6.0

Using the ESXi Shell
The ESXi Shell (formerly Tech Support Mode or TSM) is disabled by default on ESXi hosts. You can enable
local and remote access to the shell if necessary.
Enable the ESXi Shell for troubleshooting only. The ESXi Shell can be enabled and disabled whether or not
the host is running in lockdown mode. See the vSphere Security publication for more information on
lockdown mode behavior.
ESXi Shell
Enable this service to access the ESXi Shell locally.
SSH
Enable this service to access the ESXi Shell remotely using SSH. You can
upload SSH keys to your hosts. See the vSphere Security publication for more
information on SSH keys.
Direct Console UI
(DCUI)
When you enable this service while running in lockdown mode, you can log
in locally to the direct console user interface as the root user and disable
lockdown mode. You can then access the host using a direct connection to
the vSphere Client or by enabling the ESXi Shell.
The root user and users with the Administrator role can access the ESXi Shell. Users who are in the Active
Directory group ESX Admins are automatically assigned the Administrator role. By default, only the root
user can execute system commands (such as vmware -v) using the ESXi Shell.
NOTE Do not enable the ESXi Shell until you actually need access.
Use the vSphere Client to Enable Access to the ESXi Shell
Use the vSphere Client to enable local and remote access to the ESXi Shell.
Procedure
1 Select the host in the inventory panel.
2 Click the Configuration tab and click Security Profile.
3 In the Services section, click Properties.
4 Select a service from the list.
n
ESXi Shell
n
SSH
n
Direct Console UI
5 Click Options and select Start and stop manually.
When you select Start and stop manually, the service does not start when you reboot the host. If you
want the service to start when you reboot the host, select Start and stop with host.
6 Select Start to enable the service.
7 Click OK.
Create a Timeout for ESXi Shell Availability
The ESXi Shell is disabled by default. You can set an availability timeout for the ESXi Shell to increase
security when you enable the shell.
The availability timeout setting is the amount of time that can elapse before you must log in after the
ESXi Shell is enabled. After the timeout period, the service is disabled and users are not allowed to log in.
Chapter 6 Securing the Management Interface
VMware, Inc. 61