AIX Password rotation fails on the endpoint

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

PAM password rotation is failing, when they attempt to rotate that password, using another account.  

Environment

Release : 4.1.x

Cause

AIX is asking for the old password when attempting to change the password

Resolution

Ultimately every flavor of Unix/Linux can have their own ways on how passwords can be changed, via many configuration files in /etc/pam.d/system-auth, password-auth or their specific OS configuration files.  In this particular case, Aix uses the /usr/lib/security/methods.cfg file and the option in play here is the setting -> rootrequiresopw option, which should be set to False.  This is because our out of the box Unix connector is developed for all Unix variants which traditionally doesn't prompt for old password when changing another users password.  This is an option in Aix.