I couldn't find any docs about how to enable brute force protection for ESXi hypervisor ( including SSH ).

Most of my Linux servers will block IPs that try to login more than X times with the wrong user/password. Is there something similar for ESXi?

  • 1
    Your ESXi management IP should never be exposed to the internet.
    – EEAA
    Oct 16 '15 at 2:49

The functionality that you are referring to is most often implemented by add-ons like fail2ban. This is not available for or already built into ESXi.

However, ESXi 6.0 introduced root account lockout after too many logon failures. Not the same, but definitely better than nothing: http://pubs.vmware.com/vsphere-60/index.jsp#com.vmware.vsphere.security.doc/GUID-DC96FFDB-F5F2-43EC-8C73-05ACDAE6BE43.html

Anyway, you really should not connect the management interface of an ESXi host directly to the Internet -and- you should enable SSH access only temporarily when necessary. Using the ESXi builtin firewall is another option to restrict access.


I agree with @EEAA, you should never expose your ESXi management interface to the internet or any other likewise unsecured network.

That being said, ESXi does have a host firewall that you can configure so as to restrict access from ip addresses other than the ones you specify.

  • Unfortunately I can't choose two answers but yours is good too. I will take into account and use an internal IP for ESXi management interface.
    – Fernando
    Oct 16 '15 at 16:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.