When it comes to managing ESXi hosts, there are a few interfaces available to perform management tasks:

Remote TSM has been covered in the Accessing hosts via SSH recipe in this chapter. Local TSM and DCUI are console options available if you have physical access to the host or remote console access such as iDRAC.

All interfaces except vSphere API can be managed from vCenter under host Configuration | Security Profile | Services:

Both TSM options can also be configured from the DCUI console.

The following table summarizes different management interfaces and where each one can be configured:

VMware offers a way to secure management access to hosts called Lockdown mode.

Lockdown mode is a security feature, which limits the administrator's ability to manage the ESXi host only through vCenter. When a host is in this mode, the administrator cannot use the command line or run scripts. Also, any third-party software cannot get or change any settings on this host.

The following table summarizes each management interface's behavior in Normal and Lockdown modes:

Additional security always means inconvenience. If the vCenter VM crashed or didn't come up after the reboot, and access to vCenter has been lost, ESXi has to be reinstalled on hosts that are in Lockdown mode to restore access.

How to do it...

To enable lockdown mode from vCenter, execute the following steps:

1. Lockdown mode can be enabled per host by going to Configuration | Security Profile:

   

2. Click on Edit next to Lockdown Mode, select Enable Lockdown Mode, and click on OK:

   

Note

All the existing vCenter Client connections to the host will be dropped immediately.

Users that are currently logged in to DCUI or TSM will still have access after Lockdown mode has been enabled until they log off. Logged in users will not be able to switch Lockdown mode off in this case.

All the existing user and group permissions will be restored once Lockdown mode is disabled if it was enabled from vCenter.

To enable Lockdown Mode from Web Client, execute the following steps:

1. Select a host.

2. Go to Manage | Settings | Security Profile.

3. Scroll down to the Lockdown Mode section.

4. Click on the Edit next to the section.

5. Check Enable Lockdown Mode.

6. Click on OK.

   

Enable Lockdown mode from the ESXi console

To enable Lockdown mode from DCUI, press F2, log in with the root user, move the cursor to the Configure Lockdown Mode item, and press Enter.

Tip

All the existing user and group permissions will be lost once Lockdown mode is enabled from DCUI so the best practice is to use vCenter to enable Lockdown.