8.0

Table Of Contents
For example, you can change the option to the following.
retry=3 min=disabled,disabled,16,7,7
This example allows pass phrases of at least 16 characters and at least three words.
For legacy hosts, changing the /etc/pam.d/passwd file is still supported, but changing the file
is deprecated for future releases. Use the Security.PasswordQualityControl advanced system
setting instead.
Changing Default Password Restrictions
You can change the default restriction on passwords or pass phrases by using the
Security.PasswordQualityControl advanced system setting for your ESXi host. See the
vCenter
Server and Host Management
documentation for information on changing ESXi advanced system
settings.
You can change the default, for example, to require a minimum of 15 characters and a minimum
number of four words (passphrase=4), as follows:
retry=3 min=disabled,disabled,15,7,7 passphrase=4
See the man page for pam_passwdqc for details.
Note Not all possible combinations of password options have been tested. Perform testing after
you change the default password settings.
This example sets the password complexity requirement to require eight characters from four
character classes that enforce a significant password difference, a remembered history of five
passwords, and a 90 day rotation policy:
min=disabled,disabled,disabled,disabled,8 similar=deny
Set the Security.PasswordHistory option to 5 and the Security.PasswordMaxDays option to 90.
ESXi Account Lockout Behavior
Account locking is supported for access through SSH and through the vSphere Web Services SDK.
The Direct Console Interface (DCUI) and the ESXi Shell do not support account lockout. By default,
a maximum of five failed attempts is allowed before the account is locked. The account is unlocked
after 15 minutes by default.
Configuring Login Behavior
You can configure the login behavior for your ESXi host with the following advanced system
settings:
n Security.AccountLockFailures. Maximum number of failed login attempts before a user's
account is locked. Zero deactivates account locking.
n Security.AccountUnlockTime. Number of seconds that a user is locked out.
VMware ESXi Installation and Setup
VMware, Inc. 25