PowerCLI: Enabling and Disabling SSH on vSphere hosts

I’m all about running PowerCLI to replace GUI management. Every once in a while there is a requirement to access the ESXCLI on my vSphere hosts, and this is a classic task that is a multi-click process and if you’re using the old 4.x or 5.0/5.1 web client, you may find the process very tedious.

PowerCLI to the Rescue

My suggestion is that the first window you should open up on your workstation each day, and that is the PowerCLI shell to do your VMware administrative work. Here is a great way to use that nifty little shell.

First, let’s walk through the process that we need to follow.

  1. Attach to your vCenter server
  2. Query your cluster to find the hosts
  3. On each host, enable SSH by starting the TSM-SSH service

On paper, it looks pretty easy. The surprising thing is that in PowerCLI it is just as easy as that 3 point list. Even more exciting is the fact that we are going to use the magic of the pipeline to create a one-liner for the whole process.

So for item number one you will most likely do this when you launch your PowerCLI shell. This is done with the Connect-VIServer CmdLet:

Connect-VIServer <yourvCenterHost>


This will prompt you for credentials as you can see here:


Now we are authenticated and we can move to step 2 which is to query the cluster. The Get-Cluster CmdLet is just what the doctor ordered:

Get-Cluster -name <yourclustername>


This returns the name of the cluster and nothing more. So let’s add in a pipe to a Get-VMHost CmdLet to get back a list of our vSphere hosts in that cluster:

Get-Cluster -name <yourclustername> | Get-VMHost


Alright, we have gotten to this point which is where it gets a little tricky. Now we have to turn on the TSM-SSH service on each host, but because we have our hosts in a pipeline, we need to get a little bit fancy.

Starting SSH with PowerCLI on One Host

We have to walk before we run, so the first thing we need to do is understand how to turn on SSH on one host, and then we can use that method to apply to each host from the query that we got from step 2.

This section has some challenges because we are going to do a Start-VMHostService using results from a Get-VMHostService using results from a Where clause query. That’s a bit weird sounding, so let’s just get to the code and it should make sense.

Start-VMHostService -HostService ($_ | Get-VMHostService | Where { $_.Key -eq “TSM-SSH” } )

Hopefully it makes sense when it’s written out like that. The command blocks are in parentheses which should help to differentiate each section. The great thing about PowerCLI and PowerShell is that you can run a CmdLet and pipe content into it from another query and you can even nest queries which is both awesome and confusing.

With our nice nested query in place, we just have to make this run for each of our hosts in the cluster that we queried. Hmmm…how would we do this for each of the hosts (HINT: The CmdLet is right there for us!)

Gluing it all together with our ForEach Loop – The Final One-Liner

The command line has come together easily now in bits and pieces. The last step is to put it all together into a single command line:

Get-Cluster | Get-VMHost | ForEach {Start-VMHostService -HostService ($_ | Get-VMHostService | Where {$_.Key -eq “TSM-SSH”})}

Make sure that you keep track of the opening and closing brackets there because some of them are curly and some are round brackets.

Let’s see the results!


Reversing the Process to Stop the SSH Services

Using the very same logic, we can replace the Start-VMHostService CmdLet with the Stop-VMHostService CmdLet and the SSH services will be stopped which is the default configuration for our vSphere hosts.

Get-Cluster | Get-VMHost | ForEach {Stop-VMHostService -HostService ($_ | Get-VMHostService | Where {$_.Key -eq “TSM-SSH”})}

One More Thing


If you ran the Stop-VMHostService one-liner you will notice that you are prompted in the shell to confirm the action for each host:


Assuming you know what it is that you are doing with this process, there is one simple parameter to drop into the command line on the Stop-VMHostService section which is -Confirm:$FALSE as we see here:

Get-Cluster | Get-VMHost | ForEach {Stop-VMHostService -HostService ($_ | Get-VMHostService | Where {$_.Key -eq “TSM-SSH”}) -Confirm:$FALSE}


Now that we have that command together, we can start and stop SSH on our clustered hosts with ease. You can also do the same for a list of non-clustered hosts by removing the Get-Cluster and the first pipe symbol.

Happy SSH-ing!

14 thoughts on “PowerCLI: Enabling and Disabling SSH on vSphere hosts”

  1. Thanks for this post. Please note that the last code example in which you pass the “confirm:$false”, you’ve actually got the start-VMHostService in it.

  2. Avoid the For loop altogether by taking advantage of the pipeline.
    Get-cluster | Get-VMhost | Get-VMHostService | Where-Object { $_.Key -eq “TSM-SSH”} | Start-VMHostService

    • Here is how you would do it so you only modify hosts that actually have it turned on as opposed to all hosts in the cluster regardless if service is on or not.

      Get-Cluster “NAME” | Get-VMHost | Get-VMHostService | Where {$_.Key -eq “TSM-SSH” -and $_.running -eq “true”} | Stop-VMHostService -Confirm:$false


Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.