Error: Weak password: based on a dictionary word and not a passphrase when changing root password on ESXi

Products

• VMware vSphere ESXi

Issue/Introduction

• Attempting to change the ESXi root password results in the error: Weak password: based on a dictionary word and not a passphrase. Try again.
• The password contains a common string (e.g., "Cisco" or "VMware") followed by numbers/special characters.

Environment

VMware vSphere ESXi

Cause

The ESXi pam_passwdqc module rejects the password because it contains a dictionary substring. By default, the module's implicit match=4 rule strips recognized dictionary strings of 4 or more characters from the total evaluated password length. The remaining string length fails the configured minimum length requirement (N0 parameter) for its effective character class.

Resolution

1. Log in to the vSphere Client.
2. Navigate to Host > Configure > System > Advanced System Settings.
3. Edit Security.PasswordQualityControl.
4. Modify the value to "retry=3 min=8,8,8,7,7 match=0".
5. Change the root password.
6. Revert the setting to default ("retry=3 min=disabled,disabled,disabled,7,7").

Additional Information

Refer to KB article ESXi Password Policy & Account Lockout: Best Practices & Configuration Guide for more information.