Restrict SSH to key-based authentication on vSphere ESXi version 8.0.2 and later

Products

• VMware vSphere ESXi

Issue/Introduction

• Requirement to enforce SSH key-based authentication and disable all password-related authentication methods (PAM and Challenge-Response) on ESXi hosts.
• Direct modification of /etc/ssh/sshd_config for parameters such as PasswordAuthentication is unsupported and non-persistent in ESXi 8.0.2 and above.

Environment

VMware vSphere ESXi 8.0.2 and later

Cause

In ESXi 8.0.2 and higher, manual modifications to /etc/ssh/sshd_config are no longer supported. To make changes Administrators must use the esxcli system commands to set these parameters. For further information see KB article: Configurable properties of SSH Server on ESXi 8.0.2 or later 

Resolution

To restrict SSH access to public/private key pairs by disabling PAM and Challenge-Response authentication, the following steps must be performed using the esxcli command-line utility.

Note: Verification that SSH public keys are correctly configured on the host is required before proceeding to prevent loss of SSH access. To set up SSH key authentication see KB article: Allowing SSH access to VMware vSphere ESXi/ESX hosts with public/private key authentication  

1. Disable UsePAM: Execute the following command to set the UsePAM parameter to no: esxcli system ssh server config set -k usepam -v no

2. Disable ChallengeResponseAuthentication: Execute the following command to set the ChallengeResponseAuthentication parameter to no: esxcli system ssh server config set -k challengeresponseauthentication -v no

3. Verify Configuration: To confirm the application of settings, run: esxcli system ssh server config list

Additional Information

Modifying these parameters to no disables password authentication. If valid SSH keys are not in place for the root user or designated administrative accounts, SSH access to the host will be lost.