Reset vcf and/or root user password expired in SDDC Manager

Products

VMware Cloud Foundation

Issue/Introduction

This article provides instructions on how to reset the passwords of the vcf and root user accounts for SDDC Manager.

The following error can be seen if the root password is expired:

You are required to change your password immediately (password expired)
su: Authentication token manipulation error

The following error can be seen if the root password is unknown or forgotten:
```
su: Authentication_failure"
```

Environment

VMware Cloud Foundation 4.x
VMware Cloud Foundation 5.x
VMware Cloud Foundation 9.x

Resolution

To reset the passwords, take the following steps:

Login to the vCenter UI (vSphere Client) and find the SDDC Manager virtual machine (VM).
Select the SDDC Manager VM and in its Summary tab find the Related Objects tile to identify which on which ESXi host it is running. Note down the ESXi FQDN.
Open a new browser tab and open the URL of the host client UI for this ESXi (https://<host_fqdn>/ui). Login with the root account of the host.
Click on Virtual Machines, identify the SDDC Manager VM and click on it, then on the VM summary page, select Edit.
In The Edit settings interface, switch to the VM Options tab and expand Boot Options
Change the value for Boot Delay to 10000 milliseconds and close the wizard using the [ SAVE ] button.
Back in the VM summary page, select Console to open a VM console.
On the upper right-hand side of the console there is a button that says Actions. Click on this button, then select Power → Reset.
As soon as the Photon start screen appearss, press the 'e'' key to access into the GRUB interface.
Use the arrow keys to navigate to the line beginning with linux and add the following string to the end of the line:
```
rw init=/bin/bash
```
Example:
Press the F10 key to continue booting the VM.
Run the following commands to unlock the vcf and root accounts:
- For VCF versions 4.3.0.0 up until 5.0.0.1, use:
```
# /usr/sbin/pam_tally2 -u root -r
# /usr/sbin/pam_tally2 -u vcf -r
```
  Example:
- For VCF versions starting from 5.1.0.0, use:
```
# /usr/sbin/faillock --user root --reset
# /usr/sbin/faillock --user vcf --reset
```
Note: If there are any failures, use the up arrow key to re-run the command until the failures column shows 0.
Run the following commands to set temporary passwords for the accounts:
```
# passwd vcf
# passwd root
```
Now reboot the SDDC Manager VM by running the following command:
```
# reboot -f
```
Wait a few minutes to allow the boot process to proceed, then open an SSH connection with the SDDC Manager and login with the vcf account using the temporary password selected in the last step.
Run the command:
```
# su root
```
and enter the temporary password assigned to the root user to switch into the root user context.
Then run the following command to clear the passwords:
```
echo "" >/etc/security/opasswd
```
Now reset the accounts to new passwords or a password previously used by using commands mentioned in Step 13.
Note: Make a note of what the vcf and root passwords were changed to.
If desired, change the maximum password age for the accounts with:
```
# chage -M 999 vcf
# chage -M 999 root
```
Confirm that the root account has a password expiration date set with:
```
# chage -l root
```

Additional Information

In some situations, the # su root command in Step 15 might fail due to the system still recognizing its password as expired, even after it was already reset.
For Example:

vcf@vcenter01 [ ~ ]$ su root
Password:
Your account has expired; please contact your system administrator.
su: User account has expired

This can happen when even though the password was changed in the console, the system still "remembers" that the account was expired. This can occur due to the operating system blocking the login due to the account's aging policy before even verifying if the provided password is correct.
To remediate this, force the account to be unexpired with the following steps:

Repeat the origial steps 4 to 11 as outlined further above.
Force the account to never expire temporarily in order to reset the expiry time which is currently blocking the login:
```
# chage -I -1 -m 0 -M 99999 -E -1 root
```
Ensure that the account is not locked from the Authentication failure.
- For VCF versions 4.3.0.0 up until 5.0.0.1, use:
```
# /usr/sbin/pam_tally2 -u root -r
```
- For VCF versions starting from 5.1.0.0, use:
```
# /usr/sbin/faillock --user root --reset
```
Verify the account status. Run the following command and review the Password expires line:
```
# chage -l root
```
Reboot the appliance with:
```
# reboot -f
```