VMware Cloud Foundation 4.5

5.2 5.1 5.0 4.5
Deutsch Français Italiano 日本語 English

Configure the root User Account Lockout Policy for vCenter Server

Set the maximum number of failed login attempts and the time that must pass before the account is automatically unlocked for the
root
 local account in the vCenter Server appliances in
VMware Cloud Foundation
.
Setting
Default Value
Maximum number of failed login attempts
3
Unlock time for root
300 seconds
Unlock time
900 seconds

UI Procedure

  1. Log in to the vCenter Server appliance using SSH as
    root
    .
  2. Enable shell access.
    shell
  3. Back up the authentication requirements for the appliance using the following command. 
    cp -p /etc/pam.d/system-auth /etc/pam.d/system-auth-`date +%F_%H:%M:%S`.back
  4. Change the maximum number of failed attempts using the following command.
    sed -i -E 's/deny=[-]?[0-9]+/deny=<your_value>/g' /etc/pam.d/system-auth
  5. Change the unlock time for the
    root
     account using the following command.
    sed -i -E 's/root_unlock_time=[-]?[0-9]+/root_unlock_time=<your_value>/g' /etc/pam.d/system-auth
  6. Change the unlock time for the root account using the following command.
    sed -i -E 's/unlock_time=[-]?[0-9]+/unlock_time=<your_value>/g' /etc/pam.d/system-auth
  7. Repeat this procedure for each VI workload domain vCenter Server.

PowerShell Procedure

  1. Start Windows PowerShell.
  2. Replace the values in the sample code and run the commands in the PowerShell console.
    $sddcManagerFqdn = "sfo-vcf01.sfo.rainpole.io"
$sddcManagerUser = "administrator@vsphere.local"
$sddcManagerPass = "VMw@re1!"

$sddcDomainName = "sfo-m01"

$maxFailures = "5"
$unlockInterval = "900"
$rootUnlockInterval = "300"
  3. Perform the configuration by running the command in the PowerShell console.
    Update-VcenterAccountLockout -server $sddcManagerFqdn -user $sddcManagerUser -pass $sddcManagerPass -domain $sddcDomainName -failures $maxFailures -unlockInterval $unlockInterval -rootUnlockInterval $rootUnlockInterval
  4. Repeat this procedure for each VI workload domain vCenter Server.

Content feedback and comments