Thanks to Chris Colotti, I learned of a new VMware KB article today which could potentially have wide spread impact, particularly in lab, development, or proof of concept environments. The VMware KB article number is 2069041 and it is titled The vCenter Server Appliance 5.5 root account locked out after password expiration.
In summary, the root account of the vCenter Server Appliance version 5.5 becomes locked out 90 days after deployment or root account password change. This behavior is by design which follows a security best practice of password rotation. In this case, the required password rotation interval is 90 days after which the account will be forcefully locked out if not changed.
The KB article describes processes to prevent a forced lockout as well as unlocking a locked out root account.
Approximately 90 days have elapsed since the release of vSphere 5.5 and I imagine this issue will quickly begin surfacing in large numbers where the vCenter Server Appliance 5.5 has been deployed using system defaults.
Update 6/16/16: For more information on vCenter Server Appliance password policies, including the local root account, check out vCSA 6.0 tricks: shell access, password expiration and certificate warnings.
Trackbacks /
Pingbacks