Enabling Secure Shell (SSH) Access for Local Users/Domain or AD Users/Groups users on vSphere ESXi Hosts (7.x/8.x)

Products

• VMware vSphere ESXi

Issue/Introduction

When attempting to establish an SSH connection to the ESXi host using PuTTY with a non-root user account, the connection fails with the error message 'No Supported authentication methods available (server sent: publickey, keyboard-interactive).'

Environment

VMware vSphere ESXi

Resolution

As a workaround to grant SSH access to a local/Domain user or  AD Users/Groups, please follow the steps below:

1. Log in to the ESXi host client
   
   
2. Navigate to Manage>Security & users> Users> Add user (Add desired user name and password)
   
   
   
   
   
   
3. Right click on the Host> Permissions
4. Add the newly created user, assign a role to the user (For example read-only)
   
   
   
   
   
   
5. Log in to the ESXi host through SSH with the root account
6. To make changes to the access.conf:

   vi /etc/security/access.conf

    

   You will see an output similar to the below (Note: Test is can be a local/Domain Read-only user)

   # This file is autogenerated and must not be edited.
    +:dcui:ALL
    +:root:ALL
    +:vpxuser:ALL
    -:Test:ALL
    -:ALL:ALL

    

   1. Press I to edit
   2. Change "-:Test:ALL" to "+:Test:ALL"
   3. Press ESC
   4. Then press ":wq!" to save, and try to access the SSH using the locally configured user.
      
      
7. Retry to log in through another SSH with the newly created user

Additional Information

Please note that this workaround is not persistent. After each host reboot, the SSH access configuration for the specific local user must be reapplied to maintain the desired access.

With this method, we can provide Read and Write SSH access to any user created in ESXI, hence access cannot be restricted to Read-Only SSH.

However, since user is added in Read-Only group, user will have restricted access at UI level.