SSH root access for NSX-T appliance fails with "Access Denied"

Products

• VMware NSX

Issue/Introduction

• SSH access with root login was not enabled at NSX-T appliance deployment time.
• Attempts to SSH login with the root user fails with an "Access Denied" error.
  
• SCP or SFTP will also fail with root login and files cannot be transferred.
• As the admin user, executing:  get service ssh  shows "root login" enabled and the SSH "service state" as running.
  

Environment

• VMware NSX-T Data Center 3.x
• VMware NSX 

Cause

Although SSH was enabled, the root user is not allowed to login via SSH.  PermitRootLogin is commented out in the /etc/ssh/sshd_config file on the affected NSX appliance, as in the following screenshot:

 

 

Resolution

1. Log in to the NSX-T manager console as root
2. Edit SSH config file:
   • Open the file for editing by executing:  vi /etc/ssh/sshd_config
3. Modify the configuration:
   1. Locate the line: "#PermitRootLogin prohibit-password" 
   2. Replace the line with: "PermitRootLogin yes" 
4. Restart the SSH service:
   • Execute the command:  /etc/init.d/ssh restart

Note: If root login still fails you may need to enable root login after restarting SSH

• As the admin user, execute: set ssh root-login

Note: 

PermitRootLogin prohibit-password may not be commented out in some cases, but will require the same workaround above to allow root SSH login.