Enable ssh root access for NSX appliances

Products

• VMware NSX

Issue/Introduction

• Prior to NSX-T 3.2.0, SSH root access can only be configured during the NSX manager deployment.
• Starting with NSX-T 3.2.0 and above, root SSH access can be configured/modified after deployment using the Admin CLI.

Environment

VMware NSX
VMware NSX-T Datacenter

Resolution

To allow root SSH access after deployment.

• SSH to the NSX manager as admin and run the command below, these are per appliance, so they need to be run on each appliance where you want to enable root SSH access:

  > set ssh root-login

• Check it is enabled, you can see Root login status is enabled below:

  > get service ssh
  Service name:      ssh
  Service state:     running
  Start on boot:     True
  Root login:        enabled

• To disable the direct root SSH, login to the NSX manager as user admin and run the commands below:

  > clear ssh root-login

• Check it is disabled, you can see Root login status is disabled below:

  > get service ssh
  Service name:      ssh
  Service state:     running
  Start on boot:     True
  Root login:        disabled

Note: If SSH to the NSX manager fails as admin also, the SSH service on the manager may be stopped.

 

There are three option to enable/start SSH, using central CLI on NSX manager or API to the NSX manager or vCenter console.

1. Central CLI on NSX manager, this option requires at least one NSX manager to have SSH enabled/started, if SSH is not enabled, the following steps will need to be done via the vCenter console or by API:
   1. SSH as admin to one of the NSX managers where SSH is enabled/started.
   2. Get a list of manager and edge UUID's: get nodes
   3. Then use the manager/edge UUID, for the node we want to start SSH on, in the following command: on <node-uuid> exec get service ssh
   4. It should return the status of the service and to start the service use: on <node-uuid> exec start service ssh
   5. Check it is running: on <node-uuid> exec get service ssh
      
      
2. API to the NSX manager:
   If there are no manager nodes with SSH enabled/started, you can use the below POST API to start the SSH service on the manager or edge node.
   • Manager: POST /api/v1/node/services/ssh?action=start
   • Edge: POST /api/v1/transport-nodes/{transport-node-id}/node/services/ssh?action=start
     
     Note: API 'GET /api/v1/transport-nodes' can be used to find the edge node UUID. For edges, the API can be sent to any manager, for managers, send the API to the manager you wish to start the SSH service on.
     
     
3. vCenter console:
   1. Login to the vCenter server web interface where the NSX manager is present and directly access the console of NSX manager. Login as user admin and run the command: start service ssh
   2. Run the command get service ssh to ensure service state shows as running. You can now SSH and connect to the NSX manager command line interface.

 Note: Accessing NSX nodes via root is under direction from Broadcom, such as the purposes of this KB.

Additional Information

To switch to the root user via admin cli, login to the NSX manager as admin and run the command below and enter the root password:

     > st en
     Password:

Note: To be able to connect to the NSX manager via WinSCP as user root, you need to enable the direct root login as per the steps mentioned above, you can not use admin for WinSCP.

Enable SSH on NSX managers

Enable SSH access to NSX Edge Nodes