Error: "Password Expired" During SSH Authentication to VCF Automation or VCF Identity Broker

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• The vmware-system-user account status displays as "Disconnected" within the Fleet Management interface of VCF Operations.
  
  
  
  
• SSH authentication to the appliance returns a "password expired" prompt.
  
  
• VCF Operations Fleet Management shows status "Disconnected" for VCF Automation or VCF Identity Broker.
  
  
• Attempting to update the password via the UI fails, returning Error Code: LCMVMSP10019 and "SshAuthenticationFailureException" error message:

  Error Code: LCMVMSP10019
  com.vmware.vrealize.lcm.util.exception.SshAuthenticationFailureException: Cannot execute SSH commands. Verify the SSH login credentials.
  Caused by: java.lang.RuntimeException: Cannot create session for ssh://vmware-system-user@####
   at com.vmware.vrealize.lcm.util.SessionHolder.newSession(SessionHolder.java:57)
   at com.vmware.vrealize.lcm.util.SessionHolder.<init>(SessionHolder.java:37)
   at com.vmware.vrealize.lcm.util.SshUtils.execute(SshUtils.java:694)
   ... 8 more
  Caused by: com.jcraft.jsch.JSchException: Auth fail for methods 'publickey,password,keyboard-interactive'
   at com.jcraft.jsch.Session.connect(Session.java:501)
   at com.vmware.vrealize.lcm.util.SessionHolder.newSession(SessionHolder.java:53)
   ... 10 more

Environment

•   VMware Cloud Foundation 9.x
•   VCF Automation
•   VCF Identity Broker

Cause

This issue occurs due to a local security policy enforced by the Linux-based virtual appliance, which dictates a maximum password age. If the vmware-system-user password is not rotated before this configured time limit, the account expires. Consequently, Fleet Management is unable to establish the necessary SSH sessions required to perform automated lifecycle tasks.

Resolution

Note: The following steps require making low-level changes to the system. Review the commands carefully before execution to prevent unintended system disruption.

To fix the password expiration and restore access, perform the following steps:

1. Log in to the affected VM console via the vSphere Web Client.
   
   
2. Enter GRUB mode by following the steps in KB 325916.
   
   
3. Check the current expiration status:
   chage -l vmware-system-user


4. Set the account to never expire:
   chage -m 0 -M -1 vmware-system-user


5. Reset the password to the cluster-standard credential:
   passwd vmware-system-user


6. Reboot the VM:
   reboot -f


7. Navigate to VCF Operations UI > Fleet Management > Passwords, select the account, and click Update Password.
   
   
8. Trigger an inventory sync for the component.

Additional Information

If you require further assistance, Contact Broadcom Support. Visit the Contact Support portal.