VMware ESXi | Setup Issue: "All Authentication Methods Failed"

A VMware ESXi Inspector may fail with the following Setup Issue despite the SSH service being enabled and the configured credentials being correct:

In some environments, the issue is not caused by incorrect credentials or insufficient permissions. Instead, the ESXi host successfully authenticates the user but immediately terminates the SSH session because the service account is denied shell access through the ESXi access control configuration.

This article explains how to identify this scenario and restore SSH access for the service account used by the VMware ESXi Inspector..

The VMware ESXi Inspector displays the following error:

Additional observations may include:

Before following this article, verify the standard VMware ESXi Inspector configuration:

If these requirements have not been confirmed, first review the VMware ESXi Inspector Setup Guide.

From the Windows management device hosting the Liongard Agent, open PowerShell and test SSH connectivity.

Example

If prompted, accept the host fingerprint.

After entering the password, you may observe:

instead of receiving an ESXi shell.

This behavior indicates that authentication succeeded but the SSH session was immediately terminated by the ESXi host.

Ref:

Next, test the same connection using the root account.

If the root account successfully opens an SSH session while the Liongard service account is immediately disconnected, the issue is likely caused by ESXi access restrictions rather than invalid credentials.

While connected as the root user, inspect the access control configuration.

Review the file for an entry similar to:

The leading minus (-) explicitly denies SSH shell access for that account.

Although the account authenticates successfully, ESXi immediately closes the SSH session before Liongard can execute any inspection commands.

Ref:

As a result, the VMware ESXi Inspector reports:

even though authentication itself is successful.

Modify the access rule to allow shell access for the service account.

Change:

to:

Save the file.

After making the change, reconnect using the Liongard service account.

If the account now receives an interactive shell instead of immediately disconnecting, the shell restriction has been removed.

On ESXi, modifications to access.conf may be overwritten after a host reboot.

To make the change persistent, update the startup script so the access rule is reapplied during boot.

Example:

This inserts a command into local.sh that reapplies the change whenever the ESXi host starts.

🚨Note: Before making persistent configuration changes, consult your organization's VMware administration policies and validate the change in accordance with your environment's security requirements.

After restoring SSH shell access:

The inspector should complete successfully once SSH shell access is available to the configured service account.

The VMware ESXi Inspector authenticates to the ESXi host over SSH and executes a series of shell commands to collect inventory and configuration data.

In this case, authentication succeeded, but ESXi denied shell access through the local access control configuration (/etc/security/access.conf). Because the SSH session was terminated immediately after authentication, Liongard could not execute the required commands and returned the generic error:

Restoring SSH shell access for the service account resolves the issue.