AIX login failures due to invalid /etc/security/user configuration (4383781)

After reboot, AD users fail to authenticate via VAS on AIX. System logs show only generic authentication failures. It may happen for system data corruption.

The /etc/security/user file contains repeated/malformed entries for:
auth1 = SYSTEM
SYSTEM = "VAS"

These entries are defined multiple times and not placed under a proper stanza (e.g., default:), causing AIX to misinterpret the authentication configuration.

Symptoms (authlog):
With an invalid configuration, the system does not properly invoke VAS, and logs only show generic failures such as:

Jun 15 10:21:34 aixhost sshd[12345]: Failed password for invalid user testuser from 10.10.10.10 port 54321 ssh2
Jun 15 10:21:36 aixhost sshd[12345]: Connection closed by invalid user testuser 10.10.10.10 port 54321

Key observation:

Logs report “invalid user” instead of VAS/AD authentication attempts
No VAS-specific errors appear
Indicates issue is local AIX auth configuration, not VAS

Fix /etc/security/user to use a valid stanza-based configuration.

Correct example:
default:
        admin = false
        login = true
        su = true
        daemon = true
        rlogin = true
        sugroups = ALL
        admgroups =
        ttys = ALL
        auth1 = SYSTEM
        auth2 = NONE
        tpath = nosak
        umask = 022
        expires = 0
        SYSTEM = "VAS"
        logintimes =
        pwdwarntime = 0
        account_locked = false