[Debian-ha-maintainers] locking the hacluster user

[Ferenc Wágner]

Hi Valentin,

I recently merged
https://salsa.debian.org/ha-team/pacemaker/-/merge_requests/6, without
noticing that it changes the hacluster user created by pacemaker-common
in a way that breaks a crmsh autopkgtest at least.  The u! sysusers
directive creates a locked (expired) account not usable by crmsh, see:
https://ci.debian.net/packages/c/crmsh/testing/amd64/77071647/#L7442

Simple reproduction:
# su -s /bin/sh -c whoami hacluster
Your account has expired; please contact your system administrator.
su: Authentication failure

While this is best practice for system accounts that do not receive
logins, it may not be a good fit for the hacluster user.  But I'd like
to avoid shipping active accounts (even without a valid password) if
possible.  So what do you think: can we require a manual
"chage -E -1 hacluster" to enable the affected functionality (I'm not
sure what beyond "crm cluster init"), or shall I revert this change in
pacemaker-common and continue creating an active system account?
-- 
Thanks,
Feri.