[Debian-ha-maintainers] locking the hacluster user

[Valentin Vidic]

On Sat, Oct 24, 2026 at 07:38:09PM +0200, Ferenc Wágner wrote:
> While this is best practice for system accounts that do not receive
> logins, it may not be a good fit for the hacluster user.  But I'd like
> to avoid shipping active accounts (even without a valid password) if
> possible.  So what do you think: can we require a manual
> "chage -E -1 hacluster" to enable the affected functionality (I'm not
> sure what beyond "crm cluster init"), or shall I revert this change in
> pacemaker-common and continue creating an active system account?

Yes, I think locked user is ok. We can update the test in crmsh and
README if needed to work with this.

-- 
Valentin