Trying to change a Ubuntu user's password, authentication token manipulation error

Solution 1:

I ran into the "Authentication token manipulation error" after dropping into a root shell from the boot loader. Turned out the filesystem was mounted read only:

mount -o remount,rw /

fixed it and I could change the password.

Solution 2:

I would start by looking in /var/log/auth.log

Linux authentication and passwords and things are handled by PAM (pluggable authentication modules). You can get those modules to give debugging output to auth.log by changing files in /etc/pam.d/

Note that doing anything more involved than adding "debug" to a line is RISKY, since even if you know what you're doing it's fairly easy to end up making it impossible to log in (in that case, you'll need to reboot from a live CD or something). And you NEED to have a backup copy of anything you edit. And you NEED to have another root shell open, so you can copy back your backup copy.

Here's a good page on debugging PAM that I just used to fix some kerberos authentication issues: http://www.micro-gravity.com/wiki/index.php?page=DebuggingPAM