ESXi 6.X does not work for get_build='esxcli --server but works for 5.x

[mathewfer]

Hi,

I tried to use this script and it worked for ESXi 5.x but for 6.x, I get the below error. I can login into those via WEB and SSH but not from this "esxcli".

Error I get "Invalid login: Cannot complete login due to an incorrect user name or password."

Do you know what is the issue with ESXi 6.x with this script?

Mathew

[nickmoody]

Hi Mathew,

It works fine on the 3 hosts in my lab running 6.5. What is the error your receiving please?

Nick

[nickmoody]

I would advise checking the logs on the host via the GUI. It could be that the account your using is locked? When I Googled your error there is a fair amount of issues with 6.x relating to the error your receiving.

[mathewfer]

Hi Nick,

I tried to check the logs in folder "/scratch/log/" but it does not show any indications of any issues. The account is not locked too as I have SSH access. ESXi version is 6.7.

See the logs below - if you have any idea, please let me know.

I am running the "esxcli " command (that is in your script) and esxcli runs from the Linux box IP - 10.243.250.159.

[root@LAB-11-SRV:~] uname -a VMkernel LAB-11-SRV 6.7.0 #1 SMP Release build-8169922 Apr 3 2018 14:48:22 x86_64 x86_64 x86_64 ESXi [root@LAB-11-SRV:~] 2018-12-13T07:58:08Z sshd[2565720]: Connection from 10.243.250.159 port 50263 2018-12-13T07:58:08Z sshd[2565722]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.243.250.159 user=root 2018-12-13T07:58:10Z sshd[2565720]: error: PAM: Authentication failure for root from 10.243.250.159 2018-12-13T07:58:14Z sshd[2565720]: Accepted keyboard-interactive/pam for root from 10.243.250.159 port 50263 ssh2 2018-12-13T07:58:17Z sshd[2565720]: Received disconnect from 10.243.250.159 port 50263:11: disconnected by user 2018-12-13T07:58:17Z sshd[2565720]: Disconnected from user root 10.243.250.159 port 50263 2018-12-13T08:49:03Z sshd[2566087]: Connection from 10.243.250.159 port 50346 2018-12-13T08:49:09Z sshd[2566087]: error: PAM: Authentication failure for root from 10.243.250.159 2018-12-13T08:51:01Z sshd[2566087]: Connection closed by authenticating user root 10.243.250.159 port 50346 [preauth] [root@LAB-11-SRV:~]

Mathew

[mathewfer]

Hi Nick,

I tested about 5 ESXi 6.x server and none of them works. Can you please share what configurations you did in ESXi web interface?

In my setup, I only enabled SSH and tested SSH from the same server on which I run this python script. So connectivity and SSH access works.

So I believe it is do with some ESXi 6.x server configuration. I believe there could be more settings other than only enabling SSH access.

Thanks and regards,

Mathew

[nickmoody]

Hi Mathew,

I don't recall needing to enable esxcli on my hosts. I'm running Vsphere essentials so my hosts are managed by VCSA, not sure if that makes any difference in that perhaps VCSA enables esxcli as part of the host on boarding.

I did find this article that may help you: https://kb.vmware.com/s/article/2004746

Nick

[mathewfer]

Hi Nick,

Thanks for the reply. I will try this link and let you know. Also I found your ESXi management setup and my setup is different. My setup is few ESXi servers managed by accessing individual ESXi hosts via its web GUI for 6.x and Windows client for 5,0.

Regards,

Mathew

[mathewfer]

Hi Nick,

I see that the below two are enabled in ESXi 6.x when I login in to https://. But I still can not run the esxcli --server command with --thumbprint option to successfully run this python script.

Any more ideas?

Because I do not use the vCenter to access these ESXi hosts but only individually managing it via its IP, I wonder some other setting is needed to get this python script to work.

If possible, please try to setup a test ESXi 6.x install, access it via its IP on browser to check this out - without adding it to vCenter. I am not a VMware expert and this test will, if possible, will tell us what is going on.

The ESXi shell is enabled on this host. You should disable the shell unless it is necessary for administrative purposes. SSH is enabled on this host. You should disable SSH unless it is necessary for administrative purposes.

Regards,

Mathew

[nickmoody]

Hi Mathew,

I remembered I already have a stand-alone 6.5 host running in a VM. It works fine for me. You are changing the thumbprint to match same as your host right?

If your unable to execute esxcli commands against the host even from a bash prompt then the issue is not with the Python script.

Nick

[mathewfer]

Hi Nick,

FIXED/RESOLVED.

Thank you for the prompt reply.

Yes, 100% agree that this is not python issue and rather vCLI format at the Linux bash CLI.

The issue was very simple. ESXi access has a odd password and on Linux CLI, I had the run the CLI as command as below - password within ' '. I am not sure this is due to keyboard setting in my Linux Ubuntu server or what. I had the two dollar signs in the password for ESXi 6.x but not for ESXi 5.x. I identified that being the only difference. First changed the ESXi 6.x password same as the ESXi 5.x - it worked. As we had many ESXi 6.x servers with the password with dollar sign, I had to add ' ' for the password. This fixed the issue for ESXi 5.x and 6.x.

..... --username root --password 'xxx$$$xx'

Then I had to modify the python script two lines as below.

get_build='esxcli --server'+ ' '+host+' '+'--username'+' '+username+' '+'--password'+' \''+password+'\' '+'--thumbprint'+' '+thumbprint+' '+'--debug --formatter=python system version get

save_config='vicfg-cfgbackup --server'+ ' '+host+' '+'-username'+' '+username+' '+'-password'+' \''+password+'\' '+'-s'+' '+backup_folder+filename

Thank you for your continuous support and also testing this for me.

Mathew