6.5.1

n
By default, password length is more than 7 and less than 40.
n
Passwords cannot contain a dictionary word or part of a dictionary word.
Note An uppercase character that begins a password does not count toward the number of character
classes used. A number that ends a password does not count toward the number of character classes
used.
Example ESXi Passwords
The following password candidates illustrate potential passwords if the option is set as follows.
retry=3 min=disabled,disabled,disabled,7,7
With this setting, passwords with one or two character classes and pass phases are not allowed, because
the first three items are disabled. Passwords from three- and four-character classes require seven
characters. See the pam_passwdqc manpage for details.
With these settings, the following passwords are allowed.
n
xQaTEhb!: Contains eight characters from three character classes.
n
xQaT3#A: Contains seven characters from four character classes.
The following password candidates do not meet requirements.
n
Xqat3hi: Begins with an uppercase character, reducing the effective number of character classes to
two. The minimum number of required character classes is three.
n
xQaTEh2: Ends with a number, reducing the effective number of character classes to two. The
minimum number of required character classes is three.
ESXi Pass Phrase
Instead of a password, you can also use a pass phrase; however, pass phrases are disabled by default.
You can change this default or other settings, by using the Security.PasswordQualityControl
advanced option from the vSphere Web Client.
For example, you can change the option to the following.
retry=3 min=disabled,disabled,16,7,7
This example allows pass phrases of at least 16 characters and at least 3 words, separated by spaces.
For legacy hosts, changing the /etc/pamd/passwd file is still supported, but changing the file is
deprecated for future releases. Use the Security.PasswordQualityControl advanced option instead.
Changing Default Password Restrictions
You can change the default restriction on passwords or pass phrases by using the
Security.PasswordQualityControl advanced option for your ESXi host. See the vCenter Server and
Host Management documentation for information on setting ESXi advanced options.
vSphere Security
VMware, Inc. 46