Modifying the parameters like "PasswordAuthentication" to yes in sshd_config are not persistent across reboot

Products

• VMware vSphere ESXi

Issue/Introduction

The default value of "PasswordAuthentication" is typically "yes".

1. This configuration is used to allow/deny access for users/systems when trying to connect via SSH with password authentication.

Environment

VMware vSphere ESXi 8.0.1 and below

Cause

Direct changes to file "sshd_config" is not persistent across reboot.

Resolution

1. Take a ssh session to esxi host with root password.
2. Add following line in /etc/rc.local.d/local.sh file to make the sshd_config file entry "PasswordAuthentication" constant across reboot.
   
   sed -i 's/PasswordAuthentication no/PasswordAuthentication yes/g' /etc/ssh/sshd_config
   
   
3. The /etc/rc.local.d/local.sh file should look like:
   
   !/bin/sh ++group=host/vim/vmvisor/boot# local configuration options.   Note: modify at your own risk!  If you do/use anything in this
# script that is not part of a stable API (relying on files to be in
# specific places, specific tools, specific output, etc) there is a
# possibility you will end up with a broken system after patching or
# upgrading.  Changes are not supported unless under direction of
# VMware support.# Note: This script will not be run when UEFI secure boot is enabled.
sed -i 's/PasswordAuthentication no/PasswordAuthentication yes/g' /etc/ssh/sshd_config
exit 0
   
   
4. Reboot the esxi host.

Note: Starting with 8.0.2, it is no longer supported to directly modify the "/etc/ssh/sshd_config". See KB "Configurable properties of SSH Server on ESXi 8.0.2 or later" for the supported method.

Additional Information

• For the above steps to work as expected, secure boot must be disabled.
• Other method to provide access to log in via SSH.
  • Allowing SSH access to VMware vSphere ESXi/ESX hosts with public/private key authentication
• To manage specifically "root" user access via SSH.
  • Manage SSH access for the root user