Set up SSH Key-Based Authentication on VMware ESXi

You can configure SSH key-based authentication to log in to VMware ESXi hosts instead of using a username and password pair. This can be useful if you need to remotely manage an ESXi host using external scripts (for example, to send a shutdown command to ESXi on a power outage event on UPS), or if you need to manage VMware ESXi hosts with Ansible.

Generate private and public keys on the administrator’s computer. Use RSA keys with a minimum length of 4096 bits. To generate a 4096-length RSA key pair on Windows, run the command

ssh-keygen -t rsa -b 4096

The utility creates two files in the current user’s profile directory (%USERPROFILE%\.ssh):

• id_rsa – private key
• id_rsa.pub – public (open) key

Copy the public key (id_rsa.pub) from your computer to the VMware ESXi host This key must be added to the file /etc/ssh/keys-$USER/authorized_keys. If this is a key for the root user, the path to the file will be as follows: /etc/ssh/keys-root/authorized_keys.

Connect to the ESXi server using SSH.

You can edit the file manually (you can store multiple keys in one file) or add it to the ESXi server by using the PowerShell command:

cat c:\users\admin\.ssh\id_rsa.pub | ssh [email protected] 'cat >> /etc/ssh/keys-root/authorized_keys'

The /etc/ssh/sshd_config file contains the OpenSSH server on the ESXi host.

Use this option to enable or disable root access:

PermitRootLogin yes

Turn off SSH password logins:

ChallengeResponseAuthentication no # deprecated
KbdInteractiveAuthentication no
PasswordAuthentication no

Restart SSH server on ESXi:

# /etc/init.d/SSH restart

You can now connect to the ESXi host without a password using the private key. On Windows computers with ssh-agent enabled, the private key from the user profile is automatically used when connecting to the host:

ssh [email protected]

You can also use the -i parameter to specify the path to the private key:

ssh [email protected] -i "C:\Users\administrator\.ssh\id_rsa"

Now you can remotely run any command in the ESXi console. For example, shutdown a specific virtual machine:

ssh [email protected] vim-cmd vmsvc/power.shutdown VMID