I couldn't find any docs about how to enable brute force protection for ESXi hypervisor ( including SSH ).

Most of my Linux servers will block IPs that try to login more than X times with the wrong user/password. Is there something similar for ESXi?

  • 1
    Your ESXi management IP should never be exposed to the internet.
    – EEAA
    Oct 16, 2015 at 2:49
  • @EEAA While that is true if you use a service like OVH bare metal, then you don't get a choice in the matter, but that said ssh shouldn't be enabled unless really needed
    – Phil
    Apr 16 at 10:22

3 Answers 3


The functionality that you are referring to is most often implemented by add-ons like fail2ban. This is not available for or already built into ESXi.

However, ESXi 6.0 introduced root account lockout after too many logon failures. Not the same, but definitely better than nothing: http://pubs.vmware.com/vsphere-60/index.jsp#com.vmware.vsphere.security.doc/GUID-DC96FFDB-F5F2-43EC-8C73-05ACDAE6BE43.html

Anyway, you really should not connect the management interface of an ESXi host directly to the Internet -and- you should enable SSH access only temporarily when necessary. Using the ESXi builtin firewall is another option to restrict access.


I agree with @EEAA, you should never expose your ESXi management interface to the internet or any other likewise unsecured network.

That being said, ESXi does have a host firewall that you can configure so as to restrict access from ip addresses other than the ones you specify.

  • Unfortunately I can't choose two answers but yours is good too. I will take into account and use an internal IP for ESXi management interface.
    – Fernando
    Oct 16, 2015 at 16:38

There is a firewall in the vsphere that can only allow specified IP from accessing, but it's not good enough like fail2bin, too many failed tests for the login will lock all the users out, that's not good at all, it will prevent the normal user from using the web management too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.