Unable to log in to the vCenter with a local account.

Products

• VMware vCenter Server 8.0

Issue/Introduction

When logging in as the root user or another local user, authentication fails even if the correct password is entered.

Environment

VMware vCenter Server 8.0U3g

Cause

 If the control for the pam_unix.so module in /etc/pam.d/system-auth is changed to “required”, login authentication will fail.
This is because the pam_deny.so module has been added at the end of system-auth in newer versions of vCenter.
In previous versions, the control for the pam_unix.so module was “required”. However, in versions where pam_deny.so is added, “sufficient” is the default.

Resolution

Verify the control setting for the pam_unix.so module defined in the following configuration file. If it is set to “required”, use an editor such as vi to change it to “sufficient”.

- /etc/pam.d/system-auth
- /etc/applmgmt/appliance/system-auth

Ex:
----
# Begin /etc/pam.d/system-auth
auth    required      pam_faillock.so preauth
auth    sufficient    pam_unix.so                        # Exit if returns success
auth    required      pam_faillock.so authfail           # Else, record failure
auth    optional      pam_faildelay.so delay=4000000
auth    required      pam_deny.so                        # For failed auths/pam_unix, convert pam_faillock's return value of ignore to login failed.
# End /etc/pam.d/system-auth
----

Note:
When vCenter is restarted, the contents of /etc/pam.d/system-auth are overwritten by the contents of /etc/applmgmt/appliance/system-auth during startup.
Therefore, you must also verify the contents of /etc/applmgmt/appliance/system-auth.

Additional Information

If your vCenter account is locked, you can unlock it by referring to the documentation below.

- Reset the root password in vCenter Server Appliance without reboot / 6.7u1 / 7.x / 8.x
  https://knowledge.broadcom.com/external/article/321369

Japanese KB:
- vCenter にローカルアカウントでログインできません。