http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2069041#preventlockout

This behavior affects vCenter Server Appliance 5.5.

Prevent forced lockout when the root account is still active

If the root account is still accessible through the vCSA console or via the secure shell (SSH), you can prevent this issue from occurring by modifying the /etc/cron.daily/pass-expiration script.

To prevent the forced lockout when the root account is still active:

  1. Log in to the vCSA as the root user.

  2. Open the /etc/cron.daily/pass-expiration script in a text editor.

  3. Replace the commands at the bottom of the script to replace the forced lockout with a forced password change:


    1. Delete these commands:

      # disable the password if it's time and not already done.
      # don't rely on the pam account facility. prepend an x in the shadow file.
      if [ $TODAY -ge $DEADLINE ] && ! grep -q 'root:x' $SHADOW; then
         sed -e 's/^root:\(.*\)/root:x\1/' $SHADOW -i
      fi

    2. Enter these commands:

      # force a password change for root if we've reached the password expiration date.
      # pam.unix2 doesn't do this the way we would like, so we do this instead.
      if [ $TODAY -ge $DEADLINE ]; then
         chage –d 0 root
      fi

  4. Save and close the file.


Unlocking a locked out root account

If the root account is not accessible via the console, the secure shell, and the Virtual Appliance Management Interface (VAMI), the root account has been inactivated due to password expiration. To reactivate the root account, the vCSA must be rebooted and the kernel option modified in the GRUB bootloader to obtain a root shell.

To reactivate the root account:

  1. Reboot the vCSA using the vSphere Client.

  2. When the GRUB bootloader appears, press the spacebar to disable autoboot.



    Note: If the time between when you power on the virtual machine and when it exits the BIOS or EFI and launches the guest operating system is too short, you can adjust the delay. For more information, see Delay the Boot Sequence in the vSphere Client in thevSphere Single Host Management guide.

  3. Type p to access the appliance boot options.

  4. Enter the GRUB password.

    Note:

  • If the vCSA was deployed without editing the root password in the Virtual Appliance Management Interface (VAMI), the default GRUB password is vmware.

  • If the vCSA root password was reset using the VAMI, then the GRUB password is the password last set in the VAMI for the root account.

Use the arrow keys to highlight VMware vCenter Server Appliance and type e to edit the boot commands.Scroll to the second line displaying the kernel boot parameters.Type e to edit the boot command.Append init=/bin/bash to the kernel boot options.Press Enter. The GRUB menu reappears.Type b to start the boot process. The system boots to a shell.Reset the root password by running the passwd root command.Restart the appliance by running the reboot command.Important: Follow the instructions in the Prevent forced lockout when the root account is still active section of this article to prevent future root account lock out and retain password expiration functionality.

 

Additional Information

The vCSA allows you to establish your own password expiration and warning email policies by using the Admin tab of the Virtual Appliance Management Interface (VAMI).



By default, the password expiration on the local root account in the vCSA is set to 90 days after the password has been changed. This typically occurs at first boot. If the password is not changed on installation, there is a 90-day period before expiration.

Email addresses configured in the Admin tab in the VAMI (https://IP_address:5480 or https://VAMI_host_name:5480) receive email notifications each day for seven days prior to password expiration. The email settings, such as relay SMTP server, are configured through the vSphere Client in the vCenter Server mail settings.

 

 

Request a Product Feature

To request a new product feature or to provide feedback on a VMware product, please visit the Request a Product Feature page.

 

 解决Password has been already used. Choose another.

 

 

vs55:/etc/pam.d # cat common-password
#%PAM-1.0
#
# This file is autogenerated by pam-config. All changes
# will be overwritten.
#
# Password-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define  the services to be
# used to change user passwords.
#
password requisite pam_cracklib.so dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1 minlen=8 difok=4 retry=3
password required pam_pwhistory.so enforce_for_root remember=0 retry=3
password required pam_unix2.so use_authtok

 remember=5服务器只记录最后的 5 个密码。如果你试图使用曾用的最后 5个老密码中的任意一个，你将看到如下的错误提示

Password has been already used. Choose another.