pam_systemd.so
/etc/pam.d/smartcard-auth:-session     optional      pam_systemd.so
/etc/pam.d/smartcard-auth-ac:-session     optional      pam_systemd.so
/etc/pam.d/system-auth:-session     optional      pam_systemd.so
/etc/pam.d/system-auth-ac:-session     optional      pam_systemd.so
--//有点不理解前面有一个减号，是注解吗？感觉不像。而且里面有一行说明，改动该文件要
--//# User changes will be destroyed the next time authconfig is run.

--//对比前面应该是下划线内容 */
# cat /etc/pam.d/crond
#
# The PAM configuration file for the cron daemon
#
#
# No PAM authentication called, auth modules not needed
account    required   pam_access.so
account    include    password-auth
session    required   pam_loginuid.so
session    include    password-auth
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
auth       include    password-auth

--//注解session    include    password-auth，继续测试： */
--//修改/etc/sysconfig/crond文件，取消crond的调试。
--//修改/etc/cron.d/sysstat为每分钟执行1次，主要节省调式时间。记住测试完成后要修改回来。
*/1 * * * * root /usr/lib64/sa/sa1 1 1

# systemctl stop crond.service
# systemctl start crond.service

--//等几分钟检查发现：

# systemctl status crond.service
* crond.service - Command Scheduler
   Loaded: loaded (/usr/lib/systemd/system/crond.service; enabled; vendor preset: enabled)
   Active: active (running) since Mon 2020-11-23 09:33:18 CST; 3min 1s ago
 Main PID: 12110 (crond)
   CGroup: /system.slice/crond.service
           `-12110 /usr/sbin/crond -n

Nov 23 09:33:18 localhost.localdomain systemd[1]: Started Command Scheduler.
Nov 23 09:33:18 localhost.localdomain crond[12110]: (CRON) INFO (RANDOM_DELAY will be scaled with factor 99% if used.)
Nov 23 09:33:19 localhost.localdomain crond[12110]: (CRON) INFO (running with inotify support)
Nov 23 09:33:19 localhost.localdomain crond[12110]: (CRON) INFO (@reboot jobs will be run at computer's startup.)
Nov 23 09:34:01 localhost.localdomain CROND[12152]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Nov 23 09:35:01 localhost.localdomain CROND[12222]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Nov 23 09:36:01 localhost.localdomain CROND[12284]: (root) CMD (/usr/lib64/sa/sa1 1 1)

# journalctl --unit=crond --since "2020-11-23 09:33:20"
-- Logs begin at Mon 2020-03-02 18:43:25 CST, end at Mon 2020-11-23 09:39:01 CST. --
Nov 23 09:34:01 localhost.localdomain CROND[12152]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Nov 23 09:35:01 localhost.localdomain CROND[12222]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Nov 23 09:36:01 localhost.localdomain CROND[12284]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Nov 23 09:37:01 localhost.localdomain CROND[12346]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Nov 23 09:38:01 localhost.localdomain CROND[12435]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Nov 23 09:39:01 localhost.localdomain CROND[12511]: (root) CMD (/usr/lib64/sa/sa1 1 1)

--//OK现在没有错误信息了。尝试修改在前面加入减号看看。
# cat /etc/pam.d/crond
#
# The PAM configuration file for the cron daemon
#
#
# No PAM authentication called, auth modules not needed
account    required   pam_access.so
account    include    password-auth
session    required   pam_loginuid.so
-session    include    password-auth
auth       include    password-auth

# systemctl status crond.service
* crond.service - Command Scheduler
   Loaded: loaded (/usr/lib/systemd/system/crond.service; enabled; vendor preset: enabled)
   Active: active (running) since Mon 2020-11-23 09:33:18 CST; 35min ago
 Main PID: 12110 (crond)
   CGroup: /system.slice/crond.service
           |-12110 /usr/sbin/crond -n
           `-14221 /usr/sbin/anacron -s

Nov 23 10:01:01 localhost.localdomain anacron[14221]: Will run job `cron.daily' in 11 min.
Nov 23 10:01:01 localhost.localdomain anacron[14221]: Will run job `cron.monthly' in 51 min.
Nov 23 10:01:01 localhost.localdomain anacron[14221]: Jobs will be executed sequentially
Nov 23 10:02:01 localhost.localdomain CROND[14294]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Nov 23 10:03:01 localhost.localdomain CROND[14353]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Nov 23 10:04:01 localhost.localdomain CROND[14415]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Nov 23 10:05:02 localhost.localdomain CROND[14478]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Nov 23 10:06:01 localhost.localdomain CROND[14542]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Nov 23 10:07:01 localhost.localdomain CROND[14604]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Nov 23 10:08:01 localhost.localdomain CROND[14662]: (root) CMD (/usr/lib64/sa/sa1 1 1)

--//看来减号也是注解。是否两者存在冲突？？？不好解析。
# grep "^-" /etc/pam.d/password-auth
-session     optional      pam_systemd.so

--//是否要执行authconfig重新配置呢？我直接修改还是生效的啊，不熟悉放弃。

--//工作非常不熟悉systemctl journalctl命令使用，感觉systemd很麻烦。
--//最终我放弃里面的全部改动修改回来。对pam之类的东西也不熟悉，还是不乱动了，反正真实的情况也是正确执行的。仅仅做一个记录。

-