NSX Audit Account Password Reset: "BAD PASSWORD: is too short"

Products

• VMware NSX
• VMware SDDC Manager / VCF Installer

Issue/Introduction

This article details the steps to resolve failures when resetting the audit account password on the VMware NSX Manager appliance.

• Administrators may experience scenarios where the password reset is rejected by the system with the error:
  % Invalid new password: Specified password invalid: BAD PASSWORD: is too short.
• This error persists even when the new password meets the minimum character length requirements.
• Symptoms include the inability to change the audit account password via the UI or CLI.

Environment

• Product: VMware NSX
• Version: 9.0.2.0
• Integration: VMware Cloud Foundation (VCF) / SDDC Manager

Cause

• The NSX appliance password policy enforces strict character validation.
• If the intended password contains characters not supported by the Linux PAM module configuration (such as a caret ^), the system rejects the input regardless of length.

Resolution

To resolve this issue, perform a manual synchronization of the audit account password via the NSX Manager CLI.

Prerequisites:

• Ensure the new password contains only supported special characters (e.g., #, @, !, $, ", *).
• Verify the root-level SSH access to the impacted NSX Manager node is enabled. To enable the root access, refer Enable ssh root access for NSX appliances

Steps:

1. Log in to the NSX Manager appliance (<nsx_manager_fqdn>) as root via SSH.
2. Stop the Management Plane API service to prevent process conflicts or overwrites:

   /etc/init.d/nsx-mp-api-server stop

3. Reset the audit user password:

   passwd audit

   Enter and confirm the new password when prompted. Ensure no unsupported special characters are included.
4. Create the synchronization trigger flag to force the cluster to acknowledge the updated credential:

   touch /var/vmware/nsx/reset_cluster_credentials

5. Restart the Management Plane API service:

   /etc/init.d/nsx-mp-api-server start

6. Verify the password update is successful by logging in via SSH using the audit account.
7. Navigate to the SDDC Manager UI.
8. Locate the NSX Manager entry and select Remediate Password for the audit account to synchronize the SDDC Manager database with the new credentials.

Additional Information

• NSX Admin Accounts Disconnected from SDDC Manager Due to Password Character Restrictions 

• Unable to Rotate NSX Passwords from SDDC Manager Due to Expired Admin/Audit Credentials

• NSX Admin, Root and Audit accounts are in a disconnected state, remediation shows as successful but rotation fails

• NSX Edge Nodes or Managers Disconnected in SDDC Password Management