Omnistack blocking root account

Stefano_Colombo — Thu, 18 Jul 2019 09:37:13 GMT

we have a problem with a node in simplivity cluster .

On one esxi host we have the message that the root account is been blocked for 900 second due to invalid login attempt.

The Ip that is trying to access the esxi host with root account is the one of the OVC running on the host itself

how can we stop this from happening ?

thanks

Re: Omnistack blocking root account

DowS — Thu, 18 Jul 2019 09:51:57 GMT

Hi Stefano,

If you are running 3.7.3 or above you can update the stored password for the Root user.

If below 3.7.3 please open a support ticket for further assistance.

Update Identity Store:

This command is non-intrusive and will only restart some of the authentication services.

dsv-identitystore-init <HMS User> <Host IP> <Host User> <HMS Password> <Host Password>

Newer versions 3.7.7 > use:

HMS User = administrator@vsphere.local or equivalent.

Host IP = vmkernel management IP address of ESXi host housing specific OVC

Host User = Root

To See A Full Explanation of Command Run : dsv-identitystore-init --help

To unlock the root account please follow the procedure below.

1. Access ESXi console with remote or direct KVM

2. Login to ESXi console (F2) with root account (it won't be locked at this level)

3. Navigate to Troubleshooting Options

4. In first line you should see either Disable or Enable ESXi Shell. If its Enable, hit enter once.

5. Then use combination Alt+F1 to switch to ESXi shell

6. Login with root account (it won't be locked at this level)

7. Run following command. This will show number of failed login attempts

pam_tally2 --user root

8. To reset the failures, run following command

pam_tally2 --user root --reset

Now you can access the ESXi with shell and Web UI (vSphere Client).

Run 'pam_tally2 --user root' couple of times to check if there are new failed login attempts.

Stefano_Colombo — Thu, 18 Jul 2019 11:58:27 GMT

Hello

thanks for your help , it was actually another host that was blocking root account .

Nonentheless I'll keep your solution as future reference

thanks