Recently one of my previous customer asked me for tips on how to systematically control remote session timeouts to ESXi hosts. The context was around standardizing console sessions timeout across multiple ESXi hosts across an enterprise. This is a common requirement for enterprise environments with regulated security postures. I figured this may be useful, so I decided to share this information to a wider audience than just my customer and good friend Todd (@tdamore).
The security requirement can be satisfied by leveraging a new security advanced setting included in the new vSphere 5.1 platform called “ESXiShellInteractiveTimeOut”. Any vCenter user with elevated privileges (admin level) can leverage the use of an advanced setting called “ESXiShellInteractiveTimeOut” to address the ESXi host remote session timeout systematically. This advanced feature allows you implement a standardized timeout value for interactive session to ESXi hosts. The timeout values could be dictated by a standardized corporate security policies or whatever fits your organization. Overall, the use of this advanced setting could can facilitate automating the termination of idle sessions after a defined period of time (time definition is based in seconds).
Now getting to the Advanced Setting location is very simple, even if your new to the new vSphere Web Client. The screen shots below illustrate the location and configuration option.
Advanced Setting Location
ESXi Advanced Setting Configuration
From what the screen shots illustrate above, the advanced setting are located on a per host basis. Utilizing this setting in large environments can be a difficult to manage if utilized on a per hosts basis and not managed properly. I would recommend deploying this configuration as part of Host Profiles implementation. This would be a simplified, validated, and consistent approach.
The process for adding the “ESXiShellInteractiveTimeOut“ is listed below:
- Go to the advanced settings on ESXi and enter the adequate value for the ESXiShellInteractiveTimeOut
- Create a Host Profile referencing the hosts with the modified “ESXiShellInteractiveTimeOut” settings
- Verify the “ESXiShellInteractiveTimeOut” setting values is listed under the Advanced Configuration Option
- The UserVars.ESXiInteractiveTimeOut should be visible in the Host Profile as illustrated below
Host Profile with UserVars.ESXiShellInteractive
Hope everyone finds this useful and handy.
To get more information on my blog postings follow me on Twitter: @PunchingClouds