VxRail: VxRM Health-check Fails for Test 'saved_pw'

VxRail Manager (VxRM) 4.x runs several health-checks (using VxVerify2), one of which is 'saved_pw'. 

For VxRail 4.x, the management credentials for vCenter are encrypted and stored in databases on VxRM.

If the credentials stored in the databases differ between tables, this health-check gives an alert, such as the ones below:

Test Result	Result code	Result Interpretation
Pass	0	vCenter Management passwords cross-checked and logged in successfully
Warning	1	Database entry was corrected.
Failure	2	The saved passwords in the database do not match.
Critical	3	This test has no critical result.

Sometimes, VxVerify can correct mismatches between the database tables, if auto-fixes are enabled.

Each test that passes is not listed in the summary report, for ease of reading.

Examples of the health-check output are shown below:

#========================#======#=========#====================================================================#==============#
|  Hostname / Category   |Status  Dell_KB |  Warnings or Failures, unless tests Passed                         ; Product S.N. |
#========================#======#=========#====================================================================#==============#
| VxRM                   | Warning 183455 | saved_pw: PSQL settings table password corrected                                  |
| VxRM                   | Failure 183455 | saved_pw: Runtime.properties user or password incorrect                           |
| VxRM                   | Failure 183455 | saved_pw: PSQL settings table password incorrect                                  |

This test compares the encrypted passwords that are saved in VxRM in:

PSQL mysticmanager: management_account

PSQL mysticmanager: settings

runtime.properties

​​​​​The default password to use if there is a conflict is the PSC login from management_account.

This test also verifies that the login is valid using the vCenter API. If not valid, it can change the password that VxVerify uses to one of the other sources above.

The password entry in the settings table is used less than the other two password entries. Still, if this entry is wrong (it does not match the other two), then this can cause an upgrade to VxRail 7.x to fail.

PSQL

A command that can be run on VxRM to manually reproduce this test is:

/usr/bin/psql -U postgres mysticmanager -c "select id,host,component,username,password,status from management_account"

The user and encrypted password are supposed to match the entries in the runtime properties for data.managementUsername and data.managementPassword respectively. This VxVerify test should help to show which of these is wrong and in need of updating.
 

PSC

1. Log in to vCenter with an administrator account and navigate as follows:
   1. Main Menu > Administration > Single Sign On > Users and Groups
   2. Select the Users tab and then set Domain to:

localos

3. Find the User who is listed as in the output above (vxrailmgmt in this case).
4. Select the User and select the three dots to the left of the username and then click Edit.
5. Specify a new password.
6. Go back to VxRail Manager CLI (as root).
7. Edit and use the following command where user default is administrator@vsphere.local but admin user may be different.

curl -k --user administrator@vsphere.local -X POST "https://<IP Address VxRail Manager>/rest/vxm/v1/system/update-credential" -H "accept: application/json" -H "Content-Type: application/json" -d "[{\"component\": \"psc\",\"hostname\": \"hostname\",\"username\": \"username\",\"password\": \"xxxxx\"}]"

Example:

curl -k --user administrator@vsphere.local -X POST "https://172.19.4.201/rest/vxm/v1/system/update-credential"" -H "accept: application/json" -H "Content-Type: application/json" -d "[{\"component\": \"psc\",\"hostname\": \"lab01-PSC.cork.local\",\"username\": \"vxrailmgmt\",\"password\": \"VxR@il1234\"}]"