1

I have a freshly installed ESXi system (6.5.0a from 2017-02-02). I cannot login today to it using password. Both web gui (web vSphere) and ssh with password authentication does not work.

Error from web gui:

Cannot complete login due to an incorrect user name or password.

I configured a ssh pub key auth, which is still works fine, so I still have root access to the console over ssh. I tried to change the password using "passwd root" several times. I rebooted the host, but the neither web gui, nor ssh with password authentication works.

Is there anything else I can try to restore the access to ESXi host?

4

In short, there's a root account lockout feature that was introduced since ESXi 6, that gradually increases lockout timer after certain amount of failed login attempts up to 900 seconds, and those timers seem to be additive. DCUI console is not affected and your password should work there. If your management interface faces public network then you're in trouble, as brute-force ssh bots will make sure this timer never expires for root account. Look up your hostd.log and auth.log to see the gory details..

You can, in order of preference, make your management interface not to face public network, configure a built-in firewall to accept traffic from trusted networks only or disable SSH and wait for a few hours until the lockout expires. Then you should be able to login again.

You can create a separate non-root administrator account and use it, or disable account lockout feature by setting Security.AccountLockFailures in Advanced options to zero to avoid this happening in the future. At the same time you should consider sticking to best practices and remove public access from your management network and disable SSH access when it is not needed for troubleshooting.

  • Great tip Peter! It is exactly that: 2017-09-20T08:17:11.285Z info hostd[F081B70] [Originator@6876 sub=Vimsvc.ha-eventmgr] Event 4926 : Remote access for ESXi local user account 'root' has been locked for 900 seconds after 4845 failed login attempts. – Anton Golubev Sep 20 '17 at 18:14
  • You can unlock the account by logging into the DCUI and selecting Troubleshooting Options > Restart Management Agents. After that, I could log in with SSH and vSphere. – wmassingham Nov 30 '17 at 21:29
1

I also had this issue during initial build it was put in lockdown mode by accident.. I was able to disable lockdown mode from the console in iLO then the web GUI and putty ssh were working again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.