Again, more than happy to continue the discussion here, but might be more useful in a chat. If you’d like, send me email thesecurityguy at rightscale.com

Looks like we need to configure the firewall to allow transportation of RightAgent related packages. Without proper management of firewall rules from what you are describing it appear that for the RightAgent to work the communication port used by the RightAgent should be open for traffic in the firewall to be accessible from any IP address in the world!

As far as the “Managed SSH” feature, it does use SSH, but from YOUR system to the instance, not the RightScale core.

Why can’t we limit the ssh port access to only Rightscale trusted servers using firewall for the instance? Will the “Managed SSH” feature use SSH protocol for communication with the instance or will it use some other mechanism?

Option 2: “bleeding edge”
- Point your instances at Tony Spataro’s personal tarball and boot in “tarball mode” (no guarantees that the tarball stays stable, but it works now)
- To do “tarball mode”
– choose a MultiCloudImage that uses a recent vintage of RightLink (e.g. 5.7). Ubuntu is strongly preferred
– Tag your server with “rs_agent_dev:package=tony”
– Launch the server

If you’re playing with it, try doing some sftp and scp commands and look at the audit history. you will be pleasantly surprised.

I had previously requested this feature. In my mind, this is a huge value add for RightScale. We had to implement it ourselves as we prepared for a PCI audit and everyone using root to access the box (separate keys or not) was not going to pass the audit.