IBM AIX 7.2 – Common Problem 212 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

RBAC users receive ‘permission denied’ even though a role is assigned.

Environment & Reproduction

Enhanced RBAC enabled but session lacks active role.

rolelist -u user1
swrole role01
tsh

Root Cause Analysis

Role authorizations require swrole/login to be reactivated and KST refreshed.

Quick Triage

Confirm role assignment and current session authorizations.

lsuser -a roles user1
rolelist -e
lssec -f /etc/security/user -s user1 -a roles

Step-by-Step Diagnosis

Compare authorized command requirements with active KST entries.

lsauth ALL_AUTHS
lssec -f /etc/security/roles -s role01 -a authorizations
setkst

Solution – Primary Fix

Assign role, refresh KST, and have user run swrole before executing commands.

chuser roles=role01 user1
setkst
swrole role01

Solution – Alternative Approaches

Use sudo with documented commands or create a fine-grained role with chauth.

Verification & Acceptance Criteria

User executes the privileged command without password rejection.

swrole role01
rolelist -e

Rollback Plan

Remove the role assignment if it grants excessive privilege.

chuser roles= user1
setkst
rolelist -u user1

Prevention & Hardening

Document role design, use setkst after changes, and audit with rolelist.

Related Errors & Cross-Refs

Related to sudo escalation, audit subsystem misses, and login banner enforcement.

Related tutorial: View the step-by-step tutorial for aix-7.2.

View all aix-7.2 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

IBM AIX 7.2 security and RBAC administration guide.