2

I have dedicated server with esxi. I added extra user to esxi and added its keys in /etc/keys/keys-user/authorized_keys

Then i rebooted server and that keys folder was gone. Then i find that i need to copy the keys in some persistent storage and then put command in /etc/rc.local.d/local.sh but i have seen that even that file is rewritten after reboot. so my questions is

  1. In which file i need to write so that it persist with reboot
  2. Now i want to disable password authentication. i know i can do that in sshd_config. but i want it to be non permanent. i mean i want to disable it manually and if i reboot then i want it to be reset back to original file with enabled authentication

UPADTE I have setup firewall rules that only my home ip has access to esxi and nothing else. Now so that just in case i am not able to connect and then what i want is to ssh in and disable firewall for sometime and may be change firewall rule for new ip and then re-enable firewall. thats why i wanted ssh access. Few days back i had root account locked because of someone brute forcing. so just in case i want to have extra user which i can ssh into to fix problem. I have enabled ssk key-based authentication but is public. so i want to restrict ssh only to home ip and in case of emergency if my ip changes then i can reboot esxi so that password-based auth work and then i can fix firewall. I am home user so can't afford hardware firewall on esxi.

I have pfsense for internal machines. I don't have any public sites only my labs stuff. I don't want to put esxi behind pfsense because if something is wrong in pfsense then i will be locked out and i will have no way beside re-installing everything

  • When it comes to ESXi, using the SSH interface isn't really all that supported. Are you sure you shouldn't be using one of the more well supported APIs or management interfaces? – Zoredache Feb 21 '17 at 23:21
  • VMware ESXi is not a general-purpose operating system. Why are you SSHing into it with non-root users? – ewwhite Feb 21 '17 at 23:22
  • @ewwhite i have updated the question – user3214546 Feb 21 '17 at 23:34
  • @Zoredache i have updated the question – user3214546 Feb 21 '17 at 23:34
  • and i will have no way beside re-installing everything - Does the provider of your dedicated server not provide a KVM or some other kind of out-of-band management interface? Most of the ones I know about do, or have some kind of number you can call to get a KVM temporarily connected for a fee. If you don't have any way to get an OOB connection, I am tempted to suggest that you need a better provider. – Zoredache Feb 22 '17 at 0:19
2

1. Persisting SSH keys

In my experience, the /etc/rc.local.d/local.sh is actually persistent over reboots. It might be worth mentioning, that the file is only saved once and hour or during a clean shutdown (see How often does ESXi write to the boot disk?).

So one reason why the change is not saved could be, if you do a hard reset or power cycle, rather than reboot.

You can see if the system saves the change by issueing /sbin/auto-backup.sh, which saves the file immediately to bootbank (see How to Persist Configuration Changes in ESXi 4.x/5.x, which still applies for v6.x).

2. Disable password authentication

My ESXi is also on a public network. In /etc/ssh/sshd_config I have changed

PermitRootLogin yes

to

PermitRootLogin prohibit-password
PubkeyAuthentication yes

This already reduces the chance, that the root user gets locked to invalid password attempts (as passwords are not allowed for root user in the first place). Additionally, key-based authentication is considered much more save (if you keep your keys safely!) than password auth.

If you want to disable password authentication completely, you would also have to set

UsePAM no
PasswordAuthentication no

However, these changes are permanent (as /etc/ssh/sshd_config gets saved with /sbin/auto-backup.sh) and immediate (no restart if sshd, as sshd is actually launched by inetd). Thus, there is no way of non-permanent changes here.

3. Firewall

If you still want to change the firewall rules, you could possibly create a file ssha_from_anywhere.xml with contents

<ConfigRoot>
  <service id='1000'>
    <id>sshServer</id>
    <rule id='0000'>
      <direction>inbound</direction>
      <protocol>tcp</protocol>
      <porttype>dst</porttype>
      <port>22</port>
    </rule>
    <enabled>true</enabled>
    <required>true</required>
  </service>
</ConfigRoot>

in a persistent storage and copy it to /etc/vmware/firewall/ during boot (again from /etc/rc.local.d/local.sh). Then change your existing firewall rule with vSphere client to allow only your local address.

Once the system reboots, the ssh port is open to the world. Then you would need to log in and delete the /etc/vmware/firewall/ssha_from_anywhere.xml and reload the firewall:

esxcli network firewall refresh

However, before doing so, you would have to adjust the IP address that is allowed to connect to ssh. You would probably want to do this in the vSphere client again as well, or directly in /etc/vmware/firewall/service.xml. In the former case (if you did not disable the vSphere client interface) the whole procedure seems pointless, as you could simply log in with the vSphere client and change the IP address.

The changes made in vSphere client are reflected in the /etc/vmware/esx.conf file as e.g.

/firewall/services/sshServer/allowedip[0000]/ipstr = "192.168.1.1"
/firewall/services/sshServer/allowedip[0001]/ipstr = "192.168.2.0/24"

While I know this file is retained over reboots, I'm not sure how changes are activated. Maybe you can edit the file and then reboot? And after that second reboot remove /etc/vmware/firewall/ssha_from_anywhere.xml and reload the firewall.

Sources


Good luck!
Martin

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.