Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >

KB-3241: Unable to change the root password/ 'Authentication token manipulation error' message

Authentication Service ,  

20 July,15 at 08:55 AM

Applies to:

All versions of Centrify DirectControl on Linux platforms



When trying to change the root password, the following error is observed:

'passwd: Authentication token manipulation error' 


For a regular user, the passwd command output works fine. 

For a root user: 

Changing password for user rm1 

passwd: Authentication token manipulation error 

From the /var/log/secure the error is: 

passwd: pam_unix(passwd:chauthtok): unrecognized option [minlen=14] 

Notice the similar ps_chauthtok mention in the debug log. 



This is an SELinux issue.


Run the following as root:

setenforce permissive

This modifies the mode SELinux is running in. 

Then try to change the password as root again and it will be successful. 


More info on the different modes of SELinux:

enforcing  — The SELinux security policy is enforced.

permissive — The SELinux system prints warnings but does not enforce policy.

This is useful for debugging and troubleshooting purposes. In permissive mode, more denials are logged because subjects can continue with actions that would otherwise be denied in enforcing mode. For example, traversing a directory tree in permissive mode produces avc: denied messages for every directory level read. In enforcing mode, SELinux would have stopped the initial traversal and kept further denial messages from occurring.

disabled   — SELinux is fully disabled. SELinux hooks are disengaged from the kernel and the pseudo-file system is unregistered.