Admin account lockout policy for the NSX Edge and Manager nodes

Products

• VMware NSX

Issue/Introduction

After a number of failed login attempts, the NSX Manager or Edge node automatically locks out the user.

Environment

VMware NSX

Cause

By default, the lockout is triggered after 5 failed attempts and the lockout period is 900 seconds (15 minutes).

The NSX lockout policy is a security feature that disables a user account when a certain number of failed login attempts occur due to wrong passwords within a certain interval of time.

Notes:

• During a lockout period, if a failed login attempt occurs, the lockout period will reset.
• After the lockout period expires (without any failed login attempts), the account is automatically unlocked.

Resolution

Note:  All commands provided below are run at the central CLI of an NSX Manager or Edge Node, using the 'admin' account for access. 

1. The account lockout policy can be checked using this command:
   
   For CLI -
   get auth-policy cli lockout-period
   
   For API -
   get auth-policy api lockout-period
   
   
2. To set the lockout period, use the set auth-policy cli lockout-period command.
   
   For example, to set the lockout period to 2 minutes (120 seconds):
   
   For CLI -
   set auth-policy cli lockout-period 120
   
   For API -
   set auth-policy api lockout-period 120
   
   
3. You can also set the Number of authentication failures to trigger lockout with this command.
   
   For example, setting it to two failed attempts:
   
   For CLI -
   set auth-policy cli max-auth-failures 2
   
   For API -
   set auth-policy api max-auth-failures 2
   

Additional Information

Configure the Local User Account Lockout Policy for NSX Manager