NSX Manager root password needs to be reset
search cancel

NSX Manager root password needs to be reset

book

Article ID: 416526

calendar_today

Updated On:

Products

VMware NSX

Issue/Introduction

  • Unable to SSH with root, as SSH access attempts using root credentials consistently yield an "Access Denied" error, despite verification via get service ssh (executed in administrator mode) confirming that "Root login" remains enabled.
nsx-mngr> get service ssh
MM DD YYYY UTC HH:MM:SS.###
Service name:      ssh
Service state:     running
Start on boot:     True
Root login:        enabled
  • Attempts to log into the web console with root credentials also fail, returning an "Access Denied" message.
  • Direct confirmation of the password's status was obtained by executing get user root password-expiration (in administrator mode), which explicitly indicates that the root password has expired.
nsx-mngr> get user root password-expiration
MM DD YYYY UTC HH:MM:SS:###
Password expires 90 days after last change,
 Current password is expired.
User will receive warning messages 7 days before password expires.

Environment

VMware NSX

Cause

Expired or lost password for the NSX Manager "root" account.

Resolution

Steps to reset root user password via GRUB;

  1. Connect to the console of the appliance.
  2. Reboot the system.
  3. When the GRUB boot menu appears, press the left SHIFT or ESC key quickly. If you wait too long and the boot sequence does not pause, you must reboot the system again.
  4. Press e to edit the menu.
  5. Choose the top Ubuntu line then enter the user name root and the GRUB password for root (not the same as the appliance's user root). The default password is NSX@VM!WaR10
  6. Press e to edit the selected option.
  7. Search for the line starting with linux and add systemd.wants=PasswordRecovery.service to the end of the line.
  8. Press Ctrl-X to boot.
  9. When the log messages stop, enter the new password for root.
  10. Enter the password again. The boot process continues.
  11. After the reboot, verify the password change by logging in as root with the new password.
  12. In a 3 node NSX Manager cluster the procedure needs to be followed on one Manager only. After a few minutes this new root password will sync to the other two managers.
  13. If the passwords do not sync even after waiting for 5-10 minutes, then follow this KB https://knowledge.broadcom.com/external/article/317192

Note: If a custom GRUB root password was set when the Manager was deployed, and it has since been lost, then it is necessary to redeploy the NSX Manager.
Follow the Resolution steps in NSX manager node(s) are down in the cluster after issues with storage/vSAN partitioning for this. 

In a 3-node cluster, the reset only needs to be performed on one node and will sync to the others.

Additional Information

Techdocs: Resetting the Passwords of an Appliance

  • The same process is followed to reset the root password.
  • This resolution method for an expired root password is also applicable in instances where the password has been forgotten.
Powered by Wolken Software