5.3 Ensure SSH is disabled


The ESXi shell, when enabled, can be accessed directly from the host console through the DCUI or remotely using SSH. Disable Secure Shell (SSH) for each ESXi host to prevent remote access to the ESXi shell, and only enable SSH when needed for troubleshooting or diagnostics.


Remote access to the host should be limited to the vSphere Client, remote command-line tools (vCLI/PowerCLI), and through the published APIs. Under normal circumstances, remote access to the host using SSH should be disabled.


In troubleshooting and assessment scenarios having SSH disabled, which is the default, may prevent connections to the host by tools or via other methods.


To disable SSH, perform the following:

From the vSphere Web Client, select the host.

Select Configure then expand System and select Services.

Click on SSH then click Edit Startup Policy.

Set the Startup Policy is set to Start and Stop Manually.

Click OK.

While ESXi Shell is still selected click Stop.

Alternately, use the following PowerCLI command:

# Set SSH to start manually rather than automatically for all hosts
Get-VMHost | Get-VMHostService | Where { $_.key -eq 'TSM-SSH' } | Set-VMHostService -Policy Off

See Also