I would like to place my VMware ESXi 4.1 server in a data center but I'm concerned that assigning a public IP to the host to enable remote management over the net (with VMware vSphere client or SSH) might leave the server vulnerable to attacks. Is there a better/safer way for a person with a limited budget to remotely manage a VMware ESXi 4.1 server over the net. Please note I do not have access to a firewall appliance to configure VPN.
There isn't any way to do this effectively. ESXi does have a firewall built in, so you could in theory lock down the management interface to your remote IP addresses, but if your IP address ever changes... too bad.
You need to have some way to VPN into the network and put the ESXi interface on a private network.
Have you considered a free firewall such as PFSense? You could consider running it as a VM on the same server if you didn't want to dedicate a box or possibly incur additional monthly costs in the datacenter.
And if the reason ou want to connect to the ESXi host is because of a fault - or you need to shutdown the VMs to apply a patch or configuratino change to ESXi itself, but your only way in was through one of said VMs, don't you have a but of a problem?
We have the same situation. We have a virtual machine running pfSense that we use for day-to-day access to VMware and to the virtual machines.
For emergency access, we're using a VPN service provided by our collocator which allows one user to login and gain only access to the management interface of VMware.
Our initial setup had a dedicated firewall device -- which is what I recommend you get if you can't get VPN access through your collocator. We don't do this anymore for the simple reason that it died.
I would say put the ESXi host on a private network and have some form of secure VPN access into the private network. Because then, you're not exposing the ESXi host directly to the public net. Someone would have to breach your VPN service first in order to even see the ESXi host. You decrease your likelihood of having your ESXi host exploited. I'd say use good password practice is an obvious one.