VMware Live Recovery: Admin account lockouts due to external security scans.

Products

• VMware Live Recovery

Issue/Introduction

Administrative access to the VMware Live Recovery (VLR) appliance management interface (VAMI) or Web Console is lost due to repeated account lockouts. This occurs even when the password policy is set to never expire.

Symptoms

• The admin user fails to authenticate via Web Console, VAMI, or SSH.
• Log files at /var/log/messages show high-frequency SSH authentication failures.
  
  ####-##-##T##:##:##.######-04:00 s01vpasrm004 sshd[#######]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=####.####.####.####
####-##-##T##:##:##.######-04:00 s01vpasrm004 sshd[#######]: pam_faillock(sshd:auth): User unknown: servicenowlinuxsvc
####-##-##T##:##:##.######-04:00 s01vpasrm004 sshd[#######]: Invalid user servicenowlinuxsvc from ####.####.####.#### port #####
####-##-##T##:##:##.######-04:00 s01vpasrm004 sshd[#######]: error: PAM: User not known to the underlying authentication module for illegal user shoremortgage\\servicenow from ####.####.####.####
####-##-##T##:##:##.######-04:00 s01vpasrm004 sshd[#######]: pam_faillock(sshd:auth): User unknown: shoremortgage\servicenow
  
  

Environment

• VMware Live Recovery 9.x
• External security scanners (e.g., ServiceNow, Nessus)
• Photon OS-based appliance

Cause

The admin account is locked by the pam_faillock security module. This is triggered by a third-party security tool or inventory discovery (such as ServiceNow) attempting to authenticate with incorrect or legacy credentials. In VLR 9.x, the security policy does not automatically unlock the account after a timeout; it requires a manual reset by an administrator.

Resolution

1. Log in to the VMware Live Recovery appliance console as the root user.
2. Execute the following command to reset the failed login counter and unlock the account:
   
   /sbin/faillock --user admin --reset
3. Identify the source IP address(es) from the /var/log/messages file.
4. Update the credentials in the third-party security tool or exclude the VLR appliance from the automated scan scope to prevent recurrence.
5. Verify that the admin account can now successfully authenticate.

Additional Information

• If the root password is also unknown or failing, follow the steps in Reset admin & root account passwords.
• To speak with a customer representative or a Support Engineer see Contact Support.