NSX upgrade precheck fails due to guestuser1 password expiration
Article ID: 445508
Updated On:
Products
VMware NSX
Issue/Introduction
The NSX upgrade precheck fails due to the expiration .
The alarm shows that user guestuser1 is expired and must be changed.
The password for user guestuser1 must be changed now to access the system. For example, to apply a new password to a user, invoke the following NSX API with a valid password in the request body: PUT /api/v1/node/users/<userid> where <userid> is the ID of the user. If the admin user (with <userid> 10000) password has expired, admin must login to the system via SSH (if enabled) or console in order to change the password. Upon entering the current expired password, admin will be prompted to enter.
- A command-line interface command is not available to modify the password expiration for these specific guestuser1,guestuser2 accounts.
Environment
VMware NSX
Cause
- This is an NSX upgrade blocker and the password needs to be reset to clear the prechecks.
Guest accounts are local user accounts introduced to NSX in version 3.1.1.
These accounts share the default 90-day password expiration policy when enabled.
Resolution
The password expiry for these new users can be changed via REST API.
Optionally, the current password expiry of all local users can be viewed with the following API call:
root@NSXmgr:~# curl -v -k -u 'admin:<admin-password>' -H 'Content-Type: application/json' X GET https://localhost/api/v1/node/users
Please note:
guestuser1 has id of: 10003
guestuser2 has id of: 10004
To change the password expiry of a guestuser, use the following API call :
root@NSXmgr:~# curl -v -k -u 'admin:<admin-password>' -X PUT -H 'Content-Type: application/json' https://localhost/api/v1/node/users/10003 --data-binary '{ "password_change_frequency": 0 }'Note: Above command is all one line.
In the above example we disabled the guestuser1 password expiration by setting the value of password_change_frequency to 0.
Note: You can also decrease or increase the password expiration window by setting the password_change_frequency value to the desired number of days instead of using 0, which disables password expiration.
In the above example we disabled the guestuser1 password expiration by setting the value of password_change_frequency to 0.
Note: You can also decrease or increase the password expiration window by setting the password_change_frequency value to the desired number of days instead of using 0, which disables password expiration.
Additional Information
Feedback
Yes
No
Powered by
