Security scanners flag /bin/techsupport.sh as a suspicious script on ESXi hosts

Products

• VMware vSphere ESXi

Issue/Introduction

• Third-party security scanners flag the file /bin/techsupport.sh in ESXi hosts as a "suspicious script" or "unknown binary" in a system directory.

Environment

VMware vSphere ESXi (All versions)

Cause

The file /bin/techsupport.sh is a standard, native component of the VMware ESXi operating system. It serves as the login wrapper for the ESXi Shell (formerly known as Tech Support Mode).

The script is responsible for:

• Service Validation: Checking if the ESXi Shell service is enabled before allowing a login prompt.
• Security Enforcement: Verifying Shell Sandbox settings and Lockdown Mode status.
• Auditing: Facilitating the hand-off between the console and the shell process to ensure user activity is logged in auth.log and shell.log.

Resolution

This is expected behavior and the file is a legitimate part of the ESXi installation.

No action is required to remove the file, as doing so would break the ability to use the Local Tech Support Mode for troubleshooting.