Docs › Discovery

VMware ESXi Discovery via SSH

Last updated 2026-07-14

VMware ESXi Discovery via SSH

uControl Insight can discover VMware ESXi hosts (5.5 through 8.0) via SSH using esxcli commands. This method works with all ESXi versions, including those that do not support the REST API (ESXi 6.x and earlier).

Overview

When the SSH connector detects an ESXi host (by running esxcli system version get), it automatically switches to ESXi-specific commands instead of standard Linux commands. The host is classified as HYPERVISOR.

Data Collected

Category	ESXi Command	Data
Version	`esxcli system version get`	Product name, version, build number
Hardware	`esxcli hardware platform get`	Vendor, model, serial number
CPU	`esxcli hardware cpu global get` + `cpu list`	CPU count, core count, CPU model
Memory	`esxcli hardware memory get`	Total physical memory
UUID	`esxcli system uuid get`	BIOS UUID for identity resolution
Network	`esxcli network ip interface ipv4 get` + `network nic list`	IP addresses, MAC addresses
VIB Packages	`esxcli software vib list`	Installed VIBs — name, version, vendor, install date
Services	`chkconfig --list`	ESXi services with on/off state
Processes	`ps -c`	Running processes — PID, user, state, command
Datastores	`esxcli storage filesystem list`	Volume name, mount point, type, size, free space
Physical Disks	`esxcli storage core device list`	Model, vendor, size, device type
Virtual Machines	`vim-cmd vmsvc/getallvms`	VM count and names

Prerequisites

Enable SSH on the ESXi host
- vSphere Client → select the host → Configure → Services → SSH → Start
- Also start "ESXi Shell" service
Root credentials — ESXi SSH requires the root account
Firewall — TCP port 22 must be accessible from the scanning host

Credential Setup

Create an SSH_PASSWORD credential in uControl Insight:

Username: root
Password: your ESXi root password
Match Pattern: the ESXi host IP or CIDR range

Target Setup

Create a targeted discovery target:

Scan Type: SSH_UNIX
Host: ESXi host IP or FQDN
Credential: select the SSH credential above

Important: Use a targeted SSH_UNIX scan rather than a Smart Scan for ESXi hosts. Smart Scans try multiple credentials which can trigger ESXi's account lockout (see Troubleshooting below).

Authentication Notes

ESXi uses keyboard-interactive SSH authentication, not plain password authentication. uControl Insight supports this automatically — when an SSH password credential is used, the connector tries keyboard-interactive and password methods (without trying publickey first, which would waste authentication attempts against ESXi's low limit).

VMware vSphere REST API (Alternative)

For vCenter Server 6.5+ or standalone ESXi 7.0+, you can use the VMware REST API connector instead:

Scan Type: VMWARE
Credential Type: VMWARE_API

This provides additional data including vSwitches, port groups, and cluster relationships. However, ESXi 6.x standalone and vCenter 6.0 do not support the REST API — use SSH discovery for these versions.

Troubleshooting ESXi SSH

Account Lockout ("Too many authentication failures")

ESXi has a strict account lockout policy (typically 5 failed attempts, 15-minute lockout window). This can be triggered by:

Smart Scans trying multiple credentials against the ESXi host
Previous failed scan attempts from the same source IP

To reset: SSH into the ESXi host from a machine that is not locked out and run:

pam_tally2 --reset --user root

Prevention: Use targeted SSH_UNIX scans (not Smart Scans) for ESXi hosts to avoid multiple credential attempts.

SSH Enabled but "Permission Denied"

Verify both SSH and ESXi Shell services are started in the vSphere Client
Verify the root password is correct by testing in the vSphere Client or ESXi web UI
Check for account lockout (see above)

Connected but 0 Packages / 0 Processes

If the SSH connector connects but returns no data, it may not have detected the host as ESXi. Check the scan log for "Detected ESXi host". If not present, the esxcli system version get command may have failed — verify it works when you SSH in manually.