Recreating a Compromised /etc/vmware-vpx/ssl/symkey.dat File

Products

• VMware vCenter Server

Issue/Introduction

• Due to a previous security event, the vpxuser password was compromised and needs to be rotated.
• To avoid further risk of vulnerability, it is desired to recreate the /etc/vmware-vpx/ssl/symkey.dat file.

Environment

vSphere 7.0
vSphere 8.0
vSphere 9.0

Cause

The /etc/vmware-vpx/ssl/symkey.dat file contains the Advanced Encryption Standard (AES) symmetric key that the vCenter Server (vpxd service) uses to encrypt and decrypt highly sensitive data stored in the vPostgres database. Most notably, it encrypts the vpxuser credentials, which vCenter uses to maintain root-level access to all connected ESXi hosts. If it is suspected that threat actors have acquired this file, it raises the possibility of decrypting those host passwords and gaining access to management of those hosts.

Resolution

Do not manually edit or change the /etc/vmware-vpx/ssl/symkey.dat file

If you attempt to recreate or overwrite the file manually, the new key will not match the encrypted data currently sitting in your database. The vpxd service would crash on startup, vCenter can be permanently corrupted, and it can lose the ability to authenticate to any of your ESXi hosts.

To recreate this file (likely in the case of concern that it is compromised), a full reinstall of vCenter is needed. When you connect a host to the new vCenter, the system will automatically generate a brand-new vpxuser password on the ESXi host and encrypt it using the new symkey.dat in the new database.

(Note: If you attempt to restore from a file-based backup, the backup will simply restore the exact same symkey.dat that your security team considers compromised. A full redeployment is the only way to rotate the key.)