Loading

×Sorry to interrupt
CSS Error

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

ESX 4.1 and ESXi 4.1 root passwords are authenticated up to only 8 characters (1024500)

Last Updated: 1/19/2015Categories: Total Views: 41899Language:
Chinese (Simplified)JapaneseEnglish

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Details

When you set a password in ESX/ESXi 4.1, the pam_passwdqc plug-in parameter max=nn sets the maximum length allowed for a password. The intended behavior is:

For all max values except 8, proposed passwords that exceed the given max value length are not accepted.

For the special value max=8, proposed passwords longer than 8 characters are not rejected, but passwords are truncated to 8 characters. After the password has been accepted and changed, a password submitted for authentication will also be truncated to 8 characters.

By default, no max value is configured for ESX/ESXi 4.1. The default max value for the plug-in is 40. This should be the operational max value for password submission. When the default configuration is used, passwords should not be truncated, either when setting them or when they are authenticated.

In ESX/ESXi 4.1, after a password is accepted by the pam_passwdqc plug-in, ESX/ESXi behaves as if the max value is 8. When a new password is submitted, the default 40-character maximum is enforced. Thereafter, password authentication behaves as if the max value is 8, and only the first 8 characters of the password are necessary for authentication.

Solution

This issue is fixed with VMware ESX 4.1 Patch ESX410-201010414-SG for ESX systems and VMware ESXi 4.1 Patch ESXi410-201010401-SG for ESXi systems.

If you are not applying the patch to the ESX/ESXi systems, perform the following workaround steps to resolve the issue.

Note: The /etc/security/login.map file contains the authentication rules for ESX/ESXi to follow. Refer to this file to determine which file to edit in the workaround. For example, the file might contain the following rules:

vpxuser : system-auth-local
* : system-auth

In this case, use system-auth-local to authenticate vpxuser. Use system-auth to authenticate all other users. If system-auth is not present on the system, the /etc/security/login.map file typically lists system-auth.

Workaround for ESX:

Add md5 to the file /etc/pam.d/system-auth.

Log in to the service console and acquire root privileges.

Change to the directory /etc/pam.d/.

Use a text editor to open the file system-auth.

Add md5 to the following line, as shown:
password sufficient /lib/security/$ISA/pam_unix.so use_authtok nullok shadow md5

Optionally, you can use this sed command to accomplish this:

sed -e '/password.*pam_unix.so/s/$/ md5/' -i /etc/pam.d/system-auth

Reset the password. If you do not change the password, ESX continues to use the truncated password.

Workaround For ESXi:

Add md5 to the file /etc/pam.d/system-auth.

Access Tech Support Mode. For more information, see Using Tech Support Mode in ESXi 4.1 and ESXi 5.0 ( 1017910).

Change to the directory /etc/pam.d/.

Use a text editor to open the file system-auth.

Add md5 to the following line, as shown:

password sufficient /lib/security/$ISA/pam_unix.so use_authtok nullok shadow md5

(Optional) If you want the change to persist when you restart ESXi, you must add the following line to the file /etc/rc.local:

sed -e ' /password.*pam_unix.so.* md5/q' -e ' /password.*pam_unix.so/s/$/ md5/' -i /etc/pam.d/system-auth

Reset the password. If you do not change the password, ESXi continues to use the truncated password.

Additional Information
For translated versions of this article, see:

日本語: ESX 4.1 および ESXi 4.1 のルート パスワードが 8 文字までしか認証されない (2077069)

简体中文: ESX 4.1 和 ESXi 4.1 根密码最多只能以 8 个字符进行身份验证 (2078114)

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)JapaneseEnglish

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

Result 1 of 1

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware vSphere ESXi

VMware ESX Server

Related Versions:

VMware ESXi 4.1.x Installable

VMware ESXi 4.1.x Embedded

VMware ESX 4.1.x

Take Our Survey

Support Assistant