How to Disable Root SSH Shell Access on ESXi 7.0/8.0 and vCenter Server 7.0/8.0

Products

• VMware vSphere ESXi
• VMware vCenter Server

Issue/Introduction

Many company cybersecurity policies mandate that root SSH access be disabled on ESXi hosts and vCenter Server appliances to reduce the attack surface.

This article provides the procedure to disable root shell access (SSH) while maintaining system manageability.

Environment

ESXi 7.0.x

ESXi 8.0.x

vCenter Server 7.0.x

vCenter Server 8.0.x

Cause

Security hardening policies often require the disabling of direct root login via SSH to minimize the risk of unauthorized access.

Resolution

 

Warning: Before performing this operation, ensure that at least one alternative user account exists with equivalent administrative permissions (superuser) to avoid management lockouts.

1. Back up the current SSH configuration file: cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
2. SSH to the ESXi host or vCenter Server using the root account.
3. Edit the SSH configuration file: vi /etc/ssh/sshd_config
4. Find the parameter PermitRootLogin. Change the value to no: PermitRootLogin no
5. Save and quit the file: Press Esc, then type :wq! and press Enter.
6. Restart the SSH service to apply changes: /etc/init.d/SSH restart

Note: If you need to re-enable root SSH access, revert the PermitRootLogin parameter to yes and restart the SSH service.