Resetting root password on VCSA

Cause

For passwords that have expired, the default vCenter Server Appliance password expires after 90 days. For more information, see Change the Password and Password Expiration Settings of the Root User

Solution

For 6.5 / 6.7 / 7.x

・ Resetting root password in vCenter Server Appliance 6.5 / 6.7 / 7.x (2147144)

Take a snapshot or backup of the vCenter Server Appliance before proceeding.
Caution: Do not skip this step

Note: If the vCenter Appliance is on the same ESXi hosts it manages. Connect directly to the ESXi host that it is located on to perform these steps.
Reboot the vCenter Server Appliance.
After the VCSA Photon OS starts, press the e key to enter the GNU GRUB Edit Menu.
Locate the line that begins with the word Linux.
Append these entries to the end of the line:
rw init=/bin/bash
Press F10 to continue booting.
Run the command
mount -o remount,rw /
In the Command prompt, enter the command passwd and provide a new root password (twice for confirmation):
passwd
Unmount the filesystem by running this command (yes, the unmount command is umount - it's not a spelling error):
umount /
Reboot the vCenter Server Appliance by running this command:
reboot -f
Confirm that you can access the vCenter Server Appliance using the new root password.
Remove the snapshot taken in Step 1 if applicable.
You could set the Root password to never expire in order to prevent this issue by running command:
chage -I -1 -m 0 -M 99999 -E -1 root or set at the VAMI ( https://<vcenter_fqdn>:5480).

For 6.7 U1 and later

・ How to reset the lost or forgotten root password in vCenter Server Appliance 6.7 U1 and later (75174)

With the change within VCSA 6.7 U1, the SSO user who is part of SystemConfiguration.BashShellAdministrator group will be able to log in to Bash shell and can call any commands using sudo and without password. This aims at reducing the gap between the root and SSO administrator user. The user has to enable shell to log in to the bash shell. By default, the user will be logged into appliance shell.

Connect SSH to VCSA 6.7 and login using administrator@vsphere.local where vsphere.local is your default SSO Domain.
- If disabled, enable SSH using the VAMI ( https://<vcenter_fqdn>:5480 ).
- Can login as administrator@vphere.local or any other member of the SSO administrators group.
- Enable or Disable SSH and Bash Shell Access.
If first time logging in, enable shell then enter shell.
- shell.set --enable true
- shell
Once in shell as sso-user, run the below command to change to root shell.
- sudo -i
- Alternately, you could use the command: sudo passwd root
Then once in root shell, run passwd to change the root password.
- passwd
Now you can exit the session by running the exit or logout command and then log in through a new SSH session using your root account with updated password. Alternatively, you could run the su command in order to be prompted for the root password and get access as root.