8.0

ESXi Passwords
ESXi enforces password requirements for access from the Direct Console User Interface, the ESXi
Shell, SSH, or the VMware Host Client.
n By default, you must include a mix of at least three from the following four character classes:
lowercase letters, uppercase letters, numbers, and special characters such as underscore or
dash when you create a password.
n By default, password length is at least 7 characters and less than 40.
n Passwords must not contain a dictionary word or part of a dictionary word.
n Passwords must not contain the user name or parts of the user name.
Note An uppercase character that begins a password does not count toward the number of
character classes used. A number that ends a password does not count toward the number of
character classes used. A dictionary word used inside a password reduces the overall password
strength.
Example ESXi Passwords
The following password candidates illustrate potential passwords if the option is set as follows.
retry=3 min=disabled,disabled,disabled,7,7
With this setting, a user is prompted up to three times (retry=3) for a new password that is
not sufficiently strong or if the password was not entered correctly twice. Passwords with one
or two character classes and pass phrases are not allowed, because the first three items are
deactivated. Passwords from three- and four-character classes require seven characters. See the
pam_passwdqc man page for details on other options, such as max, passphrase, and so on.
With these settings, the following passwords are allowed.
n xQaTEhb!: Contains eight characters from three character classes.
n xQaT3#A: Contains seven characters from four character classes.
The following password candidates do not meet requirements.
n Xqat3hi: Begins with an uppercase character, reducing the effective number of character
classes to two. The minimum number of required character classes is three.
n xQaTEh2: Ends with a number, reducing the effective number of character classes to two. The
minimum number of required character classes is three.
ESXi Pass Phrase
Instead of a password, you can also use a pass phrase. However, pass phrases are
deactivated by default. You can change the default setting and other settings by using the
Security.PasswordQualityControl advanced system setting from the vSphere Client.
VMware ESXi Installation and Setup
VMware, Inc. 24