Month: September 2020

Short answer: NSX Manager and NSX Edge local passwords (admin, root, audit) expire after 90 days by default. Log in to the NSX CLI as admin on each appliance and run clear user <user> password-expiration to disable expiration, or set user <user> password-expiration <1-9999> to change it. Verify with get user <user> password-expiration. The API field is password_change_frequency (0 disables). In VCF 9, Broadcom recommends rotation instead of never-expire.

Default NSX password expiration

Password expiration was introduced in NSX-T 2.4.0. Since then, the local accounts on NSX Manager and NSX Edge appliances expire 90 days after the last password change, and users get warning messages 7 days before expiry. When the admin password expires you can no longer log in to the NSX Manager UI, and any task or API call that uses that account fails. That is why an expired NSX password often shows up first as a broken integration (vCenter, backup, SDDC Manager, monitoring), not as a login prompt.

Check NSX password expiration

Connect to the appliance over SSH or the console as admin and check each local account:

nsx-mgr> get user admin password-expiration
Password expires 90 days after last change
User will receive warning messages 7 days before password expires.

nsx-mgr> get user root password-expiration
nsx-mgr> get user audit password-expiration

If the password is already expired, the output says Current password expired ## day ago. The appliance also logs upcoming expiry in /var/log/auth.log (entries such as password for user admin will expire in 1 days), and NSX raises the “Password expired” / “Password about to expire” alarms in the UI.

NSX disable password expiration (CLI)

The same NSX CLI commands work on NSX-T 3.x, NSX 4.x and NSX 9.x, on both Manager and Edge nodes. Run them as admin:

# Disable expiration (password never expires)
nsx-mgr> clear user admin password-expiration
nsx-mgr> clear user root password-expiration
nsx-mgr> clear user audit password-expiration

# Verify
nsx-mgr> get user admin password-expiration
Password expiration not configured for this user

If your security policy does not allow passwords that never expire, set a longer interval instead. The allowed range is 1 to 9999 days:

nsx-mgr> set user admin password-expiration 9999
nsx-mgr> set user root password-expiration 9999
nsx-mgr> set user audit password-expiration 9999

Practical notes:

• Run the commands on every appliance where the account exists: each NSX Manager node and each NSX Edge node. Then verify with get user … password-expiration on each node rather than assuming it applied everywhere.
• NSX 4.1.x only: changing a password with set user admin password resets a custom expiration back to 90 days (KB 376166). It is fixed in NSX 4.2.0 and later. On 4.1.x, re-run set user … password-expiration or clear user … password-expiration after every password change.
• Resetting an expired password does not reset the expiration date. Extend it separately with the CLI or API.

API alternative: password_change_frequency

Password expiration is a property of the node user (NodeUserProperties). The field password_change_frequency holds the number of days; setting it to 0 disables password expiration. Broadcom documents these endpoints:

# Local node (the Manager you call)
PUT /api/v1/node/users/{userid}

# A specific Manager cluster node
PUT /api/v1/cluster/{cluster-node-id}/node/users/{userid}

# An Edge / transport node
PUT /api/v1/transport-nodes/{transport-node-id}/node/users/{userid}

Read the user first (GET on the same path), change password_change_frequency in the body and send it back with PUT. Check the “Update node user” call in the NSX API reference for your release for the exact required fields. The API route is the better choice when you manage many Edge nodes or want the change in an automation pipeline.

NSX password expired: how to recover

Expired admin or audit password

Log in as root, switch to admin with su admin, and set a new password. You need to know the current (expired) password:

nsx-mgr> set user admin password
Current password:
New password:
Confirm new password:

nsx-mgr> clear user admin password-expiration

In the UI, admin can reset expired passwords of other local users (System > User Management or the password-expiry notification), but not its own. Guest users cannot be reset from the CLI.

Expired root password

If you try st en with an expired root password, NSX refuses to open the root shell and tells you to run set user root password as admin. If admin is not accessible but you know the root password, a direct SSH/console login as root forces a password change. If you know neither password, follow “Resetting the Passwords of an Appliance” (GRUB edit during a reboot). KB 408091 also describes how to propagate a manually changed root password to the other Manager nodes in the cluster. Afterwards set the expiration again:

nsx-mgr> set user root password-expiration 9999
nsx-mgr> set user admin password-expiration 9999

NSX in VCF 9: rotate instead of disabling

In VMware Cloud Foundation, NSX Manager credentials belong to VCF password management, so changing them only on the appliance is different from standalone NSX:

• Broadcom KB 435599 (VCF 9.x) says “Never Expire” is not a supported state for core components in the automated lifecycle engine and recommends configuring automatic rotation instead. Changing account properties directly on NSX with the CLI can cause compliance drift during SDDC Manager inventory syncs or LCM operations.
• From VCF 9.1, password policies (length, complexity, expiration, lockout) are created in VCF Operations and assigned to the fleet or to a VCF instance. VCF Operations then flags non-compliant components and can remediate them.
• Known issue in VCF Operations 9.1.x (KB 448813): NSX users set to never expire can still trigger a false “NSX password expired” alert. The KB workaround is to set a finite value above 90 days, e.g. set user admin password-expiration 365.

My recommendation: in a lab or standalone NSX, clear user … password-expiration is fine. In production VCF, keep expiration enabled, rotate passwords from VCF Operations or SDDC Manager, and use the CLI only to recover an account that has already expired.

Sources

• Broadcom TechDocs: Modifying the Default Admin Password Expiration (NSX 4.2)
• Broadcom TechDocs: Resetting Expired Passwords (NSX 4.2)
• KB 338942 (formerly 70691): Alarm: Root, Admin, or Audit Password Expired
• KB 376166: Changing the password on an NSX appliance reverts the password expiration to 90 days
• KB 408091: Root password expired on NSX Manager and Edge
• KB 435599: Configuring Password Expiration and Rotation in VCF 9.x
• KB 448813: False “NSX password expired” alert in VCF Operations 9.1.x
• Broadcom TechDocs: Managing Passwords for VCF Components (VCF 9.1)

Related on vdan.cz

• NSX installation and essential commands guide
• Mastering the NSX management cluster: essential commands and log files
• How to fix vCenter password expiration: “User password expired”