2

I couldn't find any docs about how to enable brute force protection for ESXi hypervisor ( including SSH ).

Most of my Linux servers will block IPs that try to login more than X times with the wrong user/password. Is there something similar for ESXi?

Improve this question
2
  • 1
    Your ESXi management IP should never be exposed to the internet.
    – EEAA
    Oct 16, 2015 at 2:49
  • @EEAA While that is true if you use a service like OVH bare metal, then you don't get a choice in the matter, but that said ssh shouldn't be enabled unless really needed
    – Phil
    Apr 16, 2023 at 10:22

3 Answers 3

Reset to default
4

The functionality that you are referring to is most often implemented by add-ons like fail2ban. This is not available for or already built into ESXi.

However, ESXi 6.0 introduced root account lockout after too many logon failures. Not the same, but definitely better than nothing: http://pubs.vmware.com/vsphere-60/index.jsp#com.vmware.vsphere.security.doc/GUID-DC96FFDB-F5F2-43EC-8C73-05ACDAE6BE43.html

Anyway, you really should not connect the management interface of an ESXi host directly to the Internet -and- you should enable SSH access only temporarily when necessary. Using the ESXi builtin firewall is another option to restrict access.

Improve this answer
5

I agree with @EEAA, you should never expose your ESXi management interface to the internet or any other likewise unsecured network.

That being said, ESXi does have a host firewall that you can configure so as to restrict access from ip addresses other than the ones you specify.

Improve this answer
2
  • Unfortunately I can't choose two answers but yours is good too. I will take into account and use an internal IP for ESXi management interface.
    – Fernando
    Oct 16, 2015 at 16:38
  • Keeping it off the internet is not an option with many dedicated server hosting providers, at least not without a custom solution...
    – Gert van den Berg
    Jun 2, 2023 at 9:47
0

There is a firewall in the vsphere that can only allow specified IP from accessing, but it's not good enough like fail2bin, too many failed tests for the login will lock all the users out, that's not good at all, it will prevent the normal user from using the web management too.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .