Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

The first time I access my server with a new installation of Filezilla or Putty, I will get prompted that I should continue only if the RSA key shown to me is correct. The cloud provider has advice on their website that I ought to use their AJAX console to get a key out-of-band with which to compare to the one shown by Filezilla.

The AJAX console is launched from a link on the cloud provider's website which requires a login. Exactly how is this AJAX console considered to be out-of-band when it obviously is not a form of physical access to the server?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

An AJAX console accessed over the same media (i.e. Ethernet ports and cabling) as the server uses to provide it's normal service is not what I would consider to be out-of band.

Normally "out-of-band" means a completely separate and independent communications path with no potential point of failure in common with the path used to provide normal service. In previous decades that might mean a dial-up modem. Nowadays it might mean a separate Ethernet network accessed using separate Internet connectivity. It is conceivable that an "AJAX console" might be provided that way but that description (AJAX console) by itself is not sufficient to be sure.

share|improve this answer
    
When the OP mentioned a "cloud provider" I imagine the AJAX console is simply a wrapper for a console like Xen's hvc0 console. Thus, in the context of virtualization, using OOB to describe this console is a good fit. –  Garrett Apr 9 '12 at 17:39
    
Both Garrett's and RedGrittyBrick's answers provide good information. I pick this answer because it addresses the more general security concern. Thanks to you both. –  broiyan Apr 10 '12 at 5:08

Out-of-band is probably used in the wrong context here, but nevertheless I'm sure is intended to imply the console is similar to or emulates a typical local console. Most virtualization hypervisors (Xen, KVM, etc.) offer this by way of connecting to an IP that is attached to dom0, thus allowing you to connect to your virtualized node "out-of-band" -- meaning even if the network interface on your instance is down, you can still get access. Obviously this isn't true out-of-band by the traditional definition, but still fits the description of "system console access provided, even in the event of primary network subsystem (hard and/or software) failure" when speaking in a virtualized context.

share|improve this answer
1  
I don't know about the details you offer but I would agree the AJAX console is a very different communication method because it is supposed to work even when the server has networking turned off. The point of this, I believe, is security against spoofing. The communication being different seems to be a bit of protection against spoofing only because it's more work for the spoofer to spoof two different ways, or so it would seem to me. –  broiyan Apr 9 '12 at 17:29
    
Exactly. The AJAX console is connecting to a virtual console on the host server which is out-o-f-band in the context of your node. If the key can be verified in both places, they're saying it should be safe(r) to trust. –  Garrett Apr 9 '12 at 17:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.