How to allow cron to run for one particular user even if password is expired

How to allow cron to run for one particular user even if password is expired? 这个文档中说
Configure the account stack of /etc/pam.d/password-auth and /etc/pam.d/system-auth as :
account     required      pam_access.so
account   [default=1 success=ignore] pam_succeed_if.so user in testuser
account   [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so

这就是说添加
account     required      pam_access.so
account   [default=1 success=ignore] pam_succeed_if.so user in testuser
account   [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid

问题1：
实际情况是
我的用户名是：tibero
用户所在的组是：dba
这种情况下上面三句指令改怎么修改

问题2：
修改/etc/pam.d/crond行不行
sed -i.bak '/No PAM/aaccount    sufficient  pam_succeed_if.so   user ingroup dba' /etc/pam.d/crond
这么修改行不行

这个方法亲测有效