Once a machine is connected to a dashboard, running commands from the browser is an obvious next step. Checking a disk, restarting a service or opening a terminal makes managing servers and routers easier. It also gives the dashboard the ability to change those machines. A monitoring outage and a compromised command interface have very different consequences.

The previous article covered outbound connections, device approval and identity. This article follows the next decision: if an agent already trusts its server, why verify a browser signature before running a command? The details below describe Fleetd v0.3.0. Signing adds an independent check, but its assumptions include the code served to the browser and what happens after an interactive terminal opens.

A dashboard session is not unlimited authority

In a conventional design, the administrator logs in, the server authorizes an operation, and the agent executes the server's message.…