ESX Configuration Guide

nPasswords containing characters from three character classes must be at least seven characters long.

nPasswords containing characters from all four character classes must be at least six characters long.

NOTE An uppercase character that begins a password does not count toward the number of character classes used. A number that ends a password does not count toward the number of character classes used.

You can also use a passphrase, which is a phrase consisting of at least three words, each of which is 8 to 40 characters long.

Example: Sample Passwords

The following password candidates meet the requirements of ESX.

nxQaTEhbU: Contains eight characters from two character classes.

nxQaT3pb: Contains seven characters from three character classes.

nxQaT3#: Contains six characters from four character classes.

The following password candidates do not meet the requirements of ESX.

nXqat3hb: Begins with an uppercase character, reducing the effective number of character classes to two. Eight characters are required when you use only two character classes.

nxQaTEh2: Ends with a number, reducing the effective number of character classes to two. Eight characters are required when you use only two character classes.

Understanding Permissions

For ESX and vCenter Server, permissions are defined as access roles that consist of a user and the user’s assigned role for an object such as a virtual machine or ESX host.

Most vCenter Server and ESX users have limited ability to manipulate the objects associated with the host. Users with the Administrator role have full access rights and permissions on all virtual objects such as datastores, hosts, virtual machines, and resource pools. By default, the Administrator role is granted to the root user. If vCenter Server manages the host, vpxuser is also an Administrator user.

The list of privileges is the same for both ESX and vCenter Server, and you use the same method to configure permissions.

You can create roles and set permissions through a direct connection to the ESX host. Because these tasks are widely performed in vCenter Server, see the VMware vSphere Datacenter Administration Guide for information on working with permissions and roles.

Assigning root User Permissions

Root users can only perform activities on the specific ESX host that they are logged in to.

For security reasons, you might not want to use the root user in the Administrator role. In this case, you can change permissions after installation so that the root user no longer has administrative privileges or you can delete the root user’s access permissions altogether through the vSphere Client as described in the VMware vSphere Datacenter Administration Guide. If you do so, you must first create another permission at the root level that has a different user assigned to the Administrator role.

Assigning the Administrator role to a different user helps you maintain security through traceability. The vSphere Client logs all actions that the Administrator role user initiates as events, providing you with an audit trail. If all administrators log in as the root user, you cannot tell which administrator performed an action. If you create multiple permissions at the root level—each associated with a different user or user group—you can track the actions of each administrator or administrative group.

176	VMware, Inc.