Account and Password Best Practices in Dell VxRail

Accounts used during initial deployment:

   

1. vCenter administrator account

2. Management account

3. vCenter and PSC root account

4. ESXi host root account:

Account naming restrictions

1. vCenter administrator account
   • For internal VC, it is fixed to administrator@vsphere.local, no other restrictions.
   • For external VC, it is provided by the customer. There is no restriction from the VxRail Manger point of view.

2. Management account
   • For internal VC, it is chosen by the customer at initial deployment. The account name must comply with restrictions by PSC and ESXi hosts.
   • For external VC, it is provided by the customer. The account name must comply with restrictions by PSC and ESXi hosts.

• PSC restrictions:
  • For the localos domain: Match the regular expression
    • [A-Za-z_][A-Za-z0-9_.-]*[A-Za-z0-9_.$-]?, up to 32 characters.
  • For a customer-specified domain: Follow the restrictions in the specific domain.
• ESXi restrictions: Match the regular expression
  • [A-Za-z_][A-Za-z0-9_-]*[A-Za-z0-9_$-]?, up to 16 characters.

3. vCenter and PSC root account

4. ESXi system root account

Password restrictions

General suggestions for all the accounts: Avoid using special characters in a password, such as / ? ; , . | \ ' " & $ = ` < #  ! -

1. vCenter administrator password:

• vCenter software restriction: VC password policy
• VM system policy: See Linux default password restriction
• VxRail Manager code restrictions: VxRail: Special characters in password cause OVA auto deployment failed (Internal restricted article)

2. Management password
   • For internal VC, the management account is chosen by the customer at initial deployment. The account name must comply with restrictions by PSC and ESXi hosts.
   • For external VC, the account is provided by the customer. The password should comply with restrictions on the PSC and ESXi host.

• PSC VM system policy: See Linux default password restriction
• ESXi restriction: ESXi password policy, blank space not allowed
• From release 4.0.0 to 4.0.200, the Secure Remote Services admin password is aligned with the management password. The password must comply with Secure Remote Services admin password rules as well. Reference VxRail: Fail to update management account password when Secure Remote Services is enabled.

3. vCenter and PSC root account

4. ESXi host root account 

 

iDRAC:  

For iDRAC9, the iDRAC secure password is available on the back of the system information tag (Service Tag) under iDRAC Default Password. See article: What is the default username and password for Integrated Dell Remote Access Controller (iDRAC) for more information.

Some simple passwords may no longer work. For instance, in the screenshot below, the reason the default password of "calvin" is no longer accepted, is because of a password security setting for the iDRAC. See KB article Dell Technologies VxRail: iDRAC settings that cannot be changed for more information.

For Example: At the moment, you cannot set the iDRAC password to the old "calvin" default. This is prevented since the iDRAC password Policy Setting is *not* set to "0 - No Protection":  iDRAC -> iDRAC Settings -> Users -> Global User Settings -> Password Settings -> Policy Settings -> Minimum Score = "0 - No Protection"

Changing iDRAC policy settings may cause upgrade failures.

The passwords for the vCenter administrator account and the vCenter and PSC root account should be aligned all the time. Password inconsistency leads to node replacement and single node addition procedure failures.

Related Resources
Here are some recommended resources related to this topic that might be of interest to you.

• Dell VxRail: Changing VxRail Service VM passwords
• Resetting the root password for Dell VxRail Manager
• Dell VxRail: Deployment fails at step 27 "Creating management account on vCenter Server…"
• VxRail: Event code: VXR124014 - PSC management account password is invalid
• Dell VxRail: How to collect the VxRail Manager log bundle on VxRail 4.7.x and 7.x