### Human: Can you tell about NCC Health Check: default_password_check, pc_default_password_check and file_server_default_password_check. ### Assistant: The NCC health checks default_password_check, pc_default_password_check and file_server_default_password_check cover changing the default passwords on the Nutanix CVM (Controller VM), hypervisor, Prism Central (PC), File Server VMs and IPMI.. The NCC health checks default_password_check, pc_default_password_check and file_server_default_password_check verify if there are any CVMs (Controller VMs), hosts, IPMIs, Prism Central (PC) instances, or File Server VMs with the default credentials.

To secure your Nutanix cluster, Nutanix recommends changing the default passwords. This includes, but is not limited to:

The Nutanix Controller VM (CVM)
	The local 'nutanix' user account
	The Installed Hypervisor:
	For AHV, the local 'root', 'admin', and 'nutanix' accounts. This has been introduced in NCC-4.1.0 and above and AOS 5.15.5, 5.19.0.5, 5.20 and above.For ESXi, the local 'root' user accountFor Hyper-V, the local 'administrator' user account
	Prism Central
	The 'admin' Prism GUI user accountThe local 'nutanix' user account
	The Out-of-Band Management (IPMI)
	The 'ADMIN' user account
	The File Server VMs (FSVMs)
	The 'nutanix' user account
	

Note: The password checks are done on the CVMs, Prism Central, AHV, and ESXi by reading the file "/etc/shadow" for hash comparison. Some security monitoring software (e.g. Splunk) may alert that the /etc/shadow is being accessed. You may disable this check if there are security concerns with this file being read.

Running the NCC checkYou can run this check from any CVM as part of the complete NCC Health Checks:

ncc health_checks run_all

Or you can also run the appropriate check separately depending on whether you are executing on a Controller VM (CVM):

ncc health_checks run_all

Or on a Prism Central VM (PCVM):

ncc health_checks run_all

Or on a File Server VM (FSVM):

ncc health_checks run_all

You can also run the checks from the Prism web console Health page: select Actions > Run Checks. Select All checks and click Run.

This check is scheduled to run every 7 days.

This check generates an alert after 1 failure.

Sample outputFor status: PASS

ncc health_checks run_all

For status: INFO (default IPMI passwords in use)

ncc health_checks run_all

From NCC 4.3.0.1 onwards, the check results in FAIL and shows a CRITICAL alert if CVMs/hosts/IPMI is configured with a default password.For status: FAIL

ncc health_checks run_all

From NCC 4.6.0 onwards, the check messaging has changed to reflect the host type and user accounts where the default password needs to be updated.For status: FAIL

ncc health_checks run_all

From NCC 4.6.0 onwards, the check messaging also reports a FAIL if File Server VMs (FSVMs) are configured with the default password:

ncc health_checks run_all

Output messaging

Check ID6213DescriptionCVM is using the default passwordCauses of failureSSH access credentials have not changed from the shipped default.ResolutionsEnsure that all CVMs are using a custom password for improved security.ImpactInsecure configuration.Alert IDA6213Alert TitleCVM using default passwordAlert Smart TitleCVM <CVM_IP> is using default passwordAlert MessagePlease update the default password on CVM for user(s): {users} to harden the security on the clusters. Nutanix highly recommends not using default passwords for clusters.

Check ID6214DescriptionHost is using the default passwordCauses of failureSSH access credentials have not changed from the shipped default.ResolutionsEnsure that all hosts are using a custom password for improved security.ImpactInsecure configuration - Using default passwords could expose your system to unauthorized access.Alert IDA6214Alert TitleHost using the default passwordAlert Smart TitleHost <HOST_IP> is using default passwordAlert MessagePlease update the default password on {host_type} host for user(s): {users} to harden the security on the clusters. Nutanix highly recommends not using default passwords for clusters.

Check ID15037DescriptionIPMI is using default passwordCauses of failureSSH access credentials have not changed from the shipped default.ResolutionsEnsure that all IPMI devices use a custom password for improved security.ImpactInsecure configuration - Using default passwords could expose your system to unauthorized access.Alert IDA15037Alert TitleIPMI <IPMI_IP> is using default passwordAlert Smart TitleIPMI using the default passwordAlert MessagePlease update the default password on IPMI devices for user(s): {users} to harden the security on the clusters. Nutanix highly recommends not using default passwords for clusters.

Check ID111050DescriptionPC is using the default passwordCauses of failureSSH access credentials have not changed from the shipped default.ResolutionsEnsure that Prism Central is using a custom password for improved security.ImpactInsecure configuration - Using default passwords could expose your system to unauthorized access.Alert IDA111050Alert TitlePrism Central uses the default passwordAlert Smart TitlePrism Central <PC_IP> using default passwordAlert MessagePlease update the default password on PC for user(s): {users} to harden the security on the clusters. Nutanix highly recommends not using default passwords for cluster

Check ID160145DescriptionFile Server is using default password.Causes of failureSSH access credentials have not changed from the shipped.ResolutionsEnsure that all FSVMs are using a custom password for improved security.ImpactInsecure configuration - Using default passwords could expose your system to unauthorized access.Alert IDA160145Alert TitleFile Server using default passwordAlert Smart TitleFile Server {file_server_name} VM {fsvm_ips} is using default passwordAlert MessagePlease update the same custom password on FSVM(s) {fsvm_ips} of File Server {file_server_name} for account nutanix to harden the security of the clusters. Nutanix highly recommends not using default passwords for clusters.. NOTE: From NCC 4.6.4, Dell, HPE, Lenovo and Fujitsu hardware throws the following error for the check 'default_password_check':

ERR : Error fetching IPMI user list.
This is a False positive. Please upgrade NCC to 4.6.5 to resolve the issue.

If a cluster has elevated security enabled (hardened system), the password complexity requirements will be increased. See the Nutanix Security Guide document for further guidance. From NCC-4.3.0.1, the check's severity has been changed to CRITICAL/FAIL. Use the below commands to update the passwords for the user entities used for CLI access on host/CVM/PCVM and the user for Web UI access for IPMI. The Nutanix Controller VM (CVM) 'nutanix' AccountUse the below command (run from any CVM) to change the CVM 'nutanix' user password. The change will be automatically replicated to the other CVMs in the cluster. This will change the 'nutanix' user password for all CVMs.

ERR : Error fetching IPMI user list.

The Hypervisor Local Accounts

AHV

	The following three commands help to change the password for the root, admin, and nutanix accounts at the AHV host level and on all the hosts in the cluster. Do not modify the command. It will ask for the new password twice and will not display it.		Use the below command to change the local 'root' account password for all AHV hypervisors in the Nutanix cluster. This can run from any CVM in the cluster.

	ERR : Error fetching IPMI user list.

	Use the below command to change the local 'admin' account password for all AHV hypervisors in the Nutanix cluster. This can run from any CVM in the cluster.

	ERR : Error fetching IPMI user list.

	Use the below command to change the local 'nutanix' account password for all AHV hypervisors in the Nutanix cluster. This can run from any CVM in the cluster.

	ERR : Error fetching IPMI user list.

	Refer to the AHV Host Access chapter of the AHV Administration Guide for more information about root, admin, and nutanix accounts and the steps to change passwords for these accounts.		Note: If password change fails on one or more hosts with the "passwd: Have exhausted maximum number of retries for service" error, it may indicate that provided password does not comply with the password policy. Try logging in to the affected AHV host and manually changing the password.
	VMware ESXi
	Use the below command to change the local root password for all ESXi hypervisors in the Nutanix cluster. This can run from any CVM in the cluster. Do not modify the command. It will ask for the new password twice and will not display it.

	ERR : Error fetching IPMI user list.
	Microsoft Hyper-V
	Use the below command to change the local administrator password for all Hyper-V hypervisors in the Nutanix cluster. This can run from any CVM in the cluster. Do not modify the command. It will ask for the new password twice and will not display it.

	ERR : Error fetching IPMI user list.

	Documentation: AOS 5.5.x (and later) Hyper-V Administration for Acropolis: Changing the Hyper-V Host Password
	

The Prism Element and Prism Central 'admin' and 'nutanix' Accounts

The initial login will guide you through a password change for the 'admin' account for Prism Central and Prism Element. Note that making the password change on any Prism Element will automatically change the rest of the Prism Elements in the cluster.

For the Prism Central local 'nutanix' user account:

SSH into the Prism Central VM.Log in as user 'nutanix' with the default credentials.Enter the below command:
	ERR : Error fetching IPMI user list.
	Follow the prompts to enter a new password for the local 'nutanix' user.

For Prism Element admin account:

Log in to the Prism Element page and click on admin user at the top right corner.Click on "Change password" and enter a new password.

If you have forgotten the "admin" user password and are locked out of the account, you can change the password from CLI using the below command from any CVM/PCVM:

ERR : Error fetching IPMI user list.

Nutanix NX Host IPMI (Out-of-Band Management) 'ADMIN' AccountThe below command will change the IPMI 'ADMIN' user password across all hosts in the Nutanix cluster if the password is identical for all IPMIs. If the passwords are different, refer to IPMI Password Change to update the passwords directly from each host. Note that platforms with BMC version pre-3.40 cannot set passwords with special characters. If password recovery is needed, refer to IPMI Password Change. This can run from any CVM in the cluster. Change <CURRENT_PASSWORD> and <NEW_PASSWORD> to the appropriate values for your environment.

ERR : Error fetching IPMI user list.

Note: For nodes running BMC Firmware 7.0 or above, changing passwords that are longer than 16 characters requires adding "20" to the end of the command, or the remaining characters will be truncated. This can run from any CVM in the cluster. Change <CURRENT_PASSWORD> and <NEW_PASSWORD> to the appropriate values for your environment.

ERR : Error fetching IPMI user list.

Note: When you specify the new password, including special characters for bash (GNU Bourne-Again SHell), for example, ", ', !, $, and so on, escape them appropriately. The bash may expand the special meaning and generate a password string different from what you expect. For example, using ! followed by a number, the shell will replace it with a command from the bash history. Refer to the bash manual for details.

The Nutanix File Server VMs (FSVMs) 'nutanix' Account:

On the CVM, list File Server details:
	ERR : Error fetching IPMI user list.
	SSH to the File Server virtual IP address listed in the output above.Change the File Server VM password:
	ERR : Error fetching IPMI user list.
	. ### Human: Now explain this as a Nutanix support agent summarizing the answer step by step. In case, you don't know the answer say - I don't know.