Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to create a local user on a new Ubuntu box. I'm unable to change the password, and I keep getting the error below. The user gets added to the shadow file, but I can't get it to set a password. How can this be fixed?

admin@theserver:~$ sudo useradd jamz
[sudo] password for admin: 
admin@theserver:~$ sudo passwd jamz
passwd: Authentication token manipulation error
passwd: password unchanged
share|improve this question

migrated from Feb 11 '10 at 4:25

This question came from our site for professional and enthusiast programmers.

From Ubuntu's man useradd: "useradd is a low level utility for adding users. On Debian, administrators should usually use adduser(8) instead." (Ubuntu is built on top of Debian.) – Roger Pate Feb 11 '10 at 3:56
See solution for the similar problem here:… – uthark Feb 11 '10 at 4:25

I ran into the "Authentication token manipulation error" after dropping into a root shell from the boot loader. Turned out the filesystem was mounted read only:

mount -o remount,rw /

fixed it and I could change the password.

share|improve this answer
This save my life! Thank you very much – workdreamer Apr 15 '12 at 22:39

Check the permissions on your /etc/shadow file. They must be set to 000 or you cannot edit user password data

share|improve this answer

I would start by looking in /var/log/auth.log

Linux authentication and passwords and things are handled by PAM (pluggable authentication modules). You can get those modules to give debugging output to auth.log by changing files in /etc/pam.d/

Note that doing anything more involved than adding "debug" to a line is RISKY, since even if you know what you're doing it's fairly easy to end up making it impossible to log in (in that case, you'll need to reboot from a live CD or something). And you NEED to have a backup copy of anything you edit. And you NEED to have another root shell open, so you can copy back your backup copy.

Here's a good page on debugging PAM that I just used to fix some kerberos authentication issues:

share|improve this answer
You can do worse things than locking yourself out. You could for example make all logins succeed no matter if they used a correct password or not. – ThiefMaster Nov 14 '11 at 10:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.