Troubleshooting ESXi Authentication Failures Triggered by Automated Tasks

Products

• VMware vSphere ESXi

Issue/Introduction

• Identify when authentication failures (specifically pam_lsass error 40017) are caused by cron-job-based scripts rather than external brute-force attacks.
  
  
• Repeated pam_unix auth failures in system logs immediately following a cron job execution (e.g., /opt/vxutils/data/shutdown_ESX.py).
  

YYYY-MM-DDThh:mm:ss. In(78) crond[2098335]: USER root pid xxxxxx cmd sh /opt/vxutils/data/secure_process.sh ++group=host/vim/vmvisor/vxrail-utils "/opt/vxutils/data/shutdown_ESX.py"
YYYY-MM-DDThh:mm:ss. Wa(84) python[2101824]: pam_unix(vmware-authd:auth): check pass; user unknown
YYYY-MM-DDThh:mm:ss. No(85) python[2101824]: pam_unix(vmware-authd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser=xxxx = z
YYYY-MM-DDThh:mm:ss Er(11) python[2101824]: [module:pam_lsass]pam_sm_authenticate: failed [error code:40017]

 

Environment

VMware vSphere ESXi 8.x

VxRail

Cause

Scheduled tasks executing with expired/misconfigured credentials or Active Directory accounts.

Resolution

1. 1. Identify the script path from the logs (e.g., crond entries).
   2. Check the script directory for configuration files (e.g., /opt/vxutils/data/).
   3. Validate credentials with the AD team.
   4. Reset the account lockout if necessary using pam_tally2.

Best Practice: Custom scripts should have their credentials rotated regularly to match Active Directory policies.