Remediate Password Fails for vCenter Root Account Due to Password Quality Configuration

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

• This article outlines the resolution for issues where the "Remediate Password" function in the SDDC Manager fails to update the vCenter root account, resulting in a disconnected account status. 
• Trying to update vCenter's root password using passwd root fails with "The password contains the user name in some form"
  
  
  
  
• The failure often occurs because the OS-level password quality configuration pwquality.conf rejects the password retrieved from the SDDC Manager database using lookup_passwords utility.

Environment

• VMware Cloud Foundation (VCF) 9.x
• SDDC Manager 9.x
• vCenter Server 9.x

Cause

The password reset operation is blocked by the OS-level password quality configuration on the vCenter appliance. Specifically, the /etc/security/pwquality.conf file is configured with usercheck = 1, which prevents the password from containing the username string. When the SDDC Manager attempts to remediate the password, if the retrieved password matches the username pattern, the passwd command rejects the update.

Resolution

1. Log in to the vCenter Server appliance via SSH.
2. Edit the /etc/security/pwquality.conf file using a text editor: vi /etc/security/pwquality.conf
3. Locate the usercheck directive and set it to 0: usercheck = 0
4. Save the changes and exit the editor.
5. Manually update the root password using the passwd command: passwd root
6. Verify the password update is successful.
7. Return to the SDDC Manager UI and re-initiate the password remediation workflow for the vCenter resource.
8. Once the account status returns to "Active," revert the change in /etc/security/pwquality.conf by setting usercheck = 1 to maintain security compliance.

Additional Information

• If you need assistance, please refer to our main Contact Broadcom Support page.
• To create and manage your support cases, see Creating and Managing Broadcom Support Cases.