PAM-CM-3478: Failed to update the account credentials trying to update UNIX target account password

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

Trying to rotate a target account password for an account which is not root, but which has the ability to change its own password, the following error is obtained:

PAM-CM-3478: Failed to update the account credentials. The password may not meet the minimum requirements for the Linux system. Review the log file for further information or else contact your Administrator.

Environment

CA Privileged Access Manager (PAM) integrated with a Linux or UNIX target device for credential management.

Cause

This is caused by a mismatch between what PAM expects to receive from the remote machine and what it is getting. The tomcat log, which can be downloaded as a text file from the Configuration > Diagnostics > Diagnostic Logs > Download page, shows the following messages:

2024-04-05T07:47:23.239+0000 INFO [com.cloakware.cspm.server.plugin.targetmanager.UnixAdvancedTargetManager] com.cloakware.cspm.server.plugin.CSPMClientChannel.readUntil T118016 - received data 'Last unsuccessful login: Wed Apr  1 11:31:27 EEST 2020 on ssh from <PAM IP>
Last login: Fri Apr  5 10:47:21 EEST 2024 on ssh from <address>
$ ' MATCHES the pattern '[#|\$|>]
2024-04-05T07:47:23.240+0000 INFO [com.cloakware.cspm.server.plugin.targetmanager.UnixAdvancedTargetManager] com.cloakware.cspm.server.plugin.CSPMClientChannel.write T118016 - sent data 'passwd
'
2024-04-05T07:47:23.742+0000 INFO [com.cloakware.cspm.server.plugin.targetmanager.UnixAdvancedTargetManager] com.cloakware.cspm.server.plugin.CSPMClientChannel.readUntil T118016 - received data 'passwd
Changing password for "pamadmin1"
pamadmin1's New password: ' MATCHES the pattern '(?si)(.*?password(\sfor|\sagain|)(\s\S*|):.*?)
2024-04-05T07:47:23.743+0000 INFO [com.cloakware.cspm.server.plugin.targetmanager.UnixAdvancedTargetManager] com.cloakware.cspm.server.plugin.CSPMClientChannel.write T118016 - sent data '<not logged>'
2024-04-05T07:47:24.243+0000 INFO [com.cloakware.cspm.server.plugin.targetmanager.UnixAdvancedTargetManager] com.cloakware.cspm.server.plugin.CSPMClientChannel.readUntil T118016 - received data '
Enter the new password again:' MATCHES the pattern '(?si)(.*?password(\sfor|\sagain|)(\s\S*|):.*?)
2024-04-05T07:47:24.243+0000 INFO [com.cloakware.cspm.server.plugin.targetmanager.UnixAdvancedTargetManager] com.cloakware.cspm.server.plugin.CSPMClientChannel.write T118016 - sent data '<not logged>'
2024-04-05T07:47:24.744+0000 INFO [com.cloakware.cspm.server.plugin.targetmanager.UnixAdvancedTargetManager] com.cloakware.cspm.server.plugin.CSPMClientChannel.readUntil T118016 - received data '
3004-600 The password entry does not match, please try again.
pamadmin1's New password: ' MATCHES the pattern '(?si)(.*?password(\sfor|\sagain|)(\s\S*|):.*?)
2024-04-05T07:47:24.744+0000 INFO [com.cloakware.cspm.server.plugin.targetmanager.UnixAdvancedTargetManager] com.cloakware.cspm.server.plugin.CSPMClientChannel.write T118016 - sent data '<not logged>'

 

Generally when an account changes its password in UNIX, the passwd command first requests to enter the current password, and subsequently to enter the new password twice.

When the user is root, it asks straight away to enter the new password, then to do the same once again and the password is changed.

For some systems, though, even if the account is not root, the first prompt to enter the old password is not issued.

This is what is happening in this case: When the passwd command is entered, the system straight away asks for the new password, but based on the account configuration in PAM, the PAM UNIX connector script expects the command to ask for the current password first and therefore sends the current password on the first prompt, which matches the password entry prompt regex defined in the UNIX target application that the account belongs to.

After the system has received what it thinks is the new password (but is in fact the current password sent by PAM), it asks for the password to be sent again. At that point, PAM thinks it needs to send the new password and it does so.

On receiving the new password the system compares it with the previous password received and obviously there is a mismatch, hereby resulting in this error.

Resolution

Modify the target account privilege elevation setting to mark it as a root account, in which case PAM will expect the passwd command to ask for the new password right away.

1. Edit the target account.
2. Select the UNIX tab.
3. Set privilege elevation option "This account is a root account" and save the account.
4. Verify that password updates are successful now.

Additional Information

A detailed discussion of privilege elevation settings for UNIX target accounts is found in article Proper use of privilege elevation settings for PAM target accounts of type UNIX.