Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a multi-user server, which puts a subset of the users in a chroot. I want to allow all users to call passwd in order to change their respective password. Everything else I can think of is either overkill or likely to compromise system-security.

I build my chroot with makejail using the following configuration.


# these are binds to the actual location, hence, we don't want makejail to be tinkering with those.

testCommandsInsideJail=["bash","sh","ls","pwd","stat","whoami","svnserve -t","locale","localedef","man ssh","man scp","cat","nano","vim","ssh","scp","passwd"]


# speed up things a bit

As you can see, in testCommandsInsideJail, I listed passwd, but if I login as my testuser (who is inside that chroot), I get:

$ passwd
Changing password for test.
(current) UNIX password: 
passwd: Authentication token manipulation error
passwd: password unchanged

which I don't understand unfortunately (before you ask, yes, I am sure the password I entered is correct). I have found some sites via g, which help me as little as the actual error message. To my understanding, I am missing some pam module, but I don't know how to add it to the python script that builds the jail.

I am running Ubuntu Server 10.04.


I have the actual /etc/passwd bound (via /etc/fstab) to the location of the chroot passwd, which is in /var/chroot/sshd/etc/passwd, so modifications inside the chroot are seen from the outside. I have now also done the same with /etc/shadow, which for some reason I forgot before. So instead of


I have now


and an additional bind:

# chroot binds
/home       /var/chroot/sshd/home       none    bind    0   0
/etc/passwd /var/chroot/sshd/etc/passwd none    bind    0   0
/etc/shadow /var/chroot/sshd/etc/shadow none    bind    0   0
/etc/group  /var/chroot/sshd/etc/group  none    bind    0   0
/srv        /var/chroot/sshd/srv        none    bind    0   0

If I try to change the password now, I get

$ passwd
Changing password for test.
(current) UNIX password: 
Enter new UNIX password: 
Retype new UNIX password: 
passwd: Authentication token manipulation error
passwd: password unchanged

So, passwd manages to check the current password, but dies when it comes to setting it.

share|improve this question
What OS, Linux? – Chris S Oct 27 '10 at 13:17
Yes, I believe "Ubuntu Server 10.04" is Linux ;) – bitmask Oct 27 '10 at 16:59

Even if you do get passwd into the chroot is it going to be useful? The passwd within the chroot is going to update the /etc/passwd or shadow in the chroot, not the system passwd/shadow. You will probably need to tell us more about what exactly you are serving out of this chroot since the details may help us provide you with a better answer.

share|improve this answer
Thanks for the hint, I completely forgot to provide /etc/shadow inside the chroot. Please see the part after EDIT. – bitmask Oct 27 '10 at 2:25

You'd need to preserve the pam structures too (usually /etc/pam.d)

share|improve this answer
I added /etc/pam.d to the script and created a new bind. Inside the jail, I can see the correct directory. However, that did not change the error message. – bitmask Oct 27 '10 at 17:07
A quick google suggests that this can arise with null passwords in /etc/shadow, or where /dev/urandom is not available in chroot (although this is uaully accompanied by more specific error messages) or where the cracklib datafiles are required and not in the chroot....try running the passwd through 'strace' and see if you can spot where it fails. – symcbean Oct 28 '10 at 16:23
I have non-set (null?) passwords in my non-chroot shell, and passwd works fine there. Also, AFAIK cracklib is for checking if a password is admissible, which it does. If I enter for instance the password 1, passwd will refuse to set it and prompt me for a different password. – bitmask Oct 30 '10 at 7:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.