Quick Tip - Automating ESXi local user passwords using SHA512 encrypted hashes

For those that automate their ESXi installations using Kickstart aka ESXi scripted installation should be quite familiar with the ability to configure the root password as part of the installation. As described in the official ESXi documentation, the --rootpw option can either contain a plain text password (not recommended) or with the use of the additional --iscrypted option, a SHA512 hash of the password can also be used, which is definitely recommended and more secure.

However, when managing additional local users via ESXCLI system account, which I recently blogged about here, I noticed that you can only provide a plain text password either on the command-line (not recommended) or interactively, which prevents this process from being automated. As mentioned in the blog post, you could store the password and the commands into another script file and this will at least hide the password from being stored in the ESXi Shell log file (/var/log/shell.log) but this is far from ideal.

While sharing this feedback with Engineering as part of a feature enhancement request, I came to learn about a nice little utility that can be used with both ESXi 7.x and 8.x that can update local user by simply providing the encrypted SHA512 hash.

The utility is called chpw and accepts the local ESXi user which you wish to update the password and the SHA512 hash which is read from stdin, so using simple "echo" command would suffice.

Here is an example, assuming your SHA512 hash is stored in the $HASH variable and local username is admin321, you can update user password hash by running the following command:

echo $HASH | /usr/lib/vmware/auth/bin/chpw admin321

As you see, this can easily be integrated into your existing ESXi kickstart and is more secure and a pretty common method for adding additional local users by specifying the encrypted hash rather than using a plaintext password.

Note: There are a number of different ways of generating the SHA512 encrypted hash (quick search online will yield multiple options), but the easiest method is to manually configure a password for an account and then copy out the hash from the /etc/shadow file.