[VMware vSphere] vCenter Server のアカウントロックの動作ついて

vCenter Server Appliance の各アカウントのロックアウトポリシーに
ついて記載します。

使用環境
vCenter Single Sign-On(SSO) ユーザーのロックアウトポリシー
vCenter Server Appliance ローカルユーザー(root) のロックアウトポリシー

使用環境

vSphere7.0 / vSphere8.0

vCenter Single Sign-On(SSO) ユーザーのロックアウトポリシー

vCenter Single Sign-On(SSO) ユーザ (デフォルトは [vsphere.local])
のアカウントロックアウトポリシーはデフォルトで、180 秒の間に
ログインに 5 回失敗すると 300 秒間ロックされる仕様となっています。

vCenter のパスワード要件とロックアウト動作
https://docs.vmware.com/jp/VMware-vSphere/7.0/com.vmware.vsphere.security.doc/GUID-4BDBF79A-6C16-43B0-B0B1-637BF5516112.html
-> vCenter Single Sign-On のロックアウト動作

なお、vCenter Single Sign-On(SSO) 管理者である、
Administrator@vsphere.local ユーザーはデフォルトで上記ロックアウト
ポリシーの影響は受けません。

ロックアウトポリシーの設定変更方法

vCenter Single Sign-On(SSO) ユーザのアカウントロックアウトポリシー
は、以下ドキュメントの手順で設定を変更することが可能です。

vCenter Single Sign-On のロックアウト ポリシーの編集
https://docs.vmware.com/jp/VMware-vSphere/7.0/com.vmware.vsphere.authentication.doc/GUID-2D25D311-AB56-40F4-9834-BC19A7D2EA3D.html

vCenter Single Sign-On(SSO) ユーザがアカウントロックされているか判断する方法

vSphere Client へログインしようとした際に、正しい認証情報を入力
しているにも関わらず、以下のようなエラーが表示されます。
「無効な認証情報」

ログを確認すると、アカウント(今回は test-sso@vsphere.local) がロックされて
いるとの記録が確認できます。(User accoun locked.)

2023-05-28T12:01:12.003Z ERROR websso[40:tomcat-http--3] [CorId=c55692bf-76fe-421d-ab5f-9947c32ddf9c] [com.vmware.identity.idm.server.IdentityManager] 
Failed to authenticate principal [test-sso@vsphere.local] for tenant [vsphere.local] javax.security.auth.login.LoginException: Login failed
:
2023-05-28T12:01:12.017Z INFO websso[40:tomcat-http--3] [CorId=c55692bf-76fe-421d-ab5f-9947c32ddf9c] [com.vmware.identity.diagnostics.VmEventAppender] EventLog: source=[VMware Identity Server], tenant=[vsphere.local], eventid=[USER_NAME_PWD_AUTH_FAILED], level=[ERROR], category=[VMEVENT_CATEGORY_STS], text=[ParameterizedMessage[messagePattern=Failed to authenticate principal [{}]. User account locked., stringArgs=[test-sso@vsphere.local], throwable=null]], detailText=[null], corelationId=[c55692bf-76fe-421d-ab5f-9947c32ddf9c], timestamp=[1685275272017]
2023-05-28T12:01:12.017Z ERROR websso[40:tomcat-http--3] [CorId=c55692bf-76fe-421d-ab5f-9947c32ddf9c] [com.vmware.identity.idm.server.IdentityManager] Failed to authenticate principal [test-sso@vsphere.local]. User account locked.
2023-05-28T12:01:12.017Z INFO websso[40:tomcat-http--3] [CorId=c55692bf-76fe-421d-ab5f-9947c32ddf9c] [com.vmware.identity.idm.server.IdentityManager] Authentication failed for user [test-sso@vsphere.local] in tenant [vsphere.local] in [43] milliseconds with provider [vsphere.local] of type [com.vmware.identity.idm.server.provider.vmwdirectory.VMwareDirectoryProvider]
2023-05-28T12:01:12.017Z ERROR websso[40:tomcat-http--3] [CorId=c55692bf-76fe-421d-ab5f-9947c32ddf9c] [com.vmware.identity.idm.server.ServerUtils] Exception 'com.vmware.identity.idm.UserAccountLockedException: User account locked: {Name: test-sso, Domain: vsphere.local}'
com.vmware.identity.idm.UserAccountLockedException: User account locked: {Name: test-sso, Domain: vsphere.local}
:
2023-05-28T12:01:12.024Z ERROR websso[40:tomcat-http--3] [CorId=c55692bf-76fe-421d-ab5f-9947c32ddf9c] [com.vmware.identity.samlservice.impl.CasIdmAccessor] Caught exception.
com.vmware.identity.idm.UserAccountLockedException: User account locked: {Name: test-sso, Domain: vsphere.local}
:
2023-05-28T12:01:12.030Z INFO websso[40:tomcat-http--3] [CorId=c55692bf-76fe-421d-ab5f-9947c32ddf9c] [auditlogger] {"user":"test-sso@vsphere.local","client":"192.168.0.11","timestamp":"05/28/2023 12:01:12 GMT","description":"User test-sso@vsphere.local@192.168.0.11 failed to log in with response code 401","eventSeverity":"INFO","type":"com.vmware.sso.LoginFailure"}
2023-05-28T12:01:12.030Z ERROR websso[40:tomcat-http--3] [CorId=c55692bf-76fe-421d-ab5f-9947c32ddf9c] [com.vmware.identity.samlservice.AuthnRequestState] Caught Exception from authenticate com.vmware.identity.samlservice.SamlServiceException
2023-05-28T12:01:12.030Z INFO websso[40:tomcat-http--3] [CorId=c55692bf-76fe-421d-ab5f-9947c32ddf9c] [com.vmware.identity.samlservice.impl.SAMLAuthnResponseSender] Responded with ERROR 401 message 無効な認証情報
2023-05-28T12:01:12.030Z INFO websso[40:tomcat-http--3] [CorId=c55692bf-76fe-421d-ab5f-9947c32ddf9c] [com.vmware.identity.BaseSsoController] End processing SP-Initiated SSO response. Session not created.

以下のログからは、”192.168.0.11″ の IP アドレスを持つ、端末から
ログインに失敗しているということが分かります。

2023-05-28T12:00:39.319Z {"user":"test-sso@vsphere.local","client":"192.168.0.11","timestamp":"05/28/2023 12:00:39 GMT","description":"User test-sso@vsphere.local@192.168.0.11 failed to log in with response code 401","eventSeverity":"INFO","type":"com.vmware.sso.LoginFailure"}
2023-05-28T12:00:41.163Z {"user":"test-sso@vsphere.local","client":"192.168.0.11","timestamp":"05/28/2023 12:00:41 GMT","description":"User test-sso@vsphere.local@192.168.0.11 failed to log in with response code 401","eventSeverity":"INFO","type":"com.vmware.sso.LoginFailure"}
2023-05-28T12:00:42.628Z {"user":"test-sso@vsphere.local","client":"192.168.0.11","timestamp":"05/28/2023 12:00:42 GMT","description":"User test-sso@vsphere.local@192.168.0.11 failed to log in with response code 401","eventSeverity":"INFO","type":"com.vmware.sso.LoginFailure"}
2023-05-28T12:00:44.153Z {"user":"test-sso@vsphere.local","client":"192.168.0.11","timestamp":"05/28/2023 12:00:44 GMT","description":"User test-sso@vsphere.local@192.168.0.11 failed to log in with response code 401","eventSeverity":"INFO","type":"com.vmware.sso.LoginFailure"}
2023-05-28T12:00:45.323Z {"user":"test-sso@vsphere.local","client":"192.168.0.11","timestamp":"05/28/2023 12:00:45 GMT","description":"User test-sso@vsphere.local@192.168.0.11 failed to log in: Forbidden","eventSeverity":"INFO","type":"com.vmware.sso.LoginFailure"}
2023-05-28T12:00:56.290Z {"user":"test-sso@vsphere.local","client":"192.168.0.11","timestamp":"05/28/2023 12:00:56 GMT","description":"User test-sso@vsphere.local@192.168.0.11 failed to log in with response code 401","eventSeverity":"INFO","type":"com.vmware.sso.LoginFailure"}
2023-05-28T12:00:58.139Z {"user":"test-sso@vsphere.local","client":"192.168.0.11","timestamp":"05/28/2023 12:00:58 GMT","description":"User test-sso@vsphere.local@192.168.0.11 failed to log in with response code 401","eventSeverity":"INFO","type":"com.vmware.sso.LoginFailure"}
2023-05-28T12:00:59.720Z {"user":"test-sso@vsphere.local","client":"192.168.0.11","timestamp":"05/28/2023 12:00:59 GMT","description":"User test-sso@vsphere.local@192.168.0.11 failed to log in with response code 401","eventSeverity":"INFO","type":"com.vmware.sso.LoginFailure"}
2023-05-28T12:01:12.030Z {"user":"test-sso@vsphere.local","client":"192.168.0.11","timestamp":"05/28/2023 12:01:12 GMT","description":"User test-sso@vsphere.local@192.168.0.11 failed to log in with response code 401","eventSeverity":"INFO","type":"com.vmware.sso.LoginFailure"}

vCenter Single Sign-On(SSO) ユーザのアカウントロックを解除する方法

ロックが解除されるまで 300 秒間待つ、または以下 KB2146224
の手順でロックを解除させることが可能です。

How to unlock and reset SSO password in vSphere 6.x/7.x using the vdcadmintool (2146224)
https://kb.vmware.com/s/article/2146224?lang=en_us
-> Process to Unlock SSO Password:

vCenter Server Appliance ローカルユーザー(root) のロックアウトポリシー

ローカルの root ユーザーのロックアウトポリシーは、デフォルトで
ログインに 3 回失敗すると、300 秒間アカウントがロックされる動作
となっています。

root ユーザーのロックアウトポリシーの設定変更方法

vCenter Server Appliance の root ユーザーのロックアウトポリシー
を変更する方法については、vSphere のドキュメント等で公開されて
いる情報は確認することができませんでした。(2023/05 時点)

確認した範囲では /etc/pam.d/system-auth にて設定が行われて
いますが、こちらを変更する場合は自己責任となります。

# Begin /etc/pam.d/system-auth
# Updated by Ansible - 2021-07-02T06:43:17.974423

auth       required pam_unix.so
auth       required pam_tally2.so deny=3 onerr=fail audit even_deny_root unlock_time=900 root_unlock_time=300
auth       optional pam_faildelay.so delay=4000000

# End /etc/pam.d/system-auth

ただし、参考までとはなりますが VMware Cloud Foundtion の
ドキュメントでは情報が記載されていました。

VMware Cloud Foundation でのアカウントロックアウトポリシーの構成
https://docs.vmware.com/jp/VMware-Cloud-Foundation/4.5/vcf-operations/GUID-8777824B-E050-4BA2-8607-3E84CCF12ED9.html
-> vCenter Server の root ユーザーアカウントロックアウトポリシーの構成

root ユーザーがアカウントロックされているか判断する方法

root ユーザーがロックされている場合、DCUI からログインを試行すると
[Account locked due to XX failed logins] のようなメッセージが表示
されます。

また、VAMI 等でも正しい認証情報を入力しているにも関わらず、ログイン
に失敗します。

以下のコマンドの Failures にて、ログイン失敗回数を確認できます。

root@ss181 [ / ]# pam_tally2 --user root
Login           Failures Latest failure     From
root               12    06/04/23 15:30:18  unknown

ログからを確認すると以下のような出力が確認できます。

2023-06-04T15:25:04.394: INFO AuthenticationResult = { authenticated=True,  userid=False username=root, role=superAdministrator, renew=False, auth_method=LOCAL }
2023-06-04T15:25:06.542: INFO User Password Authentication request for user : root
2023-06-04T15:25:10.529: ERROR Authentication Status : Failed
2023-06-04T15:25:44.202: INFO User Password Authentication request for user : root
2023-06-04T15:25:47.284: ERROR Authentication Status : Failed
2023-06-04T15:25:48.749: INFO User Password Authentication request for user : root
2023-06-04T15:25:52.927: ERROR Authentication Status : Failed
2023-06-04T15:25:54.292: INFO User Password Authentication request for user : root
2023-06-04T15:25:59.451: ERROR Authentication Status : Failed
2023-06-04T15:26:00.996: INFO User Password Authentication request for user : root
2023-06-04T15:26:05.132: ERROR Authentication Status : Failed
2023-06-04T15:26:06.773: INFO User Password Authentication request for user : root
2023-06-04T15:26:11.230: ERROR Authentication Status : Failed
2023-06-04T15:26:12.708: INFO User Password Authentication request for user : root
2023-06-04T15:26:18.149: ERROR Authentication Status : Failed

2023-06-04T15:25:03.010816+00:00 ss181 sshd[54095]: Accepted keyboard-interactive/pam for root from 192.168.0.11 port 55739 ssh2
2023-06-04T15:25:03.011776+00:00 ss181 sshd[54095]: pam_unix(sshd:session): session opened for user root by (uid=0)
2023-06-04T15:25:06.561573+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:25:44.220900+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:25:48.767997+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:25:54.311679+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:25:54.311828+00:00 ss181 python: pam_tally2(passwd:auth): user root (0) tally 4, deny 3
2023-06-04T15:26:01.015187+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:26:01.016284+00:00 ss181 python: pam_tally2(passwd:auth): user root (0) tally 5, deny 3
2023-06-04T15:26:06.791804+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:26:06.793825+00:00 ss181 python: pam_tally2(passwd:auth): user root (0) tally 6, deny 3
2023-06-04T15:26:12.726685+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:26:12.728044+00:00 ss181 python: pam_tally2(passwd:auth): user root (0) tally 7, deny 3
2023-06-04T15:26:22.832200+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:26:22.834733+00:00 ss181 python: pam_tally2(passwd:auth): user root (0) tally 8, deny 3
2023-06-04T15:26:29.215930+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:26:29.216750+00:00 ss181 python: pam_tally2(passwd:auth): user root (0) tally 9, deny 3
2023-06-04T15:26:37.849956+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:26:37.852423+00:00 ss181 python: pam_tally2(passwd:auth): user root (0) tally 10, deny 3
2023-06-04T15:26:46.903810+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:26:46.905336+00:00 ss181 python: pam_tally2(passwd:auth): user root (0) tally 11, deny 3

2023-06-04T15:25:03.010816+00:00 ss181 sshd[54095]: Accepted keyboard-interactive/pam for root from 192.168.0.11 port 55739 ssh2
2023-06-04T15:25:03.011776+00:00 ss181 sshd[54095]: pam_unix(sshd:session): session opened for user root by (uid=0)
2023-06-04T15:25:06.561573+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:25:44.220900+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:25:48.767997+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:25:54.311679+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:25:54.311828+00:00 ss181 python: pam_tally2(passwd:auth): user root (0) tally 4, deny 3
2023-06-04T15:26:01.015187+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:26:01.016284+00:00 ss181 python: pam_tally2(passwd:auth): user root (0) tally 5, deny 3
2023-06-04T15:26:06.791804+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:26:06.793825+00:00 ss181 python: pam_tally2(passwd:auth): user root (0) tally 6, deny 3
2023-06-04T15:26:12.726685+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:26:12.728044+00:00 ss181 python: pam_tally2(passwd:auth): user root (0) tally 7, deny 3
2023-06-04T15:26:22.832200+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:26:22.834733+00:00 ss181 python: pam_tally2(passwd:auth): user root (0) tally 8, deny 3
2023-06-04T15:26:29.215930+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:26:29.216750+00:00 ss181 python: pam_tally2(passwd:auth): user root (0) tally 9, deny 3
2023-06-04T15:26:37.849956+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:26:37.852423+00:00 ss181 python: pam_tally2(passwd:auth): user root (0) tally 10, deny 3
2023-06-04T15:26:46.903810+00:00 ss181 python: pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root
2023-06-04T15:26:46.905336+00:00 ss181 python: pam_tally2(passwd:auth): user root (0) tally 11, deny 3

なお、root ユーザーがロックされている状態で、ログを確認する場合、
Administrator@vsphere.local ユーザーを使用して SSH 接続を実施
の上、確認することが可能です。

[SystemConfiguration.BashShellAdministrators] グループに属して
いるユーザーは、Bash シェルへアクセスできるようになるため、
当該グループに予めユーザーを追加しておくことでも確認可能です。

root ユーザーのアカウントロックを解除する方法

ロックが解除されるまで 300 秒間待つ

ロックが解除されるまで 300 秒間大人しく待つのが特に操作も必要
無く、一番無難かと思います。

コマンドで解除する

Administrator@vsphere.local ユーザーを使用し、Bash シェルへ
接続の後、コマンドでロックを解除することが可能です。

SS@MacBookPro ~ % ssh administrator@vsphere.local@192.168.0.181

VMware vCenter Server 7.0.3.01000

Type: vCenter Server with an embedded Platform Services Controller

(administrator@vsphere.local@192.168.0.181) Password:
Last login: Sun Jun  4 15:45:58 2023 from 192.168.0.11
Connected to service

    * List APIs: "help api list"
    * List Plugins: "help pi list"
    * Launch BASH: "shell"

Command> shell.set --enabled true
Command> shell
    ---------- !!!! WARNING WARNING WARNING !!!! ----------

Your use of "pi shell" has been logged!

The "pi shell" is intended for advanced troubleshooting operations and while
supported in this release, is a deprecated interface, and may be removed in a
future version of the product.  For alternative commands, exit the "pi shell"
and run the "help" command.

The "pi shell" command launches a root bash shell.  Commands within the shell
are not audited, and improper use of this command can severely harm the
system.

Help us improve the product!  If your scenario requires "pi shell," please
submit a Service Request, or post your scenario to the
vCenter™ Server Discussions
communities.vmware.com forum and add
"appliance" tag.

sso-user@ss181 [ ~ ]$ sudo pam_tally2 --user root
Login           Failures Latest failure     From
root               26    06/04/23 15:55:41  unknown
sso-user@ss181 [ ~ ]$ sudo pam_tally2 --user root --reset
Login           Failures Latest failure     From
root               26    06/04/23 15:55:41  unknown
sso-user@ss181 [ ~ ]$ sudo pam_tally2 --user root
Login           Failures Latest failure     From
root                0
sso-user@ss181 [ ~ ]$

※※※※※※※※※※※※※※※※※※※※※※※※※※※※※※※※※※※※※※

vCSA 8.0 U2以降のバージョンでは pam_tally2 コマンドが廃止され、
faillock コマンドを使用します。

Resetting root password in vCenter Server Appliance 6.5 / 6.7 / 7.x / 8.x (2147144)
https://kb.vmware.com/s/article/2147144
-> Changes in 8.0 U2 and above versions: