puppetlabs/puppet · error · Puppet::ExecutionFailure

chpasswd said #{output}

Error message

chpasswd said #{output}

What it means

Raised by Puppet's AIX user provider when setting a password via `chpasswd -e -c` and the command produces non-empty output. Because AIX's chpasswd can exit 1 even on success (noted for AIX 6.1), the provider treats output text as the failure signal and raises Puppet::ExecutionFailure with whatever chpasswd printed.

Source

Thrown at lib/puppet/provider/user/aix.rb:234

      tempfile << "#{user}:#{value}\n"
      tempfile.close()

      # Options '-e', '-c', use encrypted password and clear flags
      # Must receive "user:enc_password" as input
      # command, arguments = {:failonfail => true, :combine => true}
      # Fix for bugs #11200 and #10915
      cmd = [self.class.command(:chpasswd), *ia_module_args, '-e', '-c']
      execute_options = {
        :failonfail => false,
        :combine => true,
        :stdinfile => tempfile.path
      }
      output = execute(cmd, execute_options)

      # chpasswd can return 1, even on success (at least on AIX 6.1); empty output
      # indicates success
      if output != ""
        raise Puppet::ExecutionFailure, "chpasswd said #{output}"
      end
    rescue Puppet::ExecutionFailure => detail
      raise Puppet::Error, "Could not set password on #{@resource.class.name}[#{@resource.name}]: #{detail}", detail.backtrace
    ensure
      if tempfile
        # Extra close will noop. This is in case the write to our tempfile
        # fails.
        tempfile.close()
        tempfile.delete()
      end
    end
  end

  def create
    super

    # We specify the 'groups' AIX attribute in AixObject's create method
    # when creating our user. However, this does not always guarantee that

View on GitHub (pinned to e227c27540)

Solutions

1. Read the chpasswd output embedded in the message — it states the exact policy or format complaint.
2. Match the hash algorithm to AIX policy: check `/etc/security/policy.cfg` (SSHA= / others) and use a supported crypt format (e.g., AIX crypt/blowfish `{ssha512}` style or SMKMD5 as configured).
3. Loosen/reconfigure the password policy (pwdadmin/pwpolicy) if it wrongly rejects admin-set crypted hashes.
4. Verify manually: `echo 'user:hash' | chpasswd -e -c` on the node to reproduce chpasswd's message outside Puppet.

Example fix

# before - hash format not permitted by AIX policy
user { 'deploy': ensure => present, password => '$6$salt$sha512linuxhash...' }
# after - hash matching /etc/security/policy.cfg (SSHA512 enabled)
user { 'deploy': ensure => present, password => '{ssha512}AAAA...' }

# reproduce what the provider does, before the run
echo 'deploy:<crypt-hash>' | chpasswd -e -c
# non-empty output => policy/format problem to fix first

def aix_hash_format_ok?(policy_cfg = '/etc/security/policy.cfg', hash)
  allowed = File.foreach(policy_cfg).grep(/^(SSHA|others)=/).map { |l| l.split('=')[1] }.compact
  hash.start_with?('{') || allowed.any? { |a| hash.include?(a) }
end

begin
  provider.password = crypted
rescue Puppet::Error => e
  detail = e.message[/chpasswd said (.*)/, 1]
  raise Puppet::Error, "password policy rejected hash: #{detail}" if detail
  raise
end

When it happens

Trigger: Setting `password` (a crypted hash) on an AIX user where chpasswd complains: hash does not satisfy the system password policy (pwdchecker/pwpolicy), the hash format is not one of AIX's allowed crypt formats, or chpasswd reports stanza/user errors. Note it is rescued immediately and re-raised as 'Could not set password on ...'.

Common situations: Linux-style SHA-512 hashes ($6$...) not enabled in /etc/security/policy.cfg (SSHA= set to blowfish/etc.); password policies rejecting the value; loading users from a shared profile built on different AIX policy settings.

Related errors

• Could not set password on #{@resource.class.name}[#{@resourc
• Invalid value %{value}: %{property} must be an Integer!
• Cannot have both 'forcelocal' and 'ia_load_module' at the sa
• Could not set %{property} on %{resource}[%{name}]: %{detail}
• Invalid value %{groups}: Groups must be comma separated!

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/7d9bc797738d4f92. Report an issue: GitHub.