Error: pam_passwdqc: Error parsing parameter "min=..." during password change in VMware ESXi

Products

• VMware vSphere ESXi

Issue/Introduction

When attempting to change a user password (including root) on an ESXi host, the task fails with a critical error. This occurs when the password complexity requirements defined in the PAM configuration or Advanced System Settings are syntactically incorrect.

• Running passwd results in: pam_passwdqc: Error parsing parameter "min=N0,N1,N2,N3": Invalid parameter value.
• Error message: passwd: Critical error - immediate abort
• Manual changes to /etc/pam.d/passwd do not persist after a reboot.

Environment

• VMware ESXi 7.0.x
• VMware ESXi 8.0.x

Cause

The pam_passwdqc.so module requires the min parameter to contain exactly five positional integer values (e.g., min=N0,N1,N2,N3,N4), representing different character class requirements. Providing fewer than five values, or using invalid characters/spaces, causes a parsing failure.

Resolution

Do not manually edit /etc/pam.d/passwd, as these changes are not persistent. Instead, use the ESXi Advanced System Settings.

1. Log in to the VMware Host Client or vCenter Server.
2. Select the affected ESXi host and navigate to Configure > System > Advanced System Settings.
3. Locate the key Security.PasswordQualityControl.
4. Edit the value to ensure the min parameter has five comma-separated values.
   • Example for 4 character classes and 15 character minimum: retry=3 min=disabled,disabled,disabled,disabled,15
   • Default value: retry=3 min=disabled,disabled,disabled,7,7
5. Click OK to save the changes.
6. Verify the fix by running the passwd command from the ESXi CLI.

Additional Information

• For more details on password requirements, see ESXi Passwords and Account Lockouts
• If you are unable to access the UI, see Contact Broadcom Support