{"record":{"id":"7d9bc797738d4f92","repo":"puppetlabs/puppet","slug":"chpasswd-said-output","errorCode":null,"errorMessage":"chpasswd said #{output}","messagePattern":"chpasswd said #(.+?)","errorType":"exception","errorClass":"Puppet::ExecutionFailure","httpStatus":null,"severity":"error","filePath":"lib/puppet/provider/user/aix.rb","lineNumber":234,"sourceCode":"      tempfile << \"#{user}:#{value}\\n\"\n      tempfile.close()\n\n      # Options '-e', '-c', use encrypted password and clear flags\n      # Must receive \"user:enc_password\" as input\n      # command, arguments = {:failonfail => true, :combine => true}\n      # Fix for bugs #11200 and #10915\n      cmd = [self.class.command(:chpasswd), *ia_module_args, '-e', '-c']\n      execute_options = {\n        :failonfail => false,\n        :combine => true,\n        :stdinfile => tempfile.path\n      }\n      output = execute(cmd, execute_options)\n\n      # chpasswd can return 1, even on success (at least on AIX 6.1); empty output\n      # indicates success\n      if output != \"\"\n        raise Puppet::ExecutionFailure, \"chpasswd said #{output}\"\n      end\n    rescue Puppet::ExecutionFailure => detail\n      raise Puppet::Error, \"Could not set password on #{@resource.class.name}[#{@resource.name}]: #{detail}\", detail.backtrace\n    ensure\n      if tempfile\n        # Extra close will noop. This is in case the write to our tempfile\n        # fails.\n        tempfile.close()\n        tempfile.delete()\n      end\n    end\n  end\n\n  def create\n    super\n\n    # We specify the 'groups' AIX attribute in AixObject's create method\n    # when creating our user. However, this does not always guarantee that","sourceCodeStart":216,"sourceCodeEnd":252,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/provider/user/aix.rb#L216-L252","documentation":"Raised by Puppet's AIX user provider when setting a password via `chpasswd -e -c` and the command produces non-empty output. Because AIX's chpasswd can exit 1 even on success (noted for AIX 6.1), the provider treats output text as the failure signal and raises Puppet::ExecutionFailure with whatever chpasswd printed.","triggerScenarios":"Setting `password` (a crypted hash) on an AIX user where chpasswd complains: hash does not satisfy the system password policy (pwdchecker/pwpolicy), the hash format is not one of AIX's allowed crypt formats, or chpasswd reports stanza/user errors. Note it is rescued immediately and re-raised as 'Could not set password on ...'.","commonSituations":"Linux-style SHA-512 hashes ($6$...) not enabled in /etc/security/policy.cfg (SSHA= set to blowfish/etc.); password policies rejecting the value; loading users from a shared profile built on different AIX policy settings.","solutions":["Read the chpasswd output embedded in the message — it states the exact policy or format complaint.","Match the hash algorithm to AIX policy: check `/etc/security/policy.cfg` (SSHA= / others) and use a supported crypt format (e.g., AIX crypt/blowfish `{ssha512}` style or SMKMD5 as configured).","Loosen/reconfigure the password policy (pwdadmin/pwpolicy) if it wrongly rejects admin-set crypted hashes.","Verify manually: `echo 'user:hash' | chpasswd -e -c` on the node to reproduce chpasswd's message outside Puppet."],"exampleFix":"# before - hash format not permitted by AIX policy\nuser { 'deploy': ensure => present, password => '$6$salt$sha512linuxhash...' }\n# after - hash matching /etc/security/policy.cfg (SSHA512 enabled)\nuser { 'deploy': ensure => present, password => '{ssha512}AAAA...' }","handlingStrategy":"try-catch","validationCode":"# reproduce what the provider does, before the run\necho 'deploy:<crypt-hash>' | chpasswd -e -c\n# non-empty output => policy/format problem to fix first","typeGuard":"def aix_hash_format_ok?(policy_cfg = '/etc/security/policy.cfg', hash)\n  allowed = File.foreach(policy_cfg).grep(/^(SSHA|others)=/).map { |l| l.split('=')[1] }.compact\n  hash.start_with?('{') || allowed.any? { |a| hash.include?(a) }\nend","tryCatchPattern":"begin\n  provider.password = crypted\nrescue Puppet::Error => e\n  detail = e.message[/chpasswd said (.*)/, 1]\n  raise Puppet::Error, \"password policy rejected hash: #{detail}\" if detail\n  raise\nend","preventionTips":["Align hash algorithm with /etc/security/policy.cfg before deploying password data.","Test hashes with `chpasswd -e -c` on a scratch AIX host.","Keep per-OS password data in Hiera; do not share Linux crypt strings with AIX."],"tags":["aix","user-management","password","chpasswd","puppet"],"backgroundTag":"chpasswd-failed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}