Root user login failure events in ESXi logging "Cannot login user root@127.0.0.1: no permission"

Products

• VMware vSphere ESXi

Issue/Introduction

On ESXi hosts (specifically those running on HPE hardware) with Lockdown Mode enabled, the following symptoms are observed:

• Multiple login failure events appear in the vSphere Client 'Monitor > Events' tab.
• The /var/run/log/hostd.log file contains entries similar to:
  

  Db(167) Hostd[2099508]: [Originator@6876 sub=Vimsvc.Ticket opID=esxcli-##-### sid=#####] Ticket used: ***e2a6c
  In(166) Hostd[2099508]: [Originator@6876 sub=Vimsvc.HaSessionManager opID=esxcli-##-### sid=#####] Accepted password for user root from 127.0.0.1 - session=#####-###-####-###-#######
  In(166) Hostd[2099508]: [Originator@6876 sub=Vimsvc opID=esxcli-##-### sid=#####] [Auth]: User root
  In(166) Hostd[#####]: [Originator@6876 sub=Vimsvc.ha-eventmgr opID=esxcli-##-### sid=#####] Event ##### : Cannot login user root@127.0.0.1: no permission
  Db(167) Hostd[#####]: [Originator@6876 sub=Vimsvc.HaSessionManager opID=esxcli-##-### sid=#####] Invalid login request for session #####-###-####-###-#######: delaying response for # seconds

   
   
• The /var/run/log/sut.log file records errors indicating permission denials for the HPE Smart Update Tool (SUT):

  In(30) sut[#####]:[ERROR] :: [sutmetadatainterface.cpp:521] :: Unable to perform set bool in RIS for HPSUT
  In(30) sut[#####]: [INFO] :: [global.cpp:1459] :: Console log content for the command (esxcli system maintenanceMode get >& /tmp/stagingdirectory/sutm
  In(30) sut[#####]: maintenancemode.log) is : Error: Permission to perform this operation was denied.

Environment

VMware vSphere ESXi

Cause

The HPE Smart Update Tool (SUT) agent or Agentless Management Service (amsdv) executes "In-Band" management tasks using the local root account via esxcli or vim-cmd. When ESXi is in Lockdown Mode, the root user is restricted from performing operations through management agents unless explicitly exempted. This results in repeated "No Permission" events as the services attempt their scheduled checks.

Resolution

Because SUT is an HPE proprietary component, engage HPE Support to review the Smart Update Tool configuration and investigate if a version update is available that supports Lockdown Mode more natively.

 

Additional Information

HPE STU documentation

Enabling Lockdown Mode on ESXi shows - Cannot login user root@127.0.0.1: no permission events