On AIX 7.2 sudo may not be setup to utilize the "other" sections in the PAM stack. This will cause problems when using sudo to deploy the centrify packages through the Deployment Manager
Problem: Even before the Centrify agent is installed, when attempting to use sudo on an AIX 7.2 system the following error is seen: "sudo: account expired or PAM config lacks an 'account' section for sudo, contact your system administrator"
Resolution: As sudo is now looking for its own PAM stack the following lines must be entered in to the /etc/pam.conf file:
**NOTE** If this error is seen after upgrading the OS on a system is already running the Centrify Agent it is recommended that you perform an "adleave" then add the entries and verify Sudo is working without error. Onvce verified run an "adjoin" again to allow Centrify to update the new entries in the PAM stack to point to the Centrify PAM modules as this is done at join time.
If the system cannot have the "adleave" and "adjoin" process done on it the following should be added to the /etc/pam.conf file BEFORE the lines above: sudo auth sufficient pam_centrifydc sudo auth requisite pam_centrifydc deny sudo account sufficient pam_centrifydc sudo account requisite pam_centrifydc deny sudo password sufficient pam_centrifydc try_first_pass sudo password requisite pam_centrifydc deny sudo session required pam_centrifydc homedir sudo-i auth sufficient pam_centrifydc sudo-i auth requisite pam_centrifydc deny sudo-i account sufficient pam_centrifydc sudo-i account requisite pam_centrifydc deny sudo-i password sufficient pam_centrifydc try_first_pass sudo-i password requisite pam_centrifydc deny sudo-i session required pam_centrifydc homedir