Passwords show as expired, even after updating them in Fleet Management for NSX Manager

Products

• VCF Operations

Issue/Introduction

• VCF Operations displays an alert for NSX Manager passwords having expired.
• Password have been changed using the 'Update' button under Fleet Management and can log in as root, admin and audit using the updated passwords.
• However the web interface still shows them as expiring today, and hence alerts are present.
• Passwords have not been changed manually on the nodes.
• Passwords have been set to never expire via CLI directly on the nodes.

Environment

VCF Operations 9.1
NSX 9.1

Cause

VCF 9.x is designed with a secure-by-default architectural posture. This framework enforces periodic password rotation for all managed core components to align with modern security standards.

• The internal schema does not support a null or zero (0) value for expiration timers.
• "Never Expire" is not a supported architectural state for core SDDC components within the automated lifecycle management engine

Resolution

1. Set the password expiry to 90 days for root, audit and admin on all NSX Manager nodes.
2. Open an SSH session to all the NSX nodes:
   

   1. Confirm the password expiration is disabled: get user <USER_NAME> password-expiration

   2. Set a new 90-day period: set user <USER_NAME> password-expiration 90

   3. Verify the expiry has been updated: get user <USER_NAME> password-expiration


3. It can take several hours for the change to reflect in the VCF Operations UI.

 

Note: Do not use the value 9999, as VCF 9x parses this as "none". Use 9998 or a lesser value that adheres to organizational security policies. 

Additional Information

See Configuring Password Expiration and Rotation in VMware Cloud Foundation (VCF) 9.x for more details.