How to manage a VMware ESXi host remotely

1. 1

   Step 1: Save the Host Client as a web panel

   On the Connections page of the RemoteAccessApp app, add a web panel with the host's address, such as https://192.168.1.20/ui. ESXi ships with a self-signed certificate: the tab asks about it once and remembers a certificate you've accepted. Save the user name (usually root) and Fill sign-in types it in.

2. 2

   Step 2: Turn on SSH on the host, when you need it

   SSH is off on ESXi by default. In the Host Client, go to Manage, then Services, select TSM-SSH and start it. You can also turn it on at the host's own console (the DCUI), under troubleshooting options. ESXi shows a warning while SSH is on; many people turn it off again when they're done.

3. 3

   Step 3: Add the host as an SSH host

   Click Add host, choose SSH, and enter the same address with user root. On the first connection, compare the key fingerprint with the one the host shows before you trust it; see server keys.

4. 4

   Step 4: Use a key for root

   ESXi keeps root's authorized keys in its own place: /etc/ssh/keys-root/authorized_keys, not in a home folder. Copy your public key from Keys & passwords, add it to that file, and choose key sign-in for the host. See the SSH keys help.

5. 5

   Step 5: Add your guests

   Add each Windows VM as an RDP host and each Linux VM as an SSH host, in the same group as the host. Tags such as esxi or windows-vm make them easy to filter.

A web panel tab is a full browser view, with back, forward, reload, Fill sign-in, Copy password and Open in browser. The Host Client's VM consoles open in it, and a console that opens in a new window becomes another tab.

If vCenter manages your hosts, save the vSphere Client as a web panel too, at your vCenter's address. Keep both: the Host Client is how you reach a host when vCenter itself is down. A Proxmox node's web interface goes in a web panel the same way; see Proxmox VE remote management.

The ESXi Shell is a small BusyBox-based shell, not a full Linux system, but it has the two tools that matter. A few read-only commands to start with:

esxcli system version get
esxcli storage filesystem list
esxcli network ip interface ipv4 get
vim-cmd vmsvc/getallvms
vim-cmd vmsvc/power.getstate 12

vim-cmd vmsvc/getallvms lists each VM with its id, and the other vmsvc commands take that id (12 above is just an example). vim-cmd vmsvc/power.on, power.shutdown and power.off change a VM's state; RemoteAccessApp has no VM buttons of its own, so this, or the Host Client, is how you do it.

Saved scripts work here too. Save a check like the one above in the terminal's Scripts & History panel and run it on several ESXi hosts at once with Run on hosts…, which shows each host's output and result. Stick to commands that ESXi's shell has: many Linux tools aren't there.

Datastores appear in the shell under /vmfs/volumes/, one folder per datastore, with each VM in its own folder. Find the datastore names with esxcli storage filesystem list.

Where your ESXi host accepts SFTP connections, open its files in the app's two-pane file browser, or copy an ISO straight from another server into a datastore folder with a server-to-server copy. If your host doesn't offer SFTP, upload ISOs with the datastore browser in the Host Client instead, which works in the web panel tab. If your ISOs live on a NAS, TrueNAS, Unraid and NAS remote access shows how to open its files in the same app.

• No server dashboard. The live dashboard reads Linux, macOS, FreeBSD and Windows servers, and ESXi isn't one of them. Use the Host Client's monitor pages instead, in the web panel tab.
• No Containers tab. There's no Docker on the host itself.
• No VNC consoles. ESXi's VM consoles are in the Host Client, so for a guest's own desktop use RDP (Windows) or SSH (Linux) into the guest.
• SSH is often off. If a connection is refused, check that TSM-SSH is running.

Never put the Host Client or vCenter on the internet, and the same goes for your firewall's admin page (see how to reach pfSense, OPNsense and router admin pages safely). When you're away, open a Windows PC at home with RemoteAccessApp and use the Host Client in its browser, with no open ports; or, from the website, open the host's saved SSH host Through my PC to reach its shell at a local address. The guide to managing Proxmox, VMware and KVM hosts covers both, and why exposed web UIs are a risk explains the reasons.