6.0.3

Use the vSphere Client
or VMware CLIs or APIs
to administer
standalone ESXi hosts
Use the vSphere Client, one of the VMware CLIs or APIs to administer your
ESXi hosts. Access the host from the DCUI or the ESXi Shell as the root user
only for troubleshooting. If you decide to use the ESXi Shell, limit the
accounts with access and set timeouts.
Use only VMware
sources to upgrade
ESXi components.
The host runs a variety of third-party packages to support management
interfaces or tasks that you must perform. VMware does not support
upgrading these packages from anything other than a VMware source. If you
use a download or patch from another source, you might compromise
management interface security or functions. Regularly check third-party
vendor sites and the VMware knowledge base for security alerts.
N Follow the VMware security advisories at hp://www.vmware.com/security/.
ESXi Passwords and Account Lockout
For ESXi hosts, you have to use a password with predened requirements. You can change the required
length and character class requirement or allow pass phrases using the
Security.PasswordQualityControl advanced option.
ESXi uses the Linux PAM module pam_passwdqc for password management and control. See the manpage
for pam_passwdqc for detailed information.
N The default requirements for ESXi passwords can change from one release to the next. You can check
and change the default password restrictions using the Security.PasswordQualityControl advanced
option.
ESXi Passwords
ESXi enforces password requirements for access from the Direct Console User Interface, the ESXi Shell, SSH,
or the vSphere Client. By default, you have to include a mix of characters from four character classes:
lowercase leers, uppercase leers, numbers, and special characters such as underscore or dash when you
create a password.
N An uppercase character that begins a password does not count toward the number of character
classes used. A number that ends a password does not count toward the number of character classes used.
Passwords cannot contain a dictionary word or part of a dictionary word.
Example ESXi Passwords
The following password candidates illustrate potential passwords if the option is set as follows.
retry=3 min=disabled,disabled,disabled,7,7
With this seing, passwords with one or two character classes and pass phases are not allowed, because the
rst three items are disabled. Passwords from three- and four-character classes require seven characters. See
the pam_passwdqc manpage for details.
With these seings, the following passwords are allowed.
n
xQaTEhb!: Contains eight characters from three character classes.
n
xQaT3#A: Contains seven characters from four character classes.
The following password candidates do not meet requirements.
n
Xqat3hi: Begins with an uppercase character, reducing the eective number of character classes to two.
The minimum number of required character classes is three.
Chapter 5 Securing ESXi Hosts
VMware, Inc. 157