# scp, both source and destination (if both esxi)
esxcli network firewall ruleset set --ruleset-id sshClient --enabled=true

# outgoing http for wget
esxcli network firewall ruleset set -e true -r httpClient

# unlock user
pam_tally2 --user root --reset