Last week I wrote about a new security feature in the new VCSA 5.5 where the administrator account (root) password will now expire automatically after 90 days of powering on the VCSA if the password is not changed before then. This new enhancement is to ensures that administrative passwords are rotated routinely for good security practices. However, in the event that you forget to change the password before the expiration, you can still recover the VCSA and this article will walk you through that process.
As a lab exercise, I have configured my root password to expire in one day and purposely let it expire. If you try to login to the VAMI UI, you will get an "Unable to authenticate user" error and you will see something similar if you login to the SSH console. Ideally, this message should be a bit more descriptive to say something like the password has expired (which I have filed an internal bug for).
Requirements:
- You will need console access to your VCSA
- You will also need a Linux LiveCD, I personally like using KNOPPIX
Step 1 - Mount the Linux LiveCD to your VCSA and boot into the image. You will need to bring up a terminal shell. The version I am using has a menu and I just select the "shell" option.
Step 2 - Once you are in the terminal, you will need to switch to the root user by running the following command:
su -
Step 3 - Next, we need to mount the VCSA root partition which will be /dev/sda3 to /mnt directory by running the following command:
mount /dev/sda3 /mnt
Step 4 - We now need to edit /etc/shadow file on our VCSA which is located in /mnt/etc/shadow to disable the account lock. You will need to use an editor such as vi to open up the file.
You need to delete "x" in the 2nd field and the numeric value on the 5th field (if it exists, this should be the number of days for expiration, default is 90) for the root user account. The screenshot above shows what values needs to be deleted. Once you have made the changes, go ahead and save the file.
Step 5 - Reboot the VCSA and now you can login to both the VAMI UI interface as well as the SSH console.
Note: If you had the password expiration feature enabled, it has now been disabled for you to login. If you wish to re-enable it, you will need to configure it in the VAMI UI or through the CLI. Please refer to this article here for more details.
There had better be another bug submission for this thing: there has GOT to be a better way to recover/reset this password, or the support team will be fighting a rearguard action starting 90 days after this thing goes GA.
This post is certainly helpful, and I'm sure it'll end up getting reproduced as a KB article, but this is practically 180 degrees from the supposed ease & simplicity of using the VCSA over the Windows vCenter Server.
Jim,
Thanks for your feedback, I hear an official KB will be created 🙂 I'll pass along your feedback to the engineering team. Though the recovery may not be ideal, I think this should also motivate folks on putting processes in place for password rotation in general. We've done a lot on the virtual appliances to ensure they're more secure OOTB. Definitely something new, but that's one of the reason I shared this article was to educate customers about the change and you have the ability to extend the expiry or completely disable it.
I haven't got a VCSA to hand but can't you just boot into single-user mode by interrupting Grub and appending 'single' to the kernel boot line, then update the password using 'passwd'?
Will.
no, that will not work. Though there is a GRUB password which you can provide and boot into single user mode. It still requires you to login with the root account and since that password has expired, it will not allow you in which is what I found from quickly testing it
I've just run into this issue with a VCSA 5.5 Beta2 installation.... I thought it had been upgraded, but it seems not.
Instead of booting a rescue CD, edit the GRUB boot and add the following to the kernel line.
init=/bin/sh
So that's:
p (for password)
vmware
[down arrow]
e (for edit)
init=/bin/sh
[enter]
b (for boot)
at the # prompt, edit shadow to remove the x and set account to non-expiring.
vi /etc/shadow
chage -M -1 -E -1 root
You guys are just Awesome
is there a way to disable "complex" password requirements?