Applies to:

All versions of Centrify DirectControl on Linux platforms

Problem:

When trying to change the root password, the following error is observed:

'passwd: Authentication token manipulation error' 

Example:

For a regular user, the passwd command output works fine. 

For a root user: 

Changing password for user rm1 

passwd: Authentication token manipulation error 

From the /var/log/secure the error is: 

passwd: pam_unix(passwd:chauthtok): unrecognized option [minlen=14] 

Notice the similar ps_chauthtok mention in the debug log. 

Cause:

This is an SELinux issue.
 

Resolution:

Run the following as root:

setenforce permissive

This modifies the mode SELinux is running in. 

Then try to change the password as root again and it will be successful. 

More info on the different modes of SELinux:

enforcing  — The SELinux security policy is enforced.

permissive — The SELinux system prints warnings but does not enforce policy.

This is useful for debugging and troubleshooting purposes. In permissive mode, more denials are logged because subjects can continue with actions that would otherwise be denied in enforcing mode. For example, traversing a directory tree in permissive mode produces avc: denied messages for every directory level read. In enforcing mode, SELinux would have stopped the initial traversal and kept further denial messages from occurring.

disabled   — SELinux is fully disabled. SELinux hooks are disengaged from the kernel and the pseudo-file system is unregistered.