Setting an ESXi password fails with the error: Weak password: based on a dictionary word and not a passphrase
book
Article ID: 323600
calendar_today
Updated On:
Products
VMware vSphere ESXi
Issue/Introduction
Symptoms:
Attempting to change an ESXi password fails with the error message:
A general system error occurred: Weak password: based on a dictionary word and not a passphrase.
Password does not appear to contain any dictionary word and meets the password requirements. For more information, see the ESXi Passwords and Account Lockout section in the vSphere Security Guide.
Environment
VMware vSphere ESXi 6.0
Cause
ESXi uses pam_passwdqc for password management and control. This issue occurs when the password requirements are not met.
Resolution
To resolve this issue, use a password that meets the pam_passwdqc requirements. For more information, see the Linux man page pam_passwdqc.
Note:If you find a link is broken, please provide feedback.
Additional Information
The password validation is not as simple as searching words. It is a complex process that checks for partial strings of words and checks the strings in reverse.
During a password validation:
1. The password is checked against a list of 4000+ dictionary words. You see an error if the password contains any of these words.
2. If the password does not contain any dictionary word, the module checks if the password and any of dictionary words has a common string of specified length (default 4).
3. If there is a common string, the module removes it from the password, and then tests if the remainder of the password meets the complexity requirement.
4. The module then reverses the password and repeats steps 1-3.