Repository: ansible/ansible

Issue:
user module fails to set password on AIX
<!---
Verify first that your issue/request is not already reported on GitHub.
Also test if the latest release, and master branch are affected too.
-->

##### ISSUE TYPE
<!--- Pick one below and delete the rest: -->
 - Bug Report

##### COMPONENT NAME
<!--- Name of the module/plugin/task/feature -->
- user

##### ANSIBLE VERSION
<!--- Paste verbatim output from “ansible --version” between quotes below -->
```
ansible 2.3.0.0
  config file = /home/user/work/git/ansible/ansible.cfg
  configured module search path = [u'./library/']
  python version = 2.7.5 (default, Aug  2 2016, 04:20:16) [GCC 4.8.5 20150623 (Red Hat 4.8.5-4)]
```

##### CONFIGURATION
<!---
Mention any settings you have changed/added/removed in ansible.cfg
(or using the ANSIBLE_* environment variables).
-->

##### OS / ENVIRONMENT
<!---
Mention the OS you are running Ansible from, and the OS you are
managing, or say “N/A” for anything that is not platform-specific.
-->
Running from "Red Hat Enterprise Linux Server release 7.3 (Maipo)"
Managing AIX 7.1 TL04 SP02 (1614)

##### SUMMARY
<!--- Explain the problem briefly -->
Attempts to create user fail during setting of password.

##### STEPS TO REPRODUCE
<!---
For bugs, show exactly how to reproduce the problem, using a minimal test-case.
For new features, show how the feature would be used.
-->
ansible server -m user -a 'name=unxtst01 password="********"'
server | FAILED! => {
    "changed": false,
    "cmd": "/ u s r / b i n / c h p a s s w d ' ' - e ' ' - c",
    "failed": true,
    "msg": "[Errno 13] Permission denied",
    "rc": 13
}

<!--- Paste example playbooks or commands between quotes below -->
```yaml

```

<!--- You can also paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
<!--- What did you expect to happen when running the steps above? -->
The password would be set without error.

##### ACTUAL RESULTS
<!--- What actually happened? If possible run with extra verbosity (-vvvv) -->

<!--- Paste verbatim command output between quotes below -->
```
$ ansible -vvvv server -m user -a 'name=unxtst01 password="letmein"'
Using /home/xxx1234/work/git/ansible/ansible.cfg as config file
Loading callback plugin minimal of type stdout, v2.0 from /usr/lib/python2.7/site-packages/ansible/plugins/callback/__init__.pyc
META: ran handlers
Using module file /usr/lib/python2.7/site-packages/ansible/modules/system/user.py
<server> ESTABLISH SSH CONNECTION FOR USER: None
<server> SSH: EXEC ssh -vvv -oLogLevel=quiet -oConnectTimeout=10 -oControlMaster=auto -oControlPersist=90s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/home/ansible/.ansible/cp/827e06aeba server'/bin/sh -c '"'"'sudo -H -S -n -u root /bin/sh -c '"'"'"'"'"'"'"'"'echo BECOME-SUCCESS-oeclakddmuojlwurlnqaljnulbngfhsd; /usr/bin/python'"'"'"'"'"'"'"'"' && sleep 0'"'"''
<server> (1, '\n{"msg": "[Errno 13] Permission denied", "failed": true, "cmd": "/ u s r / b i n / c h p a s s w d \' \' - e \' \' - c", "rc": 13, "invocation": {"module_args": {"comment": null, "ssh_key_bits": 0, "update_password": "always", "non_unique": false, "force": false, "ssh_key_type": "rsa", "ssh_key_passphrase": null, "createhome": true, "uid": null, "home": null, "append": false, "skeleton": null, "ssh_key_comment": "ansible-generated on server", "group": null, "system": false, "state": "present", "shell": null, "expires": null, "ssh_key_file": null, "groups": null, "move_home": false, "password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER", "name": "unxtst01", "seuser": null, "remove": false, "login_class": null, "generate_ssh_key": null}}}\n', 'OpenSSH_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: /etc/ssh/ssh_config line 20: Applying options for *\r\ndebug3: ciphers ok: [aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc]\r\ndebug3: macs ok: [hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160]\r\ndebug1: auto-mux: Trying existing master\r\ndebug1: Control socket "/home/ansible/.ansible/cp/827e06aeba" does not exist\r\ndebug2: ssh_connect: needpriv 0\r\ndebug1: Connecting to server [10.30.6.242] port 22.\r\ndebug2: fd 3 setting O_NONBLOCK\r\ndebug1: fd 3 clearing O_NONBLOCK\r\ndebug1: Connection established.\r\ndebug3: timeout: 10000 ms remain after connect\r\ndebug1: identity file /home/ansible/.ssh/identity type -1\r\ndebug1: identity file /home/ansible/.ssh/identity-cert type -1\r\ndebug3: Incorrect RSA1 identifier\r\ndebug3: Could not load "/home/ansible/.ssh/id_rsa" as a RSA1 public key\r\ndebug1: identity file /home/ansible/.ssh/id_rsa type 1\r\ndebug1: identity file /home/ansible/.ssh/id_rsa-cert type -1\r\ndebug1: identity file /home/ansible/.ssh/id_dsa type -1\r\ndebug1: identity file /home/ansible/.ssh/id_dsa-cert type -1\r\ndebug1: Enabling compatibility mode for protocol 2.0\r\ndebug1: Local version string SSH-2.0-OpenSSH_6.6.1\r\ndebug1: Remote protocol version 2.0, remote software version OpenSSH_6.0\r\ndebug1: match: OpenSSH_6.0 pat OpenSSH* compat 0x04000000\r\ndebug2: fd 3 setting O_NONBLOCK\r\ndebug3: load_hostkeys: loading entries for host "server" from file "/home/ansible/.ssh/known_hosts"\r\ndebug3: load_hostkeys: found key type RSA in file /home/ansible/.ssh/known_hosts:1\r\ndebug3: load_hostkeys: loaded 1 keys\r\ndebug3: order_hostkeyalgs: prefer hostkeyalgs: ssh-rsa-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-rsa\r\ndebug1: SSH2_MSG_KEXINIT sent\r\ndebug1: SSH2_MSG_KEXINIT received\r\ndebug2: kex_parse_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1\r\ndebug2: kex_parse_kexinit: ssh-rsa-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-rsa,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-dss-cert-v00@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,ssh-dss\r\ndebug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc\r\ndebug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc\r\ndebug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160\r\ndebug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160\r\ndebug2: kex_parse_kexinit: zlib@openssh.com,zlib,none\r\ndebug2: kex_parse_kexinit: zlib@openssh.com,zlib,none\r\ndebug2: kex_parse_kexinit: \r\ndebug2: kex_parse_kexinit: \r\ndebug2: kex_parse_kexinit: first_kex_follows 0 \r\ndebug2: kex_parse_kexinit: reserved 0 \r\ndebug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1\r\ndebug2: kex_parse_kexinit: ssh-rsa,ssh-dss\r\ndebug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se\r\ndebug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se\r\ndebug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96\r\ndebug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96\r\ndebug2: kex_parse_kexinit: none,zlib@openssh.com\r\ndebug2: kex_parse_kexinit: none,zlib@openssh.com\r\ndebug2: kex_parse_kexinit: \r\ndebug2: kex_parse_kexinit: \r\ndebug2: kex_parse_kexinit: first_kex_follows 0 \r\ndebug2: kex_parse_kexinit: reserved 0 \r\ndebug2: mac_setup: setup hmac-md5\r\ndebug1: kex: server->client aes128-cbc hmac-md5 zlib@openssh.com\r\ndebug2: mac_setup: setup hmac-md5\r\ndebug1: kex: client->server aes128-cbc hmac-md5 zlib@openssh.com\r\ndebug1: kex: ecdh-sha2-nistp256 need=16 dh_need=16\r\ndebug1: kex: ecdh-sha2-nistp256 need=16 dh_need=16\r\ndebug1: sending SSH2_MSG_KEX_ECDH_INIT\r\ndebug1: expecting SSH2_MSG_KEX_ECDH_REPLY\r\ndebug1: Server host key: RSA 46:d0:38:19:69:0b:ae:47:82:24:10:06:04:c5:d3:f7\r\ndebug3: load_hostkeys: loading entries for host "server" from file "/home/ansible/.ssh/known_hosts"\r\ndebug3: load_hostkeys: found key type RSA in file /home/ansible/.ssh/known_hosts:1\r\ndebug3: load_hostkeys: loaded 1 keys\r\ndebug3: load_hostkeys: loading entries for host "10.30.6.242" from file "/home/ansible/.ssh/known_hosts"\r\ndebug3: load_hostkeys: found key type RSA in file /home/ansible/.ssh/known_hosts:1\r\ndebug3: load_hostkeys: loaded 1 keys\r\ndebug1: Host \'server\' is known and matches the RSA host key.\r\ndebug1: Found key in /home/ansible/.ssh/known_hosts:1\r\ndebug1: ssh_rsa_verify: signature correct\r\ndebug2: kex_derive_keys\r\ndebug2: set_newkeys: mode 1\r\ndebug1: SSH2_MSG_NEWKEYS sent\r\ndebug1: expecting SSH2_MSG_NEWKEYS\r\ndebug2: set_newkeys: mode 0\r\ndebug1: SSH2_MSG_NEWKEYS received\r\ndebug1: SSH2_MSG_SERVICE_REQUEST sent\r\ndebug2: service_accept: ssh-userauth\r\ndebug1: SSH2_MSG_SERVICE_ACCEPT received\r\ndebug2: key: /home/ansible/.ssh/identity ((nil)),\r\ndebug2: key: /home/ansible/.ssh/id_rsa (0x7fcd22182bb0),\r\ndebug2: key: /home/ansible/.ssh/id_dsa ((nil)),\r\ndebug3: input_userauth_banner\r\n\nBy proceeding further, I accept the following:\n\nYou are about to access an HCA-Information Technology & Services, Inc. (IT&S)\ncomputer system. This system is to be used only by authorized users of IT&S, its\ncustomers and affiliates. As a user of this system, you have no expectation of\nprivacy rights or ownership in anything you may create, store, send or receive\non this system. By proceeding, your use of this system 1) constitutes your\nagreement that IT&S and/or your company may consent to law enforcement officials\nand agencies accessing information regarding your use of this network, 2)\nconstitutes your consent to monitoring, retrieval, and disclosure of any\ninformation within this system for all purposes deemed appropriate by IT&S,\nincluding enforcement of rules concerning unacceptable uses of this system, and\n3) constitutes your agreement to comply with all privacy, security and other\npolicies and procedures of IT&S and your company. If you have any questions\nabout what constitutes an acceptable use by you, please consult the written\npolicies provided by IT&S and your company.\n\n\ndebug1: Authentications that can continue: publickey,password,keyboard-interactive\r\ndebug3: start over, passed a different list publickey,password,keyboard-interactive\r\ndebug3: preferred gssapi-with-mic,gssapi-keyex,hostbased,publickey\r\ndebug3: authmethod_lookup publickey\r\ndebug3: remaining preferred: ,gssapi-keyex,hostbased,publickey\r\ndebug3: authmethod_is_enabled publickey\r\ndebug1: Next authentication method: publickey\r\ndebug1: Trying private key: /home/ansible/.ssh/identity\r\ndebug3: no such identity: /home/ansible/.ssh/identity: No such file or directory\r\ndebug1: Offering RSA public key: /home/ansible/.ssh/id_rsa\r\ndebug3: send_pubkey_test\r\ndebug2: we sent a publickey packet, wait for reply\r\ndebug1: Server accepts key: pkalg ssh-rsa blen 279\r\ndebug2: input_userauth_pk_ok: fp 23:23:fa:43:d7:bb:09:0c:cd:be:1b:85:aa:48:72:d0\r\ndebug3: sign_and_send_pubkey: RSA 23:23:fa:43:d7:bb:09:0c:cd:be:1b:85:aa:48:72:d0\r\ndebug1: key_parse_private2: missing begin marker\r\ndebug1: read PEM private key done: type RSA\r\ndebug1: Enabling compression at level 6.\r\ndebug1: Authentication succeeded (publickey).\r\nAuthenticated to server ([10.30.6.242]:22).\r\ndebug1: setting up multiplex master socket\r\ndebug3: muxserver_listen: temporary control path /home/ansible/.ansible/cp/827e06aeba.CdHkoloOJP6Xe8wb\r\ndebug2: fd 4 setting O_NONBLOCK\r\ndebug3: fd 4 is O_NONBLOCK\r\ndebug3: fd 4 is O_NONBLOCK\r\ndebug1: channel 0: new [/home/ansible/.ansible/cp/827e06aeba]\r\ndebug3: muxserver_listen: mux listener channel 0 fd 4\r\ndebug2: fd 3 setting TCP_NODELAY\r\ndebug3: packet_set_tos: set IP_TOS 0x08\r\ndebug1: control_persist_detach: backgrounding master process\r\ndebug2: control_persist_detach: background process is 15150\r\ndebug2: fd 4 setting O_NONBLOCK\r\ndebug1: forking to background\r\ndebug1: Entering interactive session.\r\ndebug2: set_control_persist_exit_time: schedule exit in 90 seconds\r\ndebug1: multiplexing control connection\r\ndebug2: fd 5 setting O_NONBLOCK\r\ndebug3: fd 5 is O_NONBLOCK\r\ndebug1: channel 1: new [mux-control]\r\ndebug3: channel_post_mux_listener: new mux channel 1 fd 5\r\ndebug3: mux_master_read_cb: channel 1: hello sent\r\ndebug2: set_control_persist_exit_time: cancel scheduled exit\r\ndebug3: mux_master_read_cb: channel 1 packet type 0x00000001 len 4\r\ndebug2: process_mux_master_hello: channel 1 slave version 4\r\ndebug2: mux_client_hello_exchange: master version 4\r\ndebug3: mux_client_forwards: request forwardings: 0 local, 0 remote\r\ndebug3: mux_client_request_session: entering\r\ndebug3: mux_client_request_alive: entering\r\ndebug3: mux_master_read_cb: channel 1 packet type 0x10000004 len 4\r\ndebug2: process_mux_alive_check: channel 1: alive check\r\ndebug3: mux_client_request_alive: done pid = 15152\r\ndebug3: mux_client_request_session: session request sent\r\ndebug3: mux_master_read_cb: channel 1 packet type 0x10000002 len 177\r\ndebug2: process_mux_new_session: channel 1: request tty 0, X 0, agent 0, subsys 0, term "vt220", cmd "/bin/sh -c \'sudo -H -S -n -u root /bin/sh -c \'"\'"\'echo BECOME-SUCCESS-oeclakddmuojlwurlnqaljnulbngfhsd; /usr/bin/python\'"\'"\' && sleep 0\'", env 0\r\ndebug3: process_mux_new_session: got fds stdin 6, stdout 7, stderr 8\r\ndebug2: fd 6 setting O_NONBLOCK\r\ndebug2: fd 7 setting O_NONBLOCK\r\ndebug2: fd 8 setting O_NONBLOCK\r\ndebug1: channel 2: new [client-session]\r\ndebug2: process_mux_new_session: channel_new: 2 linked to control channel 1\r\ndebug2: channel 2: send open\r\ndebug2: callback start\r\ndebug2: client_session2_setup: id 2\r\ndebug1: Sending command: /bin/sh -c \'sudo -H -S -n -u root /bin/sh -c \'"\'"\'echo BECOME-SUCCESS-oeclakddmuojlwurlnqaljnulbngfhsd; /usr/bin/python\'"\'"\' && sleep 0\'\r\ndebug2: channel 2: request exec confirm 1\r\ndebug3: mux_session_confirm: sending success reply\r\ndebug2: callback done\r\ndebug2: channel 2: open confirm rwindow 0 rmax 32768\r\ndebug1: mux_client_request_session: master session id: 2\r\ndebug2: channel 2: rcvd adjust 2097152\r\ndebug2: channel_input_status_confirm: type 99 id 2\r\ndebug2: exec request accepted on channel 2\r\ndebug2: channel 2: read<=0 rfd 6 len 0\r\ndebug2: channel 2: read failed\r\ndebug2: channel 2: close_read\r\ndebug2: channel 2: input open -> drain\r\ndebug2: channel 2: ibuf empty\r\ndebug2: channel 2: send eof\r\ndebug2: channel 2: input drain -> closed\r\ndebug2: channel 2: rcvd eof\r\ndebug2: channel 2: output open -> drain\r\ndebug2: channel 2: obuf empty\r\ndebug2: channel 2: close_write\r\ndebug2: channel 2: output drain -> closed\r\ndebug2: channel 2: send close\r\ndebug1: client_input_channel_req: channel 2 rtype exit-status reply 0\r\ndebug3: mux_exit_message: channel 2: exit message, exitval 1\r\ndebug2: channel 2: rcvd close\r\ndebug3: channel 2: will not send data after close\r\ndebug2: channel 2: is dead\r\ndebug2: channel 2: gc: notify user\r\ndebug3: mux_master_session_cleanup_cb: entering for channel 2\r\ndebug2: channel 1: rcvd close\r\ndebug2: channel 1: output open -> drain\r\ndebug2: channel 1: close_read\r\ndebug2: channel 1: input open -> closed\r\ndebug2: channel 2: gc: user detached\r\ndebug2: channel 2: is dead\r\ndebug2: channel 2: garbage collecting\r\ndebug1: channel 2: free: client-session, nchannels 3\r\ndebug3: channel 2: status: The following connections are open:\r\n  #2 client-session (t4 r0 i3/0 o3/0 fd -1/-1 cc -1)\r\n\r\ndebug2: channel 1: obuf empty\r\ndebug2: channel 1: close_write\r\ndebug3: mux_client_read_packet: read header failed: Broken pipe\r\ndebug2: Received exit status from master 1\r\ndebug2: channel 1: output drain -> closed\r\ndebug2: channel 1: is dead (local)\r\ndebug2: channel 1: gc: notify user\r\ndebug3: mux_master_control_cleanup_cb: entering for channel 1\r\ndebug2: channel 1: gc: user detached\r\ndebug2: channel 1: is dead (local)\r\ndebug2: channel 1: garbage collecting\r\ndebug1: channel 1: free: mux-control, nchannels 2\r\ndebug3: channel 1: status: The following connections are open:\r\n\r\ndebug2: set_control_persist_exit_time: schedule exit in 90 seconds\r\n')
server | FAILED! => {
    "changed": false,
    "cmd": "/ u s r / b i n / c h p a s s w d ' ' - e ' ' - c",
    "failed": true,
    "invocation": {
        "module_args": {
            "append": false,
            "comment": null,
            "createhome": true,
            "expires": null,
            "force": false,
            "generate_ssh_key": null,
            "group": null,
            "groups": null,
            "home": null,
            "login_class": null,
            "move_home": false,
            "name": "unxtst01",
            "non_unique": false,
            "password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "remove": false,
            "seuser": null,
            "shell": null,
            "skeleton": null,
            "ssh_key_bits": 0,
            "ssh_key_comment": "ansible-generated on server",
            "ssh_key_file": null,
            "ssh_key_passphrase": null,
            "ssh_key_type": "rsa",
            "state": "present",
            "system": false,
            "uid": null,
            "update_password": "always"
        }
    },
    "msg": "[Errno 13] Permission denied",
    "rc": 13
}
```



Discussion:
The permissions of the /usr/bin/chpasswd file on the AIX side are restricted to the owner (root).  Expectation that privilege escalation using become and become_user=root would circumvent the restriction.
Adding "--become --become-method=sudo --become-user=root" to the command line execution results in the same error as presented.
I have the same problem here. Any solutions?
cc @sfromm
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->
I have this issue. Are there any solutions?
Is the password in the right format, as in crypted?
How did you generate that?
And if the user exists do you have "update_password: yes"?

toshywoshy: The format of the password would not impact the behavior noted.  It would simply generate an unusable password, but still successfully execute the "chpasswd" command.
I've created and attached a sample playbook to duplicate the behavior.  The debug output results from execution of the playbook follow.
Please note that we are now running version 2.3.1.0 of ansible.

[aix_user_test.yml.txt](https://github.com/ansible/ansible/files/1195657/aix_user_test.yml.txt)
[aix_user_test.results.txt](https://github.com/ansible/ansible/files/1195670/aix_user_test.results.txt)


It looks like privilege escalation with become doesn't work with this part of the module.

What i get when i try it manually:

bash-4.2$ chpasswd -h
bash: /usr/bin/chpasswd: **The file access permissions do not allow the specified action.**
bash-4.2$ sudo chpasswd -h
chpasswd: Not a recognized flag: h
Usage: 
        chpasswd [-R load_module] [-e] [ -f flags | -c ]



What i get from module:

 FAILED! => {
    "changed": false, 
    "cmd": "/ u s r / b i n / c h p a s s w d ' ' - e ' ' - c", 
    "failed": true, 
    "invocation": {
        "module_args": {
            "append": false, 
            "comment": null, 
            "createhome": true, 
            "expires": null, 
            "force": false, 
            "generate_ssh_key": null, 
            "group": null, 
            "groups": null, 
            "home": null, 
            "login_class": null, 
            "move_home": false, 
            "name": "user", 
            "non_unique": false, 
            "password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER", 
            "remove": false, 
            "seuser": null, 
            "shell": null, 
            "skeleton": null, 
            "ssh_key_bits": 0, 
            "ssh_key_comment": "ansible-generated on host", 
            "ssh_key_file": null, 
            "ssh_key_passphrase": null, 
            "ssh_key_type": "rsa", 
            "state": "present", 
            "system": false, 
            "uid": null, 
            "update_password": "always"
        }
    }, 
    "msg": "[Errno 13] **The file access permissions do not allow the specified action**.", 
    "rc": 13
}
@gblansteen 
What is your .ansible.cfg setting for the followiing :
- ssh_args =
- ControlPath=
- control_path_dir
- control_path =
- pipelining =
- scp_if_ssh =
- transfer_method =
- sftp_batch_mode =
Can you try with SSH ControlMaster disabled on your Ansible master?
@owlmind in your case I think the problem is in the path/user settings
Normally you can set that in your ansible config or your host file
" sudo_exe = /usr/bin/sudo  "
On AIX, the default is ksh, while you are running bash, so also check what your ansible user is and set the sudo path there

@toshywoshy sudo works perfectly, this is the only one module i'am experiencing trouble with. As example I can use aix_inittab module which requires exactly the same privileges, but user doesn't work.

Changing pipelining also doesn't help . That is one of the first thing i'he tried.
Hello, same problem here.
Source: Ansible 2.2.1.0 on Ubuntu 17.04, and version 2.3.1.0 on ArchLinux
Targets: AIX 7100-04-04-1717, 6100-09-05-1524, 6100-09-09-1717

The issue started after the update from release 2.1.1.0 to 2.2.1.0.
Up to 2.1.1.0 I had no problems with chpasswd, used montly to change AIX user passwords.
No problems with other modules that require privilege excalation to root.

@toshywoshy sudo operations work fine with other modules.  This is specific to executing the /usr/bin/chpasswd command within the user module.  That said the sudo and bash commands are in the standard path locations (i.e.: /bin, /usr/bin).
I have exactly the same issue.  I'm suspious about this:

/ u s r / b i n / c h p a s s w d ' ' - e ' ' - c

The space between each character?
something is expecting a list but getting a string, which in python CAN be treated as a list .. probably why you are getting it space separated.
found issue in line 1873:
 ` self.execute_command(' '.join(cmd), data="%s:%s" % (self.name, self.password))`

that join is incorrect, passing command directly should fix it

Resolving patch:
diff --git a/lib/ansible/modules/system/user.py b/lib/ansible/modules/system/user.py
--- a/lib/ansible/modules/system/user.py
+++ b/lib/ansible/modules/system/user.py
@@ -1870,7 +1870,7 @@ def create_user_useradd(self, command_name='useradd'):
             cmd.append(self.module.get_bin_path('chpasswd', True))
             cmd.append('-e')
             cmd.append('-c')
-            self.execute_command(' '.join(cmd), data="%s:%s" % (self.name, self.password))
+            self.execute_command(cmd, data="%s:%s" % (self.name, self.password))
 
         return (rc, out, err)
 
@@ -1942,7 +1942,7 @@ def modify_user_usermod(self):
             cmd.append(self.module.get_bin_path('chpasswd', True))
             cmd.append('-e')
             cmd.append('-c')
-            (rc2, out2, err2) = self.execute_command(' '.join(cmd), data="%s:%s" % (self.name, self.password))
+            (rc2, out2, err2) = self.execute_command(cmd, data="%s:%s" % (self.name, self.password))
         else:
             (rc2, out2, err2) = (None, '', '')
 


Test patch: