Reset root password without rebooting - vCenter Server Appliance

Products

• VMware vCenter Server

Issue/Introduction

This article provides procedures to reset a lost or forgotten root password for vCenter Server Appliance (VCSA) versions 6.7 Update 1, 7.x, 8.x, and 9.x without requiring a system reboot.

• For versions prior to VCSA 6.7 Update 1, see Resetting root password in vCenter Server Appliance 6.5 to 6.7 U1.

• Logging in to the root account of vCenter Server Appliance (VCSA) fails.

• Forgot the root password.

Note: The above symptoms can also occur on an external Platform Services Controller (PSC) running on vSphere 6.5 and 6.7.

Environment

• VMware vCenter Server Appliance 6.7 U1

• VMware vCenter Server 7.x

• VMware vCenter Server 8.x

• VMware vCenter Server 9.x

Cause

Failure to log in as the root user on the vCenter Server Appliance typically stems from one of the following two scenarios:

1. Forgotten Root Password: The root password has been lost, and the administrator does not have a record of the current credentials.

2. Expired Password Policy: By default, VMware root passwords expire after 90 days. If unchanged, the account locks and blocks authentication, even with the correct password.
   
   Note: These symptoms can also occur on an external Platform Services Controller (PSC) running on vSphere 6.5 and 6.7.

Resolution

• With the change within VCSA 6.7 U1, the SSO user who is part of SystemConfiguration.BashShellAdministrator group will be able to log in to Bash shell and can call any commands using sudo and without password.

• This aims at reducing the gap between the root and SSO administrator user. The user has to enable shell to log in to the bash shell. By default, the user will be logged into VCSA appliance shell.

• For passwords that have expired, the default vCenter Server Appliance password expires after 90 days. For more information, see Change the Password and Password Expiration Settings of the Root User.

• If the current root password is known, an SSH session to the vCenter server VM can be made and the user will be prompted to change the root password. This must be completed in 30 seconds before the authentication attempt times out.

• If it is not possible to complete the password change in 30 seconds, the steps below can be used.

The resolution contains two sections for the problem that is usually encountered:

1. Steps to reset the Root Password in VCSA

1. 1. Connect SSH to VCSA and login using [email protected] where vsphere.local is your default SSO Domain. ​​​​​

   2. If first time logging in, enable shell then enter shell.

      shell.set --enable true

      shell

      

   3. Once in shell as sso-user, run the below command to change to root shell.

      sudo -i

   4. Unlock the 'root' account using below command if it is already locked due to multiple logins with incorrect password.

      pam_tally2 --user=root --reset

      

      For 8.0 U2 onwards:

      /usr/sbin/faillock --user root --reset

       Note: pam_tally2 is deprecated in Photon 4, use faillock instead

      1. Then once in root shell, run passwd to change the root password.

         passwd

      2. Login to the vCenter Server Appliance using the new root password.

2. Steps to follow if you have forgotten the Root Password:

1. 1. Follow Steps 1 and 2 from Section A.

   2. Then continue by running the following steps: 

      1. Run the following command in bash shell to change the root password.

         sudo passwd root

         New password:

         Retype new password:

         passwd: password updated successfully 

      2. Login to vCenter Server Appliance using the new root password.

         sudo -i
Password:
Connected to service

             * List APIs: "help api list"
    * List Plugins: "help pi list"
    * Launch BASH: "shell"

Note: The root password can be set to never expire in order to prevent this issue by running command:

chage -I -1 -m 0 -M 99999 -E -1 root  or at the VAMI  ( https://<vcenter_fqdn>:5480)

Note: If the issue persists, see Unable to log in to the vCenter Server Appliance shell using root account even after password reset

Additional Information

To update the password of the root user in the vCenter Server via appliance shell  if account is not locked

1. Access the appliance shell and log in as a user who has a super administrator role. The default user with a super administrator role is root.

2. Login using [email protected] where vsphere.local is your default SSO Domain. ​​​​​

3. Run the localaccounts.user.password.update --username user name --password command.
   

   1. localaccounts.user.password.update --username root --password

   2. Enter and confirm the new password when prompted.

More information on Managing vCenter local user accounts: Managing Local User Accounts in vCenter Server.

Managing vCenter password policy: Change the Password and Password Expiration Settings of the Root User

Useful logs for troubleshooting re-lockouts:/var/log/audit/sshinfo.log