Reset 'admin' and/or CLI Privilege Mode passwords for NSX Manager, NSX for vSphere 6.3 & 6.4

Products

• VMware NSX for vSphere

Issue/Introduction

The passwords to the 'admin' account and/or the CLI Privilege Mode have been lost, forgotten, or are otherwise unrecoverable.
There are no other CLI users defined for this NSX Manager, or the CLI Privilege Mode password has also been lost, forgotten, or is otherwise unrecoverable.

Environment

VMware NSX for vSphere 6.4.x
VMware NSX for vSphere 6.3.x

Resolution

To reset the password for the 'admin' account and/or the CLI Privilege Mode, use the following steps.

1. Power off the NSX Manager appliance
2. Edit the virtual machine settings and mount a Linux-based LiveCD ISO to the virtual CD/DVD drive, and configure it to Connect At Power On
3. Under VM Options > Boot Options ensure that the option Force BIOS setup is selected
4. Power on the NSX Manager appliance
5. In the BIOS, under the Boot menu, ensure that the CD-ROM Drive is listed above the Hard Drive
6. Exit the BIOS, saving changes
7. Once your LiveCD has booted into a desktop environment, open a Terminal (command line) and switch to the 'root' account
8. To reset the 'admin' password:
   1. Create a directory to mount the appliance root partition:
      # mkdir /mnt/sda2
   2. Mount the appliance root partition:
      # mount /dev/sda2 /mnt/sda2
   3. Create a backup of the shadow file:
      # cp /mnt/sda2/etc/shadow /mnt/sda2/etc/shadow.backup
   4. Make the shadow file writable:
      # chmod u+w /mnt/sda2/etc/shadow
   5. Generate a new password hash (in this example, the placeholder <password> is used):
      # perl -e '$salt = `tr -dc "a-z0-9A-Z" < /dev/urandom | dd bs=1 count=8 2>/dev/null`; $crypt_passwd = crypt("<password>", "\$6\$$salt\$\\"); print $crypt_passwd . "\n"'
   6. Edit the shadow file and replace the password hash for the 'admin' account with the generated hash from Step 5
   7. Save your changes and exit the editor
   8. Remove the write permission for the shadow file:
      # chmod u-w /mnt/sda2/etc/shadow
9. To reset the CLI Privilege Mode password:
   1. Create a directory to mount the appliance common partition:
      # mkdir /mnt/sda6
   2. Mount the appliance common partition:
      # mount /dev/sda6 /mnt/sda6
   3. Create a backup of the passwd file:
      # cp /mnt/sda6/configs/cli/etc/passwd /mnt/sda6/configs/cli/etc/passwd.backup
   4. Generate a new password hash (in this example, the placeholder <password> is used)):
      # perl -e '$salt = `tr -dc "a-z0-9A-Z" < /dev/urandom | dd bs=1 count=8 2>/dev/null`; $crypt_passwd = crypt("<password>", "\$6\$$salt\$\\"); print $crypt_passwd . "\n"'
   5. Edit the passwd file and replace the password hash for the 'admin' account with the generated hash from Step 4
   6. Save your changes and exit the editor
10. Power off the NSX Manager appliance
11. Edit the virtual machine settings and un-mount the Linux-based LiveCD ISO from the virtual CD/DVD drive.
12. If you want to revert back to the default boot order, under VM Options > Boot Options ensure that the option Force BIOS setup is selected
13. Power on the NSX Manager appliance
14. Verify the new passwords by logging into the console of the NSX Manager with the 'admin' account, and then use the enable command to switch to the CLI Privilege Mode.

  Note: If you are still unable to access the CLI mode after the change above and received authentication failed message. You may also need to perform all the steps in section 8 for partition /dev/sda3 if there was an upgrade at some point. 

If you are unable to access CLI Privilege Mode mode/ Enable mode, please verify the passwd has the correct permission. Use the command below to ensure the passwd file has the appropriate read/write permission.

chmod 664 /mnt/sda6/configs/cli/etc/passwd

Workaround:
There is no workaround

Additional Information

Impact/Risks:
The NSX Manager will need to be taken offline for several minutes while the passwords are reset.