7.0

ESXi Passwords and Account Lockout
For ESXi hosts, you must use a password with predefined requirements. You can change
the required length and character class requirement or allow pass phrases using the
Security.PasswordQualityControl advanced option. You can also set the number of passwords
to remember for each user using the Security.PasswordHistory advanced option.
Note The default requirements for ESXi passwords can change from one release to
the next. You can check and change the default password restrictions by using the
Security.PasswordQualityControl advanced option.
ESXi Passwords
ESXi enforces password requirements for access from the Direct Console User Interface, the ESXi
Shell, SSH, or the VMware Host Client.
n By default, you must include a mix of at least three from the following four character classes:
lowercase letters, uppercase letters, numbers, and special characters such as underscore or
dash when you create a password.
n By default, password length is at least 7 characters and less than 40.
n Passwords must not contain a dictionary word or part of a dictionary word.
n Passwords must not contain the user name or parts of the user name.
Note An uppercase character that begins a password does not count toward the number of
character classes used. A number that ends a password does not count toward the number of
character classes used. A dictionary word used inside a password reduces the overall password
strength.
Example ESXi Passwords
The following password candidates illustrate potential passwords if the option is set as follows.
retry=3 min=disabled,disabled,disabled,7,7
With this setting, a user is prompted up to three times (retry=3) for a new password that is
not sufficiently strong or if the password was not entered correctly twice. Passwords with one
or two character classes and pass phrases are not allowed, because the first three items are
disabled. Passwords from three- and four-character classes require seven characters. See the
pam_passwdqc man page for details on other options, such as max, passphrase, and so on.
With these settings, the following passwords are allowed.
n xQaTEhb!: Contains eight characters from three character classes.
n xQaT3#A: Contains seven characters from four character classes.
VMware ESXi Installation and Setup
VMware, Inc. 21