Information
When the ESXi shell or SSH services are enabled on a host, they will run indefinitely. To avoid this, set the ESXiShellTimeOut, which defines a window of time after which the ESXi shell and SSH services will automatically be terminated.
It is recommended to set the ESXiShellInteractiveTimeOut together with ESXiShellTimeOut.
Rationale:
This reduces the risk of an inactive ESXi shell or SSH service being misused by an unauthorized party to compromise a host.
Solution
To set the timeout to the desired value, perform the following from the vSphere web client:
Select the host and click 'Configure' -> 'System' -> 'Advanced System Settings'.
Type ESXiShellTimeOut in the filter.
Click on the attribute to highlight it.
Click the pencil icon to edit.
Set the attribute to 3600 seconds (1 hour) or less.
Click 'OK'.
Note: A value of 0 disables the ESXiShellTimeOut.
Alternately, run the following PowerCLI command:
# Set UserVars.ESXiShellTimeOut to 3600 on all hosts
Get-VMHost | Get-AdvancedSetting -Name 'UserVars.ESXiShellTimeOut' | Set-AdvancedSetting -Value '3600'
References:
https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-6E1ECA4D-B617-4D42-B40B-71E4C83DEEFB.html
https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-B314F79B-2BDD-4D68-8096-F009B87ACB33.html
http://kb.vmware.com/kb/2004746
https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-94F0C54F-05E3-4E16-8027-0280B9ED1009.html
Notes:
This value can be set in minutes via the DCUI. When using the vCenter GUI or PowerShell API, the value is set in seconds.