ESX Configuration Guide

Password Strength and Complexity

By default, ESX uses the pam_passwdqc.so plug-in to set the rules that users must observe when creating passwords and to check password strength.

The pam_passwdqc.so plug-in lets you determine the basic standards that all passwords must meet. By default, ESX imposes no restrictions on the root password. However, when nonroot users attempt to change their passwords, the passwords they choose must meet the basic standards that pam_passwdqc.so sets.

A valid password should contain a combination of as many character classes as possible. Character classes include lowercase letters, uppercase letters, numbers, and special characters such as an underscore or dash.

NOTE When the number of character classes is counted, the plug-in does not count uppercase letters used as the first character in the password and numbers used as the last character of a password.

To configure password complexity, you can change the default value of the following parameters.

nN0 is the number of characters required for a password that uses characters from only one character class. For example, the password contains only lowercase letters.

nN1 is the number of characters required for a password that uses characters from two character classes.

nN2 is used for passphrases. ESX requires three words for a passphrase. Each word in the passphrase must be 8-40 characters long.

nN3 is the number of characters required for a password that uses characters from three character classes.

nN4 is the number of characters required for a password that uses characters from all four character classes.

nmatch is the number of characters allowed in a string that is reused from the old password. If the pam_passwdqc.so plug-in finds a reused string of this length or longer, it disqualifies the string from the strength test and uses only the remaining characters.

Setting any of these options to -1 directs the pam_passwdqc.so plug-in to ignore the requirement.

Setting any of these options to disabled directs the pam_passwdqc.so plug-in to disqualify passwords with the associated characteristic. The values used must be in descending order except for -1 and disabled.

NOTE The pam_passwdqc.so plug-in used in Linux provides more parameters than the parameters supported for ESX. You cannot specify these additional parameters in esxcfg-auth.

For more information on the pam_passwdqc.so plug-in, see your Linux documentation.

Change Default Password Complexity for the pam_passwdqc.so Plug-In

Configure the pam_passwdqc.so plug-in to determine the basic standards all passwords must meet.

Procedure

1 Log in to the service console and acquire root privileges.

2Enter the following command. esxcfg-auth --usepamqc=N0N1N2N3N4match

Example: esxcfg-auth --usepamqc Command

For example, you use the following command.

esxcfg-auth --usepamqc=disabled 18 -1 12 8

198	VMware, Inc.