Omnistack blocking root account

[Stefano Colombo]

we have a problem with a node in simplivity cluster .

On one esxi host we have the message that the root account is been blocked for 900 second due to invalid login attempt.

The Ip that is trying to access the esxi host with root account is the one of the OVC running on the host itself

how can we stop this from happening ?

thanks

[DowS]

Hi Stefano,

If you are running 3.7.3 or above you can update the stored password for the Root user.

If below 3.7.3 please open a support ticket for further assistance.

Update Identity Store:

1. Log into OVC and Elevate permissions prior to running below commands.

• sudo su
• source /var/tmp/build/bin/appsetup

1.  This command is non-intrusive and will only restart some of the authentication services.

• dsv-identitystore-init <HMS User> <Host IP> <Host User>  <HMS Password> <Host Password> 

Newer versions 3.7.7 > use:

• dsv-digitalvault-init

HMS User = administrator@vsphere.local or equivalent.

Host IP = vmkernel management IP address of ESXi host housing specific OVC

​​​​​​​Host User = Root

To See A Full Explanation of Command Run : dsv-identitystore-init --help 

To unlock the root account please follow the procedure below. 

1. Access ESXi console with remote or direct KVM 

2. Login to ESXi console (F2) with root account (it won't be locked at this level)

3. Navigate to Troubleshooting Options

4. In first line you should see either Disable or Enable ESXi Shell. If its Enable, hit enter once. 

5. Then use combination Alt+F1 to switch to ESXi shell

6. Login with root account (it won't be locked at this level)

7. Run following command. This will show number of failed login attempts 

pam_tally2 --user root 

8. To reset the failures, run following command 

pam_tally2 --user root --reset 

Now you can access the ESXi with shell and Web UI (vSphere Client). 

Run 'pam_tally2 --user root' couple of times to check if there are new failed login attempts.

[Stefano Colombo]

Hello

thanks for your help , it was actually another host that was blocking root account .

Nonentheless I'll keep your solution as future reference

thanks