IBM AIX 7.1 – Common Problem 157 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Critical service accounts are intermittently locked, breaking batch jobs. Operations team must unlock accounts repeatedly, signalling a configuration or attack issue.

Environment & Reproduction

Affects accounts subject to loginretries policy in /etc/security/user.

lsuser -a account_locked unsuccessful_login_count ALL
oslevel -s
uname -a

Root Cause Analysis

Cause is unsuccessful_login_count exceeding loginretries due to typos, expired keys, or brute-force attempts on listening services.

Quick Triage

Identify locked accounts, review login history, and confirm source IPs.

lsuser -a account_locked unsuccessful_login_count ALL

Step-by-Step Diagnosis

Capture deeper evidence to isolate the failure path.

lsuser -a account_locked unsuccessful_login_count ALL
grep batch /etc/security/lastlog
last | head
who /etc/security/failedlogin | head

Solution – Primary Fix

Apply the proven primary fix in a controlled change window.

chsec -f /etc/security/lastlog -s batch -a unsuccessful_login_count=0
chuser account_locked=false batch
passwd batch

Solution – Alternative Approaches

Use these alternatives when the primary fix is blocked by environmental constraints.

chsec -f /etc/security/user -s default -a loginretries=10
chuser loginretries=0 root

Verification & Acceptance Criteria

Confirm the system meets acceptance criteria after the change.

lsuser -a account_locked batch
last batch | head
errpt -j AA8AB241 | head

Rollback Plan

Revert cleanly if regressions appear during validation.

chsec -f /etc/security/user -s default -a loginretries=5
chuser loginretries=0 root

Prevention & Hardening

Reduce recurrence with monitoring and preventive tuning.

chsec -f /etc/security/login.cfg -s default -a logindelay=5
fail2ban-equivalent via /etc/hosts.deny
audit start

Related Errors & Cross-Refs

Related to SSH brute-force, AD/LDAP integration failures, and TCP wrapper drops.

Related tutorial: View the step-by-step tutorial for aix-7.1.

View all aix-7.1 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

IBM AIX 7.2 Security guide, chuser and chsec man pages.