Accessing the Veeam Host Management TUI via SSH on VSA/VIA
A few weeks ago I had a Veeam ticket that required exporting a lot of information from the shell of a Veeam Software Appliance (VSA) and entering some long commands.
Anyone who has ever had to log in via iLO/iDRAC (on a physical server) or through the console of a VM knows what a struggle that can be: passwords, no copy & paste, poor scaling, … And of course this case was no different.
However, support showed me a brilliant way to log in to a Veeam Software / Infrastructure Appliance via SSH and then open the Host Management TUI directly. Once the shell is enabled, you can work in it comfortably, paste commands in and copy exports out. It simply makes the work so much easier, and since I learned this method, I use it very often.
Since the rest of the world should benefit too, and nobody should have to get annoyed by trivial things like wrong keyboard layouts in iLO, I’m going to walk through the process here.
Host Management Console, TUI, Web UI: What’s what?
To clear up the terminology right from the start and avoid any confusion, here is a short explanation of the different terms.
Anyone working with the Veeam Software Appliance for the first time quickly stumbles over terms like “Host Management Console” and “Host Management TUI”. Since they often get mixed up, it’s worth taking a quick look at what’s actually behind each name.
Veeam Host Management Console
The Host Management Console isn’t where you manage your backups; it’s where you manage the appliance host itself, meaning things like networking, access and maintenance. It isn’t a single tool, but the umbrella term for two different interfaces: the TUI and the Web UI. The TUI and the Web UI do not have feature parity. Depending on what you want to do, you need the appropriate interface.
Veeam Host Management TUI
The TUI is the text-based menu interface you see directly on the physical or virtual console of the machine, deliberately without direct SSH access. In other words, it isn’t set up as an SSH login shell, but as shown below, it can be started manually after an SSH login. It is essentially your basic and emergency access, because functions such as advanced network settings, the root shell or re-enabling the Web UI can only be found here.
Veeam Host Management Web UI
After the initial setup, you can conveniently manage the appliance in your browser via port 10443. The Web UI offers some convenience features, such as exporting events or configuration files, user management… and for security reasons it can also be disabled completely if needed.
When does it make sense to use the ssh way?
The classic case is a support ticket. When support wants logs, config dumps or the output of certain commands, they want them as a file, not as a screenshot of a console. Over SSH, you can simply copy & paste the output. Conversely, the sometimes endlessly long commands that support sends you can be pasted in cleanly instead of typing them out and then wondering why they don’t work.
Then there’s the keyboard layout issue. Anyone who has ever typed a complex password with special characters blind into an iLO console knows what I mean. With SSH, the layout comes from your own client and the problem solves itself.
The third case is when you simply can’t reach the console. The management network with iLO/iDRAC isn’t reachable from your home office without VPN.
And finally, plain convenience. Proper scrollback, a window of usable size, clean resizing, searching log files with less and grep without staring at a 24-line field of view. After the first time, you won’t want to go back.
What should you keep in mind?
The server obviously has to be reachable via SSH (firewall rule required if the server is in a different network!), and you need the credentials of a host admin and a veeamso.
On top of that, you should understand the appliance’s permission model, otherwise you’ll be surprised along the way. The Host Administrator (typically veeamadmin) is allowed to turn SSH on and off and request access to the shell. However, they cannot approve this themselves; that’s what the Security Officer (veeamso) is for. If you didn’t create a Security Officer during installation, you don’t have this intermediate step and get through immediately. Handy in a lab, but not a good idea in production!
Also, veeamadmin does not get root privileges in the classic sense. It’s not sudo. The shell you end up with is provided by Host Management and runs in the root context. Once the Security Officer approves the request, access is valid for eight hours from the first login. The Security Officer can revoke it early (simply withdraw the request), or veeamadmin can disable it again via the Web UI or TUI. This is important later when cleaning up.
And one more note before someone learns it the hard way: anything you reconfigure on the operating system bypassing Veeam is not supported. The shell is for diagnostics and for whatever support tells you to do.
The process
Enable SSH
Log in to the appliance’s Host Management Console, either via the Web UI on port 10443 or locally at the console.
In the Web UI: Remote Access → switch SSH Server to On. This enables the SSH server under “Remote Access” in the Host Management Console. Since a Security Officer is configured, a message appears stating that the request has been submitted for approval and that SSH will be active for 8 hours after approval.
Directly in the Host Management TUI: Remote access configuration → Enable SSH server.
Wait for approval
If a Security Officer is configured, port 22 is only opened after their approval. You need to log in to the Host Management Console on port 10443 as veeamso and approve the request.
Connect
Connect to the appliance via SSH using PowerShell or PuTTY:
ssh veeamadmin@vbr01.lab.local
Start the Host Management TUI
This is the part that confuses you the first time: after the SSH login, you don’t automatically land in the interface. You start it manually with the command:
/opt/veeam/hostmanager/veeamhostmanagertui
Log in to the Host Management TUI
The Host Management TUI start screen shows the host overview (product name, IP address…), just as you know it from the KVM/VMware console. Press Enter to get to the login.
Log in here with the veeamadmin username, password and MFA. This is where you already notice the huge advantage of copy & paste being possible
Request shell access
In the TUI main menu, select the “Remote access configuration” option and press Enter to open it.
In the submenu, select “Request shell access” to request root shell access.
Confirm the security prompt “Enable shell access?” with “Yes”.
Alternatively in the Web UI under Overview, in the Quick Actions, via Request root access.
Wait for approval
The Security Officer sees the pending request “User veeamadmin requests root shell access” in their Host Management Console and approves it via “Approve”.
Enter the shell
After approval, the new menu item “Enter shell” appears in the Host Management TUI, which takes you into the shell when you press Enter. (You have to exit the dialog once and go back in; only then is “Request shell access” replaced by “Enter shell”.) With F1, shell access could also be disabled again when cleaning up at the end.
The root shell is now open, recognizable by the prompt
[root@ /]#
As you can see, you can now work as root in the shell just as usual.
Now you can copy and paste perfectly, there are no character limits or screen limitations, and you can work freely without any KVM or console restrictions. Maybe you can even have a little fun while you're at it, even if it's just a support ticket or something that needs to be tested ;-)
Disable the shell, revoke privileges and clean up
Once the work is done, all services and permissions must be rolled back without exception, so that no SSH remains open and the elevated privileges are removed.
Specifically, this means: first, leave the shell with exit. Then revoke the root privileges, either by having the Security Officer reject the still-active request so the approval doesn’t keep running for the remaining hours, or by reclaiming the privileges as the Veeam admin in the Host Management Console via “Revoke root privileges now?”. Since the SSH server would otherwise remain active until the remaining time expires, it must additionally be disabled using the toggle switch.
Finally, do a quick check from the outside with powershell:
tnc -computer vbr01.lab.local -port 22Only when nothing responds on port 22 anymore can you check this item off.
Tip: Check the TUI before requesting the shell
A small tip on the side: a surprising amount can be done in the Host Management TUI itself without needing a shell at all. Network, time, proxy settings… all have their own menu items. Before requesting shell access, it’s worth checking whether you can manage without it.
Note on the documentation
One more remark about the documentation: it states that the root shell is only accessible via a local or virtual remote console and explicitly not via SSH. The method described above works nonetheless and was given to me exactly like this by support.
My interpretation is that the statement refers to a direct root login via SSH, which indeed doesn’t exist. Here you don’t authenticate as root against sshd; instead, you go through the complete host management logic including approval. This of course makes it a secure method again, and no direct root access is possible.
Conclusion
The method itself is really simple and makes my work easier in so many places, so feel free to try it out and use it. I now use it almost daily.
*the first picture is AI created
Original post is on my blog: Accessing the Veeam Host Management TUI via SSH on VSA/VIA - petersvirtualworld.de
