How to Fix “passwd: Authentication token manipulation error” in Linux in 2025

Linux user management is based mostly on the passwd command, which lets you change or reset passwords. But when it throws the dreaded “Authentication token manipulation error,” panic frequently ensues. This flaw locks users off accounts, restricts password changes, and suggests more general system problems.

Common triggers include read-only file systems, full disks, or improper permissions. Whether you’re a sysadmin or a casual user, resolving this mistake fast is crucial. Let’s explore its causes and follow tested remedies to regain system control.

What Causes the “Authentication Token Manipulation Error”?

This error occurs when the system can’t update authentication files like /etc/shadow. Below are the five most common culprits:

1. File System Mounted as Read-Only

If your root partition (/) is read-only, the passwd command can’t modify /etc/shadow. This often happens after improper shutdowns or disk errors.

2. Disk Space or Inode Exhaustion

A full disk or exhausted inodes (metadata pointers) prevents file updates. Use df -h and df -i to check storage and inode usage.

3. Incorrect File Permissions on Critical Files

The /etc/shadow and /etc/passwd files require strict permissions. If altered, the system can’t write password changes.

4. Corrupted User Authentication Files

Physical disk errors or failed writes can corrupt /etc/shadow. Similarly, misconfigured PAM (Pluggable Authentication Modules) may disrupt password updates.

5. SELinux or AppArmor Restrictions

Overly strict security policies in SELinux or AppArmor might block password modifications. Temporarily disabling them can isolate the issue.

Step-by-Step Fixes for the Authentication Token Error

Follow these solutions in order, starting with the simplest fixes.

1. Check Disk Space and Inodes

Run these commands to identify shortages:

df -h  # Check disk space
df -i  # Check inode usage

If your disk is full, delete logs (/var/log), clear package caches (sudo apt clean), or remove temporary files. For inode exhaustion, delete small unused files or Docker containers.

2. Verify File System Read-Write Status

Confirm your root partition isn’t read-only:

mount | grep " / "

If ro (read-only) appears, remount it as read-write:

sudo mount -o remount,rw /

3. Repair File Permissions for /etc/shadow and /etc/passwd

Reset permissions and ownership:

sudo chmod 0644 /etc/passwd
sudo chmod 0640 /etc/shadow
sudo chown root:shadow /etc/shadow

The correct permissions for /etc/shadow are 640, owned by root:shadow.

4. Check for File System Errors

Boot from a live USB, unmount your disk, and run fsck:

sudo umount /dev/sdX  # Replace sdX with your partition
sudo fsck -y /dev/sdX

This repairs disk corruption that might lock authentication files.

5. Reset Password via Recovery Mode

If the system is unbootable:

1. Reboot and hold Shift to access GRUB.
2. Select “Advanced Options” → “Recovery Mode.”
3. Choose “root” to drop into a shell.
4. Remount the file system: mount -o remount,rw /.
5. Run passwd [username] to reset the password.

6. Disable SELinux/AppArmor Temporarily

For SELinux:

sudo setenforce 0  # Set to permissive mode

For AppArmor:

sudo systemctl stop apparmor

If the error disappears, adjust policies instead of leaving modules disabled.

Also Read : How to Create Directories with the mkdir Command in Linux

Troubleshooting Common Issues

What If the Error Persists After Fixes?

Check PAM configurations in /etc/pam.d/common-password. A broken module (e.g., pam_unix.so) can cause failures. Comment out suspicious lines with # and retest.

Handling “Permission Denied” Errors

Use lsattr to check immutable flags:

sudo lsattr /etc/shadow

If the i (immutable) flag is set, remove it:

sudo chattr -i /etc/shadow

Resetting Passwords for Locked Accounts

Unlock the account first:

sudo usermod -U [username]

Then reset the password.

People Also Ask: Your Top Questions Answered

1. Why Does Linux Show “Authentication Token Manipulation Error”?

The system can’t update /etc/shadow due to read-only filesystems, disk issues, or permission errors. This file stores encrypted passwords, so write failures trigger the error.

2. Can Disk Full Cause Password Change Errors?

Yes. If the disk or inodes are 100% full, the system can’t write to /etc/shadow. Always keep at least 5-10% of disk space free.

3. How to Fix Read-Only File Systems in Linux?

Remount the partition as read-write with mount -o remount,rw /. If the issue persists, run fsck to repair disk errors.

4. What Are Safe Permissions for /etc/shadow?

/etc/shadow should have 640 permissions (-rw-r-----) and be owned by root:shadow. Never set it to world-writable (666 or 777).

5. How to Bypass This Error in Recovery Mode?

Boot into recovery mode, remount the root partition as read-write, and use passwd to reset the password. This bypasses most permission and filesystem issues.

Conclusion: Preventing Future Authentication Errors

Regular system checks are your best defense. Monitor disk space with tools like ncdu, audit file permissions monthly, and keep backups of critical files like /etc/shadow. Configure SELinux/AppArmor policies carefully, and always shut down Linux properly to avoid filesystem corruption.

If you hit the “Authentication token manipulation error” again, methodically test each fix. The Linux community thrives on shared knowledge—don’t hesitate to seek help on forums or Stack Overflow. With these solutions, you’ll turn a show-stopping error into a minor bump in your sysadmin journey.