cron background task - Access wrong credentials

[Edward Killian]

I have a problem that is driving me up a wall. I moved our iTop to a new server running a newer OS. I can't seem to get the cron background task running. The /var/log/itop-cron.log just says Access wrong credentials ('itop_user') even though I can copy the same credentials to the command line and use them with "mysql -u itop_user -p" and they work. I have changed the password, deleted and recreated the account and still get the same error. And the error is only with the cron job. The iTop user web interface works fine. Any help is appreciated.

Command in cron file:
*/2 * * * * apache /usr/bin/php /var/www/html/itop/web/webservices/cron.php --param_file=/etc/itop/params >>/var/log/itop-cron.log 2>&1

Contents of /etc/itop/params:

# This is a parameter file
#
# If a parameter is given both in the file and in the arguments,
# then the value given as argument is retained
#
 
# Authentication
auth_user = itop_user
auth_pwd = PASSWORD
 
# My web service
size_min = 20 # Megabytes
time_limit = 40 # Minutes

From web interface About iTop:
iTop version 3.1.1-1-12561 built on 2023-12-19 10:53:23
MySQL: 10.6.17-MariaDB
PHP: 8.1.27

The first section of phpinfo:
PHP Version 8.1.27
System Linux rumraisin 4.18.0-513.18.1.el8_9.x86_64 #1 SMP Wed Feb 21 21:34:36 UTC 2024 x86_64
Build Date Dec 19 2023 20:35:55
Build System Red Hat Enterprise Linux release 8.9 (Ootpa)
Build Provider Remi's RPM repository https://rpms.remirepo.net/ #StandWithUkraine
Compiler gcc (GCC) 8.5.0 20210514 (Red Hat 8.5.0-20)
Architecture x86_64
Server API FPM/FastCGI
Virtual Directory Support disabled
Configuration File (php.ini) Path /etc
Loaded Configuration File /etc/php.ini
Scan this dir for additional .ini files /etc/php.d
Additional .ini files parsed /etc/php.d/10-opcache.ini, /etc/php.d/20-bz2.ini, /etc/php.d/20-calendar.ini, /etc/php.d/20-ctype.ini, /etc/php.d/20-curl.ini, /etc/php.d/20-dom.ini, /etc/php.d/20-exif.ini, /etc/php.d/20-fileinfo.ini, /etc/php.d/20-ftp.ini, /etc/php.d/20-gd.ini, /etc/php.d/20-gettext.ini, /etc/php.d/20-iconv.ini, /etc/php.d/20-imap.ini, /etc/php.d/20-ldap.ini, /etc/php.d/20-mbstring.ini, /etc/php.d/20-mysqlnd.ini, /etc/php.d/20-pdo.ini, /etc/php.d/20-phar.ini, /etc/php.d/20-simplexml.ini, /etc/php.d/20-soap.ini, /etc/php.d/20-sockets.ini, /etc/php.d/20-sodium.ini, /etc/php.d/20-sqlite3.ini, /etc/php.d/20-tokenizer.ini, /etc/php.d/20-xml.ini, /etc/php.d/20-xmlwriter.ini, /etc/php.d/20-xsl.ini, /etc/php.d/30-mcrypt.ini, /etc/php.d/30-mysqli.ini, /etc/php.d/30-pdo_mysql.ini, /etc/php.d/30-pdo_sqlite.ini, /etc/php.d/30-xmlreader.ini, /etc/php.d/30-zip.ini
PHP API 20210902
PHP Extension 20210902
Zend Extension 420210902
Zend Extension Build API420210902,NTS
PHP Extension Build API20210902,NTS
Debug Build no
Thread Safety disabled
Zend Signal Handling enabled
Zend Memory Manager enabled
Zend Multibyte Support provided by mbstring
Zend Max Execution Timers disabled
IPv6 Support enabled
DTrace Support available, disabled
Registered PHP Streams https, ftps, compress.zlib, php, file, glob, data, http, ftp, compress.bzip2, phar, zip
Registered Stream Socket Transports tcp, udp, unix, udg, ssl, tls, tlsv1.0, tlsv1.1, tlsv1.2, tlsv1.3
Registered Stream Filters zlib., string.rot13, string.toupper, string.tolower, convert., consumed, dechunk, bzip2., convert.iconv., mcrypt., mdecrypt.

[Raf Czlonka]

On Tue, Apr 02, 2024 at 08:13:45PM BST, Edward Killian wrote:
>
>
> I have a problem that is driving me up a wall. I moved our iTop to a new
> server running a newer OS. I can't seem to get the cron background task
> running. The /var/log/itop-cron.log just says Access wrong credentials
> ('itop_user') even though I can copy the same credentials to the command
> line and use them with "mysql -u itop_user -p" and they work. I have
> changed the password, deleted and recreated the account and still get the
> same error. And the error is only with the cron job. The iTop user web
> interface works fine. Any help is appreciated.
>
> Command in cron file:
> */2 * * * * apache /usr/bin/php /var/www/html/itop/web/webservices/cron.php
> --param_file=/etc/itop/params >>/var/log/itop-cron.log 2>&1

Hi Edward,

It doesn't seem like this is Salt-related at all.

You are running cron.php as 'apache' user but the official documentation[0]
reads

Allowed users

Only administrators are allowed to execute cron.php.

So it is either that, or /etc/itop/params isn't readable to the 'apache'
user.

[0] https://www.itophub.io/wiki/page?id=latest:admin:cron#allowed_users

Regards,

Raf

[Edward Killian]

Does that mean OS level administrators or database administrators? It's interesting since just above that on the same page it gives an example of the cron entry as:

Scheduling on Linux

Edit the crontab to execute the script every 1 minutes:

*/1 * * * * www-data /usr/bin/php /var/www/html/itop/webservices/cron.php --param_file=/etc/itop-cron.params >>/var/log/itop-cron.log 2>&1

Note: Replace /var/www/html/itop with your path to the iTop directory

And there is also a note:

Do not run cron.php using root user! You must launch the command with the same user that is used by the web server running iTop.

[Edward Killian]

OK, I figured it out and I'm ignorant. The user for the cron job has to be an iTop user, not a mysql user.