Resolve

This topic explains how to resolve the "Authentication token manipulation error" that occurs when you change the password on a Linux ECS instance.

Problem description

When you run the passwd command to change a password on a Linux ECS instance, the command fails with the "Authentication token manipulation error" message.

[ecs-user@i              ~]$ passwd
Changing password for user ecs-user.
Current password:
New password:
Retype new password:
passwd: Authentication token manipulation error

Cause

This issue may occur for the following reasons:

The i security attribute is set on user password files. This attribute makes the files immutable and blocks all write, delete, rename, and link operations.
The user password files have been tampered with or corrupted.
Note
The user password files include the following:
- /etc/passwd
- /etc/shadow
- /etc/group
- /etc/gshadow

Solution

Connect to the Linux ECS instance.

For more information, see Connect to a Linux instance by using Workbench.

Run the following command to check the attributes of the password-related files.

sudo lsattr /etc/*shadow /etc/passwd /etc/group

The output is similar to the following:

----i---------e------ /etc/gshadow
----i---------e------ /etc/shadow
--------------e------ /etc/passwd
----i---------e------ /etc/group

If a file has the i attribute (for example, ----i---------e------ /etc/shadow), run the following command to remove the i attribute.
```
sudo chattr -i /etc/*shadow /etc/passwd /etc/group
```
Try changing the password again.
```
passwd
```
If the error persists, run the following command to back up the /etc/shadow file.
```
sudo cp /etc/shadow /etc/shadow.bak
```
Run the following command to recreate the /etc/shadow file.
```
sudo pwconv
```
Try changing the password again.
```
passwd
```