Any way to check ESXi root password Changed Date through PowerCLI

[Sivaramsharmar]

Hi All,

Is there Any way to check ESXi root password Changed Date through PowerCLI.

ESXi version : 6.0

vCenter : 6.0

[LucD]

Yes, the change will create a UserPasswordChanged event.

You can get those events and the date with the following.

$esxName = 'MyEsx'

Get-VIEvent -Start (Get-Date).AddMinutes(-15) -MaxSamples ([int]::MaxValue) |

where { $_ -is [VMware.Vim.UserPasswordChanged] -and $_.UserName -eq 'root' -and $_.Host.Name -eq $esxName } |

Select CreatedTime, FullFormattedMessage

You can run this against a connection to a vCenter or a connection against an ESXi node.

On an ESXi node events are kept for about 1 hour, on a vCenter events are kept for the valu

[Sivaramsharmar]

Hi Lucd,

As there is a time factor involved as per the log retention period of ESXi & vCenter as  you said, I tried for alternate approach.

I have gone through couple of blogs and found below command.

Below command is working only on ESXi 6.5 and above.

[root@localhost:~] myDays=$(cat /etc/shadow | grep root | awk -F ":"'{print $3}')

[root@localhost:~] date -d "1970-01-01 +$(($myDays *24))"

We have more servers running on ESXi 6.0 environment and above command is not working.

Is there any way that we can execute above command through PowerCLI which will work both on ESXi 6.0 & 6.5.

[LucD]

The following can do this (there seems to be an error in your code).

It assumes that you have the Posh-SSH module installed (see Use Posh-SSH instead of PuTTY)

$esxName = 'MyEsx'

$cred = Get-Credential -Message "Credentials for $esxName"

$esx = Get-VMHost -Name $esxName

$cmdSub = @'

days=$(awk -F":" '$1 == "root" {print $3}' /etc/shadow)

seconds_since_epoch=$((days*60*60*24))

date --date=@$((seconds_since_epoch))

'@

$session = New-SSHSession -ComputerName $esx.Name -Credential $cred -AcceptKey

$result = Invoke-SSHCommand -SSHSession $session -Command $cmdSub

Remove-SSHSession -SSHSession $session | Out-Null

$result.Output

[LucD]

It looks as if the root password age is returned as Sat Jul 29 00:00:00 UTC 2006 when you still are using the original password defined during the installation of ESXi.

At least that is what I seem to see in ESXi 6.7

[RJ4719]

While I haven't had prior experience with the posh-ssh module, I find it quite intriguing, and I appreciate you bringing it to my attention.

@LucD , I'm curious about the feasibility of modifying the code snippet below to enable the collection of information for each host within a vCenter. Specifically, I'm interested in querying each host to retrieve details about local users, including password age, complexity settings, and historical data. This capability would be immensely valuable, particularly for those of us who need to navigate security audits such as PCI compliance and similar requirements. Thanks so much for all you do in this portal, truly a value add for the admins.

Additionally it would be a tremendous help to have a one stop shop script to first enable ssh on each host withing a vcenter just before attempting this audit as well.