VMware ESXi and vSphere Cluster Management

Managing ESXi Host Services with the Security Profile

Learn how to view, start, stop, restart, and configure ESXi host services and startup policies in the vSphere Web Client Security Profile.

The ESXi Security Profile is the host configuration area for security-related settings, including host services and firewall behavior. Its service controls let an administrator view service status, start or stop a service, restart it, and select how it behaves during host boot, shutdown, and firewall-port changes.

An ESXi host service is a host-level daemon or background process that provides management, communication, or infrastructure functionality. These settings apply to services running on the ESXi host itself. They do not manage services inside virtual machines or applications running in a guest operating system.

Access the ESXi Service Controls

Use the vSphere Web Client to open the service-management interface:

1. Select the ESXi host in the inventory.
2. Open Manage.
3. Select Settings.
4. Open Security Profile.
5. In the services section, select Edit services.
6. Select an individual service to review its current running state and startup policy.

Select ESXi host > Manage > Settings > Security Profile > Edit services

The service list normally exposes the service name, whether it is running, and its configured startup behavior. Select the service before using the available controls to start, stop, or restart it, or to change its startup policy.

Service Lifecycle Operations

Start a service

Start a stopped service when a planned administrative task, diagnostic procedure, or required host function needs it. Before starting a network-facing service, confirm that its required firewall port is permitted and that enabling the service is authorized.

Stop a service

Stop a service that is not required, especially after temporary troubleshooting or maintenance. Stopping a remotely used service can immediately remove an administration path. For example, stopping SSH ends SSH-based access to the host.

Restart a service

Restart a service after changing a service-related configuration or when the service is running but not responding correctly. A restart interrupts current connections and operations provided by that service, so perform it during an appropriate maintenance window when the impact is significant.

Change a startup policy

A startup policy determines how and when ESXi starts or stops a service. Changing the policy affects future host boots and, for port-usage management, future firewall-port changes. Always review the resulting state after the change.

ESXi Service Startup Policies

The service editor provides three important startup-policy choices. The exact availability of a policy depends on the service and its relationship to ESXi firewall rules.

Start and stop with host

This policy starts the service shortly after the ESXi host boots and stops it shortly before the host shuts down. It is appropriate when the service should normally be available whenever the host is operating.

Start and stop manually

With manual control, the administrator explicitly starts or stops the service. The selected state persists through a host reboot. A service that was running before the reboot remains configured to run afterward, while a service that was stopped remains stopped, subject to the service's own behavior and platform controls.

Start and stop with port usage

This policy ties service operation to associated ESXi firewall ports. If a service starts before network connectivity or the required port is available, it continues attempting the required work until it succeeds. When the relevant port becomes available, the service can start or retry its communication task. If all associated ports are later closed, the port-usage-managed service stops.

The start and stop with port usage option is recommended for applicable services because service availability follows the firewall exposure configured for that service. It does not replace careful firewall design: opening a port can permit the service to start and can also allow network traffic.

Services and ESXi Firewall Ports

Some ESXi services depend on corresponding firewall rules or ports. The service state and firewall state are therefore related, but they are not identical settings. A service can appear configured correctly yet fail to communicate because its required firewall port is closed.

• With port-usage management, opening an associated port can allow the service to start or retry its required work.
• Closing all associated ports causes a port-usage-managed service to stop.
• With manual management, port availability does not decide whether the service is running.
• When a service cannot communicate, check both its running state and the relevant firewall rule or port.

Coordinate service changes with firewall policy and organizational access controls. Do not open a firewall port merely to make a service appear operational without confirming that the resulting access is required and authorized.

SSH as a Host-Service Example

SSH, or Secure Shell, provides remote command-line access to an ESXi host. SSH appears in the Security Profile service list, where you can inspect whether it is running and review or change its startup policy.

1. Open the selected host's Security Profile service settings.
2. Locate SSH in the service list.
3. Identify whether SSH is running.
4. Identify the configured startup policy.
5. Decide whether SSH should remain available based on the current administrative requirement.

Limit SSH availability to authorized troubleshooting or administrative periods. If SSH is no longer needed, stop it and select a policy that prevents it from being unnecessarily enabled later. Before stopping SSH, establish an alternate access method, such as authorized console access. Stopping SSH ends SSH-based administrative access to that host.

Practical Service-Management Procedures

Review the state of SSH

Open the host's Security Profile service settings, locate SSH, and record both its running state and startup policy. Keep it available only when the current administrative need justifies the access path.

Enable a service only while troubleshooting

1. Start the required host service.
2. Confirm that the applicable firewall port is available when the service requires one.
3. Perform the diagnostic or maintenance activity.
4. Stop the service when the activity is complete.
5. Verify that the host no longer exposes unnecessary access.

Configure a service to follow firewall port usage

1. Select a service with an associated firewall port.
2. Set its startup behavior to Start and stop with port usage.
3. Open the relevant firewall port when the service is required.
4. Allow the service to start or retry its communication task if connectivity was not initially available.
5. Close the associated ports when the service is no longer required.
6. Verify that the service stops as expected.

Preserve a manually controlled state through reboot

1. Set the service to Start and stop manually.
2. Start or stop the service as required.
3. Reboot the host during a planned maintenance window.
4. Verify that the selected service state is retained after the reboot.

Troubleshooting Service Problems

A configured service does not perform its expected network task

1. Confirm that the service is running.
2. Confirm its startup policy.
3. Check whether the service requires an associated firewall port.
4. Verify that the required firewall port is open.
5. If the port was recently opened, allow time for the service to retry its required work.

A service stops unexpectedly after firewall changes

1. Determine whether the service uses Start and stop with port usage.
2. Check whether all associated ports were closed.
3. Reopen the needed port if the service is authorized and required.
4. Alternatively, select an appropriate startup policy if port-based control is not suitable.
5. Verify both the firewall state and the service state.

An administrator loses remote SSH access

1. Verify that the SSH service is running.
2. Verify that the SSH firewall rule or port is available.
3. Confirm that SSH was not stopped manually.
4. Use authorized alternate host access if remote access cannot be restored through the current session.

A service has an unexpected state after reboot

1. Review the configured startup policy.
2. For manual policy, remember that the administrator-selected state persists through reboot.
3. For host policy, expect state to follow the host boot and shutdown lifecycle.
4. For port-usage policy, check whether the required firewall ports were available and whether they caused the service to start or stop.

Operational and Security Practices

• Apply the least-functionality principle: enable only services required for administration or workloads.
• Review service state and startup settings after maintenance, troubleshooting, and host reboot.
• Coordinate service changes with firewall policy and organizational access controls.
• Plan an alternate access method before modifying the service used for remote administration.
• Use temporary service access deliberately: start the service, perform the task, stop it, and verify that unnecessary exposure is gone.
• Document intentional exceptions, including why a management service is enabled and which startup policy it uses.