VxRail: Best Practices for VxRail Account and Passwords
Summary: The rules for accounts and passwords implemented by VxRail are explained in this article. Recommendations for VxRail account naming including vCenter ESXi host, VxRail Manager, and Platform Services Controller (PSC) root accounts, general suggestions for accounts password best practices for use in Dell VxRail. ...
Instructions
Accounts used during initial deployment:
- vCenter administrator account
administrator@vsphere.local. For external VC, the customer should provide the account name with the same permission as administrator@vsphere.local.
- Management account
localos domain. In the PSC, it will get the VMware HCIA Management permission after initial deployment. In each ESXi host, it will be assigned with the administrator permission after initial deployment. The customer selects the management account username during initial deployment. For external VC, the customer creates this account without any permission or any group that is assigned to it.
- vCenter and PSC root account
- ESXi host root account:
Account naming restrictions
- vCenter administrator account
- For internal VC, it is fixed to
administrator@vsphere.local, no other restrictions. - For external VC, the customer provides it. There is no restriction from the VxRail Manger point of view.
- For internal VC, it is fixed to
- Management account
- For internal VC, the customer chooses it at initial deployment. The account name must comply with restrictions by PSC and ESXi hosts.
- For external VC, the customer provides it. The account name must comply with restrictions by PSC and ESXi hosts.
- PSC restrictions:
- For the
localosdomain: Match the regular expression[A-Za-z_][A-Za-z0-9_.-]*[A-Za-z0-9_.$-]?, up to 32 characters.
- For a customer-specified domain: Follow the restrictions in the specific domain.
- For the
- ESXi restrictions: Match the regular expression
[A-Za-z_][A-Za-z0-9_-]*[A-Za-z0-9_$-]?, up to 16 characters.
- vCenter and PSC root account
- ESXi system root account
Password restrictions
General suggestions for all the accounts: Avoid using special characters in a password, such as / ? ; , . | \ ' " & $ = ` < # ! -
- vCenter administrator password:
- vCenter software restriction: VC password policy
- VM system policy: See Linux default password restriction
- Management password
- For internal VC, the customer chooses the management account at initial deployment. The account name must comply with restrictions by PSC and ESXi hosts.
- For external VC, the customer provides the account. The password should comply with restrictions on the PSC and ESXi host.
- PSC VM system policy: See Linux default password restriction
- ESXi restriction: ESXi password policy
, blank space not allowed
- From release 4.0.0 to 4.0.200, the Secure Remote Services admin password is aligned with the management password. The password must comply with Secure Remote Services admin password rules as well. Reference article VxRail: Fail to update management account password when Secure Remote Services is enabled.
- vCenter and PSC root account
- ESXi host root account
, blank spaces are not allowed.
iDRAC:
For iDRAC9, the iDRAC secure password is available on the back of the system information tag (Service Tag) under iDRAC Default Password. See article What is the default username and password for Integrated Dell Remote Access Controller (iDRAC) for more information.
Some simple passwords may no longer work. For instance, in the screenshot below, the reason the default password of "calvin" is no longer accepted, is because of a password security setting for the iDRAC. See article Dell Technologies VxRail: iDRAC settings that cannot be changed for more information.
For Example: At the moment, you cannot set the iDRAC password to the old "calvin" default. This is prevented since the iDRAC password Policy Setting is *not* set to "0 - No Protection": iDRAC > iDRAC Settings > Users > Global User Settings > Password Settings > Policy Settings > Minimum Score = "0 - No Protection"
Changing iDRAC policy settings may cause upgrade failures.
Additional Information
The passwords for the vCenter administrator account and the vCenter and PSC root account should be aligned all the time. Password inconsistency leads to node replacement and single node addition procedure failures.