regnak2012
Enthusiast
Enthusiast

ESXi Password Policy

Hi,

I've trying to implement a change to disable certain types of passwords on ESXi Hosts as part of a security lockdown. I edit the /etc/pam.d/passwd file and change the default line as per KB1012033:

from:

password requisite    /lib/security/$ISA/pam_passwdqc.so retry=3 min=8,8,8,7,6
to:

password requisite    /lib/security/$ISA/pam_passwdqc.so retry=3 min=disabled,8,disabled,8,8


This saves fine but I discovered it's not valid when my Virtual Center Appliance threw out it's SSL cert, I regenerated it and had to reconnect the ESXi Hosts. They refused to connect with an error about the password not meeting complexity requirements. I can generate a similar issue by using the command "passwd root" to force a change password on the root account and the modified passwd file does not work. I've narrowed it down to the N2 entry, if I use "disabled" on N2 it breaks the password policy:


password requisite    /lib/security/$ISA/pam_passwdqc.so retry=N min=N0,N1,N2,N3,N4

N0=12: Passwords containing characters from one character class must be at least twelve characters long. For example: charsoftware

N1=10: Passwords containing characters from two character classes must be at least ten characters long. For example: chars12345

N2=8: Passphrases must contain words that are each at least eight characters long. For example: software

N3=8: Passwords containing characters from all three character classes must be at least eight characters long. For example: CHars123

N4=7: Passwords containing characters from all four character classes must be at least seven characters long. For example:  CHars1!


I'm guessing that manipulating the N2 may conflict with the other policies but has anyone else got this to work? I've tested ESXi 5.1 & 5.5 with the same result.


Thanks

Mike

0 Kudos
0 Replies