hxcli commands prompt for login credentials.

The Admin Shell password for the predefined users admin and root are specified during HX Data Platform installer. After installation you can change passwords through the hxcli command line.

When a user attempts to login with wrong credentials for 10 successive times, the account will be locked for two minutes. If the failed login attempts were made through SSH, the error message will not indicate that the account is locked. If the failed login attempts were made through HX Connect or REST API, the error message during the 10th attempt will indicate that the account is locked.

Most printable and extended ASCII characters are acceptable for use in names and passwords. Certain characters are not allowed in HX Data Platform user names, passwords, virtual machine names, storage controller VM names, and datastore names. Folders and resource pools do not have character exceptions.

Passwords must contain a minimum of 10 characters, with at least 1 lowercase, 1 uppercase, 1 numeric, and 1 of the following characters:

ampersand (&), apostrophe ('), asterisk (*), at sign (@), back slash (\), colon (:), comma (,), dollar sign ($), exclamation (!), forward slash (/), less than sign (<), more than sign (>), percent (%), pipe (|), pound (#), question mark (?), semi-colon (;)

When entering special characters, consider the shell being used. Different shells have different sensitive characters. If you have special characters in your names or passwords, place them in a single quote, 'speci@lword!'. It is not required to place passwords within single quotes in the HyperFlex Installer password form field.

HX Storage Cluster Name

HX cluster names cannot exceed 50 characters.

HX Storage Cluster Host Names

HX cluster host names cannot exceed 80 characters.

Virtual Machine and Datastore Names

Most characters used to create a virtual machine name, controller VM name, or datastore name are acceptable. Escaped characters are acceptable for virtual machine, controller VM names, or datastore names.

Maximum characters―Virtual machine names can have up to 80 characters.

Excluded characters―Do not use the following character in any user virtual machine name or datastore name for which you want to enable snapshots.

• accent grave (`)

Special characters―The following special characters are acceptable for user virtual machine or datastore names:

• ampersand (&), apostrophe ('), asterisk (*), at sign (@), back slash (\), circumflex (^), colon (:), comma (,), dollar sign ($), dot (.), double quotation ("), equal sign (=), exclamation (!), forward slash (/), hyphen (-), left curly brace ({), left parentheses ((), left square bracket ([), less than sign (<), more than sign (>), percent (%), pipe (|), plus sign (+), pound (#), question mark (?), right curly brace (}), right parentheses ()), right square bracket (]), semi-colon (;), tilde (~), underscore (_)

Username Requirements

Usernames can be specific to the HX Data Platform component and must meet UCS Manager username requirements.

UCS Manager username requirements.

• Number of characters: between 6 and 32 characters

• Must be unique within Cisco UCS Manager.

• Must start with an alphabetic character.

• Must have alphabetic characters (upper or lower case).

• Can have numeric characters. Cannot be all numeric characters.

• Special characters: Limited to underscore (_), dash (-), and dot (.)

Controller VM Password Requirements

The following rules apply to controller VM root and admin user passwords.

Note	General rule about passwords: Do not include them in a command string. Allow the command to prompt for the password.

• Minimum Length: 10

• Minimum 1 Uppercase

• Minimum 1 Lowercase

• Minimum 1 Digit

• Minimum 1 Special Character

• A maximum of 3 retry to set the new password

To change a controller VM password, always use the hxcli command. Do not use another change password command, such as a Unix password command.

1. Log into the management controller VM.

2. Run the hxcli command.

   hxcli security password set [-h] [--user USER]

   The change is propagated to all the controller VMs in the HX cluster.

UCS Manager and ESX Password Format and Character Requirements

The following is a summary of format and character requirements for UCS Manager and VMware ESXi passwords. See the Cisco UCS Manager and VMware ESX documentation for additional information.

• Characters classes: lower case letters, upper case letters, numbers, special characters.

  Passwords are case sensitive.

• Character length: Minimum 6, maximum 80

  Minimum 6 characters required, if characters from all four character classes.

  Minimum 7 characters required, if characters from at least three character classes.

  Minimum 8 characters required, if characters from only one or two character classes.

• Start and end characters: An upper case letter at the beginning or a number at the end of the password do not count toward the total number of characters.

  If password starts with uppercase letter, then 2 uppercase letters are required. If password ends with a digit, then 2 digits are required.

  Examples that meet the requirements:

  h#56Nu - 6 characters. 4 classes. No starting upper case letter. No ending number.

  h5xj7Nu - 7 characters. 3 classes. No starting upper case letter. No ending number.

  XhUwPcNu - 8 characters. 2 classes. No starting upper case letter. No ending number.

  Xh#5*Nu - 6 characters counted. 4 characters classes. Starting upper case letter. No ending number.

  h#5*Nu9 - 6 characters counted. 4 characters classes. No starting upper case letter. Ending number.

• Consecutive characters: Maximum 2. For example, hhh###555 is not acceptable.

  Through vSphere SSO policy, this value is configurable.

• Excluded characters:

  UCS Manager passwords cannot contain the escape (\) character.

  ESX passwords cannot contain these characters.

  • Cannot be the username or the reverse of the username.

  • Cannot contain words found in the dictionary.

  • Cannot contain the characters escape (\), dollar sign ($), question mark (?), equal sign (=).

• Dictionary words:

  Do not use any words that can be found in the dictionary.

• Remote root access over ssh to any controller VM from outside the cluster is disabled. Only nodes part of the cluster can SSH as root to other nodes over the data network.

• If an ESX node is put in Maintenance Mode (MM) during or before consent token generation, the token will not be available on that SCVM and the sync utility will have to be invoked after the node exists MM and the SCVM is back online.

• If a root capable user exists in an HX Release 4.0(x) or earlier cluster, delete it before starting an upgrade to HX Release 4.5(1a). If the root capable user is not removed, the upgrade will not proceed.