Expired Admin Password Changes via VM Console Are Not Saved

Products

• VMware NSX

Issue/Introduction

• You are accessing the NSX Manager CLI from the VM console.
• Upon authenticating with a local account that is expired, the system prompts the user to change the password

  You are required to change your password immediately (password expired).

• Updating the user password in this prompt accepts the new credentials and appears to succeeed.
• The next login attempt fails again with the same "password expired" message.
• This applies to local users such as admin, audit, and root.

Environment

VMware NSX 4.2.x
VCF 9.x

Cause

The issue is caused by a change in behaviour in PAM following a recent upgrade of the library used by the NSX appliance.

Resolution

This is a known issue impacting VMware NSX. Subscribe to this KB article to be updated if a fix version becomes available. 

 

Workaround:

1. Method 1: Update via SSH (Recommended)
   1. Connect to the CLI using an SSH client (e.g., PuTTY, Terminal) rather than the VM Console. The password change prompt via SSH functions correctly.
   2. Initiate an SSH connection to the appliance.
   3. Login with the expired credentials.
   4. Follow the prompts to update the password.
      
      
2. Method 2: Manual Update via CLI (If SSH is Disabled)
   1. If you must use the VM Console (Serial/Direct) or cannot use SSH.
   2. Log in to the CLI as admin (the system will prompt for a password update here).
   3. Once logged in as admin, manually run the password set command:
      

      set user admin password

   4. Follow the prompts to enter and confirm the new password.

Additional Information

To confirm that the password has been successfully updated and the expiration timer reset, run the following commands in the nsxcli:

get user admin status
get user admin password-expiration

Verify that the password-expiration date has moved forward and the account status is active.