How to reset the root password for VCSA 6.x

In general, I tend to store all my passwords in something like KeePass or some other password management tool. I also have a habit of jotting down credential details in the annotation or notes field for any VM I create for testing purposes. This serves as a quick self-reminder whenever I need to log on a VM and also help users access a VM when required.

To cut a long story short, I found myself trying to log in as root on a test VCSA I had recently set up and, for the life of me, I could not recall the password. As luck would have it, I neither saved the password to KeePass nor did I write it down in VM’s annotation field. So much for good habits!

As I wasn’t particularly keen on reinstalling the appliance from scratch, I googled around to see if resetting a root password on vCSA can be done. Surely enough it can, hence today’s post! So, if you ever found yourself locked out of VCSA because you forgot the root password, read on!

Disclaimer: I tested the procedure on VCSA 6.0 U2 and VCSA 6.5. In theory, it should work on earlier releases but I do not have the time to test this out on every version released to date. Do so at your own risk and always back up the appliance before effecting any changes.

VCSA 6.5

First, shut down the VCSA and take a snapshot.

1. Start the appliance up and press the space bar to freeze the GRUB menu. Note that you need to be somewhat quick here.

2. Press e to enable edit mode.

3. Append rw init=/bin/bash to the list of options as shown in Fig. 2.

4. Press F10 to reboot. The appliance will now boot up in bash or root shell.

5. Type passwd to change the root password. Type it twice and press Enter to confirm.

6. Optionally, you can unmount the file system using umount /

7. Reboot the appliance using the power options from the VMRC or vSphere client menu.

You should now be able to log in with root using the new password as shown in this next video.

VCSA 6.0 Update 2

The process is very similar to the one for VCSA 6.5. First, shut down the VCSA and take a snapshot.

1. Press the space bar to freeze the GRUB menu.

2. Press p and type in the password to unlock the advanced features in GRUB (refer to The GRUB Password section further down).

3. Press e to enable Edit mode

4. Select the entry starting with “kernel /vmlinuz- …” and press e once more.

5. Append init=/bin/bash to the kernel boot options

6. Press Enter followed by b. This reboots the appliance in single-user mode.

7. Type in the passwd command. Type in the new password twice and press Enter to confirm.

8. Reboot the appliance using the power options from the VMRC or vSphere client. Alternatively, you can use the reboot shell command. If this fails, run mkfifo /dev/initct first followed by reboot -f.

Here’s a second video illustrating the password change procedure on 6.0 U2.

The GRUB Password

While carrying out research for this post, most of the info I came across stated that the GRUB password on VCSA is set to vmware by default unless the root password was changed via VAMI, in which case both the GRUB and root password are set to be the same. When I installed VCSA 6.0 U2 (version 6.0.0.20000-3634791) I found that this was not the case. The GRUB password was by default set the same as that for root. At no point during the vCSA installation do you get to set the GRUB password and you also cannot skip setting one for root.  So, I don’t know how and when the GRUB password is set to vmware. And yes, I’m positive that I did not change the root password using VAMI or otherwise.

Why am I ranting? Well, if this is the default behavior in U2 you are faced with two issues if you happen to lose or forget the root password. It logically follows that if you’re locked out from making changes to GRUB, there is no way you can reset the root password. Not all hope is lost, however. You can use a technique similar to the one used to recover Windows passwords. Here’s a good link that outlines this procedure.

Note: On VCSA 6.5 you’ll find that access to GRUB is not password protected much to the horror of the security folk!

Changing the root password and expiration settings

There will be times where you will not be able to log in as root despite being sure that you’re typing in the correct password. This will occur whenever the root password expires after the default password lifetime of 365 days. Additionally, it is very common to set the expiration period to 90 days or less to tighten up security. You can disable password expiry altogether but this is definitely not recommended.

The root password and expiry settings are easily managed using VAMI which you will access via this https://<VCSA FQDN or IP>:5480> link. Figures 10-11, show the root account management pages for VCSA 6.0 U2 and 6.5 respectively.

Alternatively, use the chage command from the ESXi shell as shown in Figure 11 which consists of a screen grab of the root settings in VAMI next to a screen grab of the VCSA VM’s console while in shell. Here’s a step by step explanation of the commands used.

1. chage -l root : Displays the account details for root which include the account and password expiry dates, the date at which the password was last changed, etc.

2. passwd : This command simply prompts you to change the password of the currently logged on user, which in this case happens to be root.

3. chage -M 30 root : Here I’ve used the chage command to set the password expiration period to 30 days from when the password was last changed.

4. Same as (1). You can see that the “Maximum number of days between password change“value – which is a bit misleading if you ask me – is now set to 30. The change is also reflected in the VAMI settings screens when it is refreshed.

This concludes today’s post. As always, make sure to take a snapshot or a backup of the appliance when committing these type of changes. This allows you to quickly revert to a working vCSA instance should you hit a dead end.