How to configure User Account Lockout Policy for vCenter

Products

• VMware vCenter Server

Issue/Introduction

This KB explains how to configure "User Account Lockout Policy" for vCenter.

If the configuration reverts after rebooting the vCenter or restarting its services as described in the referenced document, this KB provides an effective solution.

Environment

VMware vCenter Server 8U3

Resolution

1. SSH to the vCenter

ssh root@<VCENTER_FQDN>

# If the prompt is "Command>", change to the shell mode
shell

2. Update faillock.conf

# 1. Backup
cp -p /etc/applmgmt/appliance/faillock.conf /etc/applmgmt/appliance/faillock.conf-`date +%F_%H:%M:%S`.back

# 2. Edit
vi /etc/applmgmt/appliance/faillock.conf

# 3. Restart applmgmt
service-control --restart applmgmt
service-control --status applmgmt

# 4. Update will be reflected on /etc/security/faillock.conf
cat /etc/applmgmt/appliance/faillock.conf
cat /etc/security/faillock.conf

3. Update system-password

# 1. Backup
cp -p /etc/applmgmt/appliance/system-password /etc/applmgmt/appliance/system-password-`date +%F_%H:%M:%S`.back

# 2. Edit
vi /etc/applmgmt/appliance/system-password

# 3. Restart applmgmt
service-control --restart applmgmt
service-control --status applmgmt

# 4. Update will be reflected on /etc/pam.d/system-password
cat /etc/pam.d/system-password
cat /etc/applmgmt/appliance/system-password

Additional Information

Japanese version: vCenter Server の root ユーザーアカウントロックアウトポリシー の変更方法