Unable to SSH as root user to the ESXi host

Products

• VMware vSphere ESXi

Issue/Introduction

• SSH using root account fails. However, we can login to DCUI and Host Client with the root credentials
• SSH using admin user is successful.
• Lockdown mode is disabled.
• Verify in var/log/vobd.log that there's no root account locking.
• Following entries are seen in var/log/auth.log:

yy-mm-dd sshd[2103285]: Connection from <IP> port 55338
yy-mm-dd sshd[2103294]: pam_access(sshd:account): access denied for user `root' from `<IP>'
yy-mm-dd sshd[2103294]: [module:pam_lsass]pam_sm_acct_mgmt failed [login:root][error code:2]
yy-mm-dd sshd[2103294]: [module:pam_lsass]Converting error to 40008 for root
yy-mm-dd sshd[2103285]: error: PAM: User account has expired for root from ####
yy-mm-dd sshd[2103285]: error: Received disconnect from <IP> port 55338:14: No supported authentication methods available [preauth]
yy-mm-dd sshd[2103285]: Disconnected from authenticating user root <IP> port 55338 [preauth]


• Run the following command on the ESXi host to verify the Role of the root user:
  
  [root@ESXi:~] esxcli system permission list

Principal        Is Group      Role         Role Description
------------     --------     --------      ----------------
root              false        Custom         Custom

Environment

• VMware vSphere ESXi 7.0.x
• Vmware vSphere ESXi 8.0.x

Cause

Root account does not have the required Admin role.

Resolution

If the Role for root is set to Custom instead of Admin, run the following command:

• esxcli system permission set --id root -r Admin