Linking Deployment Manager to Agents

This page describes how Deployment Manager and Agent servers communicate in a secure way.

Background

Some deployment technologies have no security at all. Some require machines to be on the same Active Directory domain, or on the same LAN. Others require you to set up usernames and passwords, and to store them in configuration files.

When designing Deployment Manager, we wanted to make it easy to have secure deployments out of the box, without expecting machines to be on the same domain. A common example is when the Deployment Manager server is running in your local LAN, close to your developers, while your production servers are running in the cloud or at a remote data center.

We achieve this security using public-key cryptography.

Deployment Manager/Agent communication

The Agent service listens on TCP port 10301 by default, though this can be changed during the installation. Deployment Manager sends commands to it in the form of HTTP requests. These requests are encrypted using a pair of X509 certificates. This establishes a trust relationship between the two machines:

1. Your Deployment Manager server will only issue commands to the Agents that it trusts
2. Your Agents only accept commands from a Deployment Manager they trust.

When you install the Agent service, you add a key for the Deployment Manager servers it should trust. When you register a machine in Deployment Manager, you'll add the Agent key.

In the diagram below, you can see the Deployment Manager web interface where machines are registered, and the Agent administration application:

Since this is all based on public-key cryptography, it creates a highly secure way for the two machines to communicate without exchanging passwords, and works much like an SSH connection in the UNIX world. If necessary you can further restrict access using IPSec or VPN's, though this usually isn't necessary.

Agent permissions

The Agent service by default runs as Local System. This is because during installation of your applications you usually need to perform tasks that require a high-degree of access to the machine.

For the sake of security, however, it's better to create a custom Windows user that has only the permissions you know you'll need. You can then configure the Deployment Manager Agent windows service to run under that account.