Explanation of vCenter Server SSO Account and Root Account Password Storage

Products

• VMware vCenter Server

Issue/Introduction

This article explains where vCenter Server stores the passwords for the SSO account and root account, as well as how they are protected.

Environment

vCenter Server 7.x / 8.x / 9.x

Resolution

 

• Password Storage Location

  • Passwords for the vCenter Server SSO account and root account are not stored in the vCenter Server database (vPostgres).

  • The SSO account password is stored in vmdir and is encrypted using a hash.

  • The root account password is stored in the underlying Photon OS (used by vCenter Server). As with other Linux-based operating systems, it is stored securely in /etc/shadow using standard Linux password hashing mechanisms.

• Security Considerations
  The methods, algorithms, and implementation details used for password storage and encryption are proprietary.
  For security reasons, VMware does not provide additional public documentation or KB articles detailing these internal mechanisms.