- does this assume that the user the JON Server is running as the
same
user you're ssh'ing as?
it seems it would have to in order to find the
user's private key; perhaps this could be made more flexible by
providing an option to upload a private key
Greg and I talked about how we can handle key authentication. Note:
today the remote agent install does nothing with the user's private key
- we don't use it, we don't look for it, etc. This is because we rely on
ssh password authentication, not key authentication. Therefore, what
user the RHQ Server is running as is irrelevant in today's implementation.
The problem with key auth is - how do we know where the private key is?
How do we get it to the server to use? Would a user actually allow us to
ask him to upload the private key? I was very hesitant to do anything
with asking for private keys to be uploaded to the server, saving it to
disk, etc. etc. Security issues need to be considered.
We'd have to get a newer version of JSch to get an API we'd need
(JSch.addIdentity(Identity)) and we'd need to write custom code to keep
the key in memory (rather than writing it to disk which to me would not
be secure enough for me to want to use it myself).
Anyway, to answer your question - you don't need the Server running as
the same as the user pushing the agent because we use password auth and
the user gives us the password in that UI form (note: obviously, the
user should be going over https to the server GUI unless he wants his
password to go out in the clear from browser to server; but at least the
password remains in memory and we don't write it to disk anywhere :)
- it would be cool if after you installed an Agent it detected when
that
Agent had sent its first inventory report and provided a message
informing the user of that, along with a link to the auto-inventory page
- going to the Remote Agent Install page to stop and start existing
agents is not intuitive to me; I think I'd move that functionality to
the HA>Agents page, where all of the installed agents are listed; I'd
even consider moving all of the new functionality under HA>Agents,
perhaps with an "Install New Agent..." button as an entry point to the
functionality
Should all be part of a site wide UXD design discussion. With the new
GWT stuff, we'll need to do this across the entire app to make sure
things still make sense.