Note:

Replace SSH Keys for Oracle Cloud VMware Solution ESXi hosts

Introduction

Oracle Cloud VMware Solution provides a customer-managed, native VMware-based cloud environment, offering complete control using familiar VMware tools. However, if the SSH keys used to access the ESXi hosts are lost, you will need an alternative method to regain access. This tutorial outlines the tasks involved in enabling password-based login to the ESXi host and replacing the SSH keys.

SSH access to Oracle Cloud VMware Solution (OCVS) SDDC compute instances and ESXi hosts is typically achieved using a private key corresponding to the public key supplied during provisioning. However, if the private SSH key is lost or unavailable, direct SSH access to the ESXi host becomes impossible. In such cases, the workaround solution is to access the Direct Console User Interface (DCUI) of the ESXi host, enable password-based login, and then SSH into the ESXi host to replace the Public key in the authorized keys section. After validating the new public key is working as expected, you can disable the password-based login for better security.

Objective

Prerequisites

Task 1: Create a Console connection to the ESXi host

  1. Open the Oracle Cloud Console navigation menu, click Compute and then click Instances.

  2. Select the first ESXi host of the Oracle Cloud VMware Solution SDDC.

  3. Click Console Connection.

  4. Click Create local connection.

    Create a local Console connection for a ESXi host in the Compute section

  5. Generate an SSH key pair or upload your own public key for the Console Connection, in this example we will create a new key pair.

    Generate a new key pair for the console connection

  6. Click Create console connection and wait for the state of the connection to change to Active.

Task 2: Access Console connection or DCUI of the ESXi host

Once the console connection has changed to active state, complete the following steps.

  1. Click on the kebab icon on the right of the connection and then click Copy VNC connection for Windows.

    Note: If you are using a Linux/Mac machine, follow the appropriate steps.

    Copy the VNC connection command for the connection

  2. Paste the copied command to a text editor.

    Start-Job { Echo N | plink.exe -i $env:homedrive$env:homepath\oci\console.ppk -N -ssh -P 443 -l ocid1.instanceconsoleconnection.oc1.ap-melbourne-1.anwwkljxyzxyzxyzxyzhatrpp5gdhi75lunwazur6vlkost37m2rxa -L 5905:ocid1.instance.oc1.ap-melbourne-1.anwwkljrxyzxyzxyzxyzoua6cxxfbtqbg2tvhkogyusd6scnb2wfdnfcfmzq:5905 instance-console.ap-melbourne-1.oci.oraclecloud.com }; sleep 5; plink.exe -i $env:homedrive$env:homepath\oci\console.ppk -N -L 5900:localhost:5900 -P 5905 localhost -l ur6vlkost37m2rxa

  3. Replace the two $env:homedrive$env:homepath\oci\console.ppk sections in the following command to point to your private key.

    Start-Job { Echo N | plink.exe -i C:\Keys\ssh-key-2022-06-11-converted.ppk -N -ssh -P 443 -l ocid1.instanceconsoleconnection.oc1.ap-melbourne-1.anwwkljxyzxyzxyzxyzhatrpp5gdhi75lunwazur6vlkost37m2rxa -L 5905:ocid1.instance.oc1.ap-melbourne-1.anwwkljrxyzxyzxyzxyzoua6cxxfbtqbg2tvhkogyusd6scnb2wfdnfcfmzq:5905 instance-console.ap-melbourne-1.oci.oraclecloud.com }; sleep 5; plink.exe -i C:\Keys\ssh-key-2022-06-11-converted.ppk -N -L 5900:localhost:5900 -P 5905 localhost -l ur6vlkost37m2rxa

  4. Start Windows PowerShell or Terminal, run the following command and follow the prompts to begin the session.

    Console connection established using the VNC command using Windows PowerShell

  5. Once the connection has started, open VNC Viewer and establish a connection to the Console using the command localhost:localport. For this tutorial, we will use localhost:5900.

  6. Once the connection is established, you can see the DCUI.

    Accessing VMware DCUI using VNC Viewer

  7. Press ALT+F1 to access the Console, log in using opc user and SDDC password.

    Login to ESXi shell from Console Connection

Task 3: Enable password based authentication for the ESXi host

  1. To enable password based login for the opc user, edit the /etc/ssh/sshd_config file.

  2. Change the PasswordAuthentication setting to yes and save the file.

  3. Reload the SSH service by running the command: /etc/init.d/SSH restart.

  4. Configure a password for the opc user.

    Enable password based login for the ESXi host

Task 4: Add the new Public Key on ESXi host

  1. SSH into the ESXi host using the password you have configured in the previous step.

    SSH into the ESXi host using the set password

  2. Edit the authorized_keys file located at /etc/ssh/keys-opc/.

    Add new SSH Public key to replace old or lost key

  3. Replace the existing public key or add a new public key.

    Displaying the new public key in authorized keys for the ESXi host

Task 5: Test access using the new SSH key pair

  1. Establish a new SSH session to the ESXi host using the new SSH key pair.

    Validate SSH into the ESXi host using the new SSH key pair

Task 6: Disable password based login

After testing access with the new SSH keys in Task 5, you must disable the password based login for security reasons.

  1. Edit the /etc/ssh/sshd_config file and change the PasswordAuthentication setting to no.

  2. Restart the SSH service.

    Disable password based login to ESXi host

  3. Validate that the password-based log in does not work.

    Validate password based login doesn't work anymore

Task 7: Enable Persistent SSH Public Keys

To ensure that the configuration persists even after the ESXi host reboots, follow these steps to add the new public key to the authorized_keys file:

  1. Prior to continuing, establish an SSH connection to the ESXi host, if you have not already done so.

  2. Copy the new public key to a variable.

    NEW_PUB_KEY = "Paste New Public Key here"

  3. Append the new public key to the authorized_keys file on the ESXi host.

    echo "<$NEW_PUB_KEY>" >> /etc/ssh/keys-root/authorized_keys

  4. Enable the sticky bit for the authorized_keys file to prevent unintentional modifications.

    chmod +t /etc/ssh/keys-root/authorized_keys

  5. Execute the auto-backup script to make the authorized_keys file persistent.

    /sbin/auto-backup.sh

Next Steps

Perform Tasks 1 to 7 consecutively on all ESXi hosts in the Oracle Cloud VMware Solution SDDC.

Acknowledgments

More Learning Resources

Explore other labs on docs.oracle.com/learn or access more free learning content on the Oracle Learning YouTube channel. Additionally, visit education.oracle.com/learning-explorer to become an Oracle Learning Explorer.

For product documentation, visit Oracle Help Center.