Accessing NSX appliances via SSH or CLI with non system local users such as AD users fails.

Products

• VMware NSX

Issue/Introduction

• Attempting to access NSX appliances (NSX Managers or Edges) via CLI or SSH with non system generated local user accounts gives an access denied error or the the session resets. This includes remote users such as AD users and added local users. 
• The authentication fails, and the following log entries are recorded in /var/log/auth.log on the NSX Manager/Edge:

  • - pam_unix(sshd:auth): authentication failure; 
    - Failed password for invalid user user <Username> from <source IP> port <source port> ssh2

Environment

All versions of VMware NSX and VMware NSX-T Data Center.

Cause

Only the system generated local user accounts are able to access the NSX appliances via SSH and CLI. These accounts are documented within the admin guide - NSX Admin guide 3.2 - Managing Local User Accounts as admin, audit and root.
Local accounts that have been added by users are also not allowed to access the CLI.

Resolution

Use the local system user accounts to access the NSX appliances directly (admin recommended for administration tasks).

Additional Information

The ability to add local users is only available in 4.1 onwards (Admin guide 4.1 - Adding local users).