The special padmin user that IBM tried to make us all use was a big mistake. A vio server is really just an AIX server with a different set of commands. I find it easier to circumvent all of this:

SEED=somegoodhost
scp $SEED:/etc/security/login.cfg /etc/security/login.cfg
chuser su=true login=true rlogin=true shell=/usr/bin/bash root
ln -s /usr/ios/cli/ioscli /usr/sbin/ioscli
chuser shell=/usr/bin/bash groups=staff,buxs rigljoha