Lockdown mode - cannot login user root alerts come up for the ESXi host.
Article ID: 386459
Updated On:
Products
Issue/Introduction
-
After enabling lockdown mode on ESXi 8.0 U3c and U3d, the following error shows in the host events every 5 minutes:
"Cannot login user [email protected]: no permission." - In the hostd.log file:
<YYYY-MM-DD>T<time> In(166) Hostd[2098855]: [Originator@6876 sub=Vimsvc.HaSessionManager opID=515efd15 sid=521edb9c] Accepted password for user root from
127.0.0.1 - session=521edb9c-6c6a-255c-2c1c-ba7362cf600a
<YYYY-MM-DD>T<time> In(166) Hostd[2098855]: [Originator@6876 sub=Vimsvc opID=515efd15 sid=521edb9c] [Auth]: User root
<YYYY-MM-DD>T<time> Wa(164) Hostd[2098855]: [Originator@6876 sub=Vimsvc opID=515efd15 sid=521edb9c] Refresh function is not configured.User data can't be
added to scheduler.User name: root
<YYYY-MM-DD>T<time> In(166) Hostd[2098855]: [Originator@6876 sub=Vimsvc.ha-eventmgr opID=515efd15 sid=521edb9c] Event 10389 : Cannot login user root@127.
0.0.1: no permission
<YYYY-MM-DD>T<time> In(166) Hostd[2098864]: [Originator@6876 sub=Solo.Vmomi] Activation finished; <<521edb9c-6c6a-255c-2c1c-ba7362cf600a, <TCP '127.0.0.1
: 8307'>, <TCP '127.0.0.1 : 22764'>>, ha-sessionmgr, vim.SessionManager.login, <vim.version.v8_0_3_0, internal, 8.0.3.0>, [N11HostdCommon18VmomiAdapterServer
19ActivationResponderE:0x00000013e62e2be8]>
<YYYY-MM-DD>T<time> Db(167) Hostd[2098864]: [Originator@6876 sub=Solo.Vmomi] Arg userName:
<YYYY-MM-DD>T<time> Db(167) Hostd[2098837]: --> "local-root"
<YYYY-MM-DD>T<time> Db(167) Hostd[2098864]: [Originator@6876 sub=Solo.Vmomi] Arg password:
<YYYY-MM-DD>T<time> Db(167) Hostd[2098837]: --> (not shown)
<YYYY-MM-DD>T<time> Db(167) Hostd[2098837]: -->
<YYYY-MM-DD>T<time> Db(167) Hostd[2098864]: [Originator@6876 sub=Solo.Vmomi] Arg locale:
<YYYY-MM-DD>T<time> Db(167) Hostd[2098837]: --> "en"
<YYYY-MM-DD>T<time> In(166) Hostd[2098864]: [Originator@6876 sub=Solo.Vmomi] Throw vim.fault.NoPermission
<YYYY-MM-DD>T<time> In(166) Hostd[2098864]: [Originator@6876 sub=Solo.Vmomi] Result:
<YYYY-MM-DD>T<time> In(166) Hostd[2098837]: --> (vim.fault.NoPermission) {
<YYYY-MM-DD>T<time> In(166) Hostd[2098837]: --> object = 'vim.Folder:ha-folder-root',
<YYYY-MM-DD>T<time> In(166) Hostd[2098837]: --> privilegeId = "System.View",
<YYYY-MM-DD>T<time> In(166) Hostd[2098837]: --> msg = "",
<YYYY-MM-DD>T<time> In(166) Hostd[2098837]: --> }- When the host is in lockdown mode, the 'root' user will be removed and vsan_health plugin won't be able to login to hostd.
Hence, instead of root user we need to use vpxuser for vsan_health plugin hostd login. - Disabling this `vsan_health` plugin and restarting healthd should stop the events.
Environment
VMware vSphere ESXi 8.0 U3c and U3d.
Cause
This is a known issue introduced in ESXi 8.0 U3c, where the vsan_health plugin, which runs every 5 minutes to capture the vSANmgmt daemon's health, attempts to log in to Hostd as the root user to retrieve vSAN stubs. When the host is in lockdown mode, the root user is disabled, leading to the following error.
Resolution
Workaround:
Disable the vsan_health plugin on the host, via command:
- configstorecli config current set -c esx -g health -k vsan_health --path "enabled" --value False
Restart the healthd via command:
- /etc/init.d/health restart
Engineering has addressed the issue, and a patch will be made available soon.
This issue is scheduled to be fixed in vSphere 8.0 P05
Additional Information
The host will perpetually fill up with Cannot login user [email protected]: no permission events, thereby obstructing other important events from populating in the events tab.
Similar error message could be due to the following issues detailed in Broadcom knowledge base articles listed below :
Enabling Lockdown Mode on ESXi shows - Cannot login user [email protected]: no permission events
User [email protected] logged in as hbr-agent messages are filling up host event logs
Feedback
