Scenario

• Product: ZCF
• Component: ZStack Cloud
• Version: 5.4.x
• Operating system: H84r
• Deployment: Dual management nodes
• Trigger: VM VNC console passwords require security hardening.

Symptoms

• The environment needs stronger VM VNC console access security.
• Passwords can be set manually in the UI or distributed through a script.
• The change affects host parameters and console passwords only and should not affect existing VM workloads.

Assessment

1. Determine whether passwords will be set manually per VM or with the batch script.
2. Restart VMs after setting passwords and verify that console passwords take effect.
3. Verify that workloads and platform high availability return to normal.

Cause

This hardening adds password protection to VM consoles. KVM VNC has a hard password-length limit. A password longer than 8 characters does not take effect even when configuration succeeds, so enforce the limit before distribution.

Resolution

1. Preparation

• Risk level: Low.
• Disable or defer VM high-availability policy.
• Confirm whether to use UI-based manual configuration or the batch script.

2. Set the VNC console password
3. Option 1: Set the console password manually for a VM in the UI.

• Expected result: Individual or small numbers of VMs are hardened manually.

2. Option 2: Upload the batch script to the VIP node.

• Expected result: Batch hardening is ready.

3. Run on the VIP node:

      bash ./SetVmconsole.sh -p <management_node_password> -s <controller_password>

• Expected result: Console passwords are distributed in batches.

4. Note:

      KVM VNC supports passwords of no more than 8 characters; longer passwords do not take effect.

• Expected result: Password length meets the effective limit.

3. Verify and close out
4. Restart the VM in the UI.

• Expected result: The new console password takes effect after VM restart.

2. Check workload status.

• Expected result: Console hardening does not affect workload operation.

3. Log in to the management-platform Web UI and re-enable high-availability policy.

• Expected result: Normal platform policy is restored.

Verification

• Verify that VM console access requests the new password.
• Verify that the password contains no more than 8 characters and works.
• Verify normal workloads after VM restart.
• Verify that platform high availability is re-enabled.

Risks and rollback

• Risk: A password longer than 8 characters does not take effect for VNC.
• Risk: Failing to verify after VM restart can leave a console-access issue undiscovered.
• Risk level: Low.
• Rollback: Log in to the management node and use the safe script to restore the rule.