2

This is a question regarding technical feasibility, and not a real-world scenario.

The question is NOT regarding how to access the "hidden" console of the ESX/ESXi HOST OS running on the bare metal.

That being said, I'll outline this question with an example.

On Dell and HP servers, it is possible to enable SSH to the DRAC/iLO console so that you can keep logs of what transpires on those consoles respectively, provided you are either using a jump host that logs all ssh connections out, or your SAs have logging enabled in PuTTY, or whatever ssh client they are using.

The console has a separate IP from the OS (the DRAC/iLO IP usually), that is typically allocated on a non-routed subnet and VLAN.

The question I have is: Is it possible to enable this same sort of IP address assignment and ssh functionality to the console of a guest VM, provided that the guest is running some variant of unix/linux/bsd with a text console?

I did try to google for this but all of the results I got were regarding how to access (and enable) the host's text service console.

5

I believe that you can approximate that functionality by enabling a serial console on the VM, then by choosing "Connect via Network". I'm not certain that you'll be able to access it via ssh (I've only found examples using telnet, telnet over SSL, and tricky netcat stuff, but it might be possible in the latest and greatest versions. You may also need a full enterprise license. Here are some links to get you started:

https://pubs.vmware.com/vsphere-51/index.jsp#com.vmware.vsphere.vm_admin.doc/GUID-462B8B04-29DF-406B-9585-12D2588A6A48.html

http://esxi.oeey.com/2013/11/how-to-redirect-esx-linux-vms-console.html

  • Glad it helped and I could be of service. If you do happen to get it plumbed up to ssh, please come back here and let us know. Thanks! – Jed Daniels Sep 27 '17 at 21:41
2

The ability to connect to the VM is entirely up to the guest OS configuration on that VM. There's no special text console access provided by the hypervisor (ESXi in this case) other than the virtual display (GUI) console. Even on a text based OS, the console is still basically VGA-over-IP.

If you want to SSH to a VM, you give it network and configure an SSH daemon. If you want to SSH to the hypervisor, you enable the SSH service and connect on its management port.

  • I appreciate your answer, however I shall provide additional clarification: The idea here is to fulfill separation of duties. Guest OS SA doesn't need access to vCenter to access the GUI console. Why give them that if he can access to the console over SSH or telnet+ssl when the network of the guest is down for whatever reason? Allowing guest OS SA to connect to a vCenter server or even having to use the web client, strictly to give guest console access is a bad requirement, hence the ESX SA should be the only one with vCenter access. – Speeddymon Sep 27 '17 at 20:12
  • 1
    I understand what you're trying to do. But "access to vCenter" isn't a binary thing. There's a role based access model for exactly this purpose. You can give your SA only the rights needed to connect to the VM's console. But vCenter will always be the entrance point. – Ryan Bolger Sep 27 '17 at 20:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.