VxRail: VxRM health-check fails for test 'vc_pw_char'

VxVerify on VxRail Manager can run multiple tests which require vCenter credentials.

The health-check 'vc_pw_char' verifies that the password matches VMware rules, if the credentials cannot log in to vCenter.

Every test that passes is not listed in the summary report, for ease of reading.

An example of the health-check output is shown below:

#========================#======#=========#====================================================================#==============#
|  Hostname / Category   |Status  Dell_KB |  Warnings or Failures, unless tests Passed                         ; Product S.N. |
#========================#======#=========#====================================================================#==============#
| VxRM                   | Warning 224236 | vc_pw_char: vSphere passwords cannot be more than 20 characters long              |

Password Length

vCenter passwords should be within 8 to 20 characters long. Refer to VMware article vCenter Password Requirements and Lockout Behavior (External Link) 

Password Characters

vCenter allows a wider variety of special characters than the Linux Shell can support. Therefore, it is possible that some special characters in the passwords may cause upgrades to fail. For example, using " or ' in an Application Programming Interface (API), command may cause an error because the quotes should be at the start and end of the password string.

Some of these special characters can also break search strings. The ASCII decimal codes are used to verify the characters. Bad ASCII characters also include null characters which are ASCII codes from 0 to 31.

VxVerify only analyzes passwords for special characters if the saved vCenter or node management passwords are unable to successfully log in.

The following table is a list of good and bad special characters (this excludes 0-9, a-z and A-Z) from the ASCII range 32 to 126:

The quotation mark characters are listed as dubious because their use can be mitigated in Shell commands by substituting a \ in front of them, but not all scripts have that workaround. It is advisable to not include these in passwords.

The ! character (ASCII 33) always works correctly as the last character, but in any other position, it may cause scripts to fail in versions prior to VxRail 4.7.510.

VxRail 4.7.510 fixed the issues caused by most of the special characters, but there are still some (such as \) that cause issues for the vCenter API, so the VxVerify test flags these as a problem.

Changing the node and or vCenter management passwords to avoid using the special characters above, should address this issue, but the saved passwords in VxRM must be updated to match. Refer to the procedures listed in Solve.

Further details about any test warnings or failures are found in the VxVerify log:  

• /tmp/vxv/vxv.log