Security
Ready for your customer's security review.
Copy the firewall request, check connectivity, and review what the agent installs and records.
Firewall change request — device egress
- Purpose
- Management agent on our Linux appliance. Outbound connections only.
- Destination
- commandplane.com — resolves to 15.197.93.179, 15.197.160.235. Allowlist the hostname, or use these addresses for fixed-IP rules.
- Port
- TCP 443, TLS (HTTPS and WebSocket).
- Direction
- Outbound only. No inbound rule, no port forward, no VPN.
- Connections
- One long-lived outbound control connection that reconnects with backoff. Shell and tunnel sessions open extra outbound WebSockets on demand and close with the session.
- Listeners
- No inbound connections to the agent are required. Its diagnostic endpoints bind to localhost.
- Through it
- Heartbeats (hostname, OS, arch, MAC and IP addresses, agent version); commands our operators queue and their results; on demand, a recorded browser shell or a port tunnel to 127.0.0.1 on the appliance, source-restricted and time-limited.
Verify from inside the network
curl -sS -H 'Accept: application/json, */*' https://commandplane.com/connection
Expected response
{"ok":true,"port":"443","host":"commandplane.com","organization_name":null,"client_ip":"<your egress IP>","checked_at":"2026-09-02T13:19:06.373696Z","expected_host":"commandplane.com","proto":"https"}
Run this from the device's network to check HTTPS connectivity before installing. Shells and tunnels also require WebSocket support.
Standard Linux/systemd installation
These paths describe a Standard Linux/systemd installation. Manual installs keep binaries and config in the chosen directory and do not create a boot service or updater timer.
- /usr/local/bin/commandplane-agent
- static Go binary
- /usr/local/bin/commandplane-agent-updater
- same; runs from its own service and timer
- /etc/commandplane/config.json
- root-owned, mode 0600: device id and device secret; agent state and the result journal live beside it
- /etc/systemd/system/commandplane-agent.service
- User=root · Restart=always · RestartSec=2 · NoNewPrivileges=yes · PrivateTmp=yes · After=network-online.target
- /etc/systemd/system/commandplane-agent-updater.service
- and commandplane-agent-updater.timer: daily by default, randomized delay up to 2 h
- Heartbeat every 90 s plus up to 30 s of jitter: hostname, OS, arch, MAC and IP addresses, agent version.
- Commands you queue run as root with a 5-minute default timeout; stdout and stderr are capped at 64 KiB each.
- The agent checks for updates on its own and hands off to the updater, which verifies the SHA-256 before swapping binaries.
- The installer verifies downloads and checks agent health. Failed transactions attempt to restore the previous installation.
An uninstall helper is served at /agent/uninstall.sh (--system, --purge-config, --dry-run).
What their auditor sees.
- Device identity
- A per-device secret issued at registration and shown once. The server keeps an HMAC-SHA256 of it and checks it on every request. Delete the device and it stops working.
- Enrollment
- Install links expire, 15 minutes by default. With approval on, a new device stays pending until an operator accepts it.
- Commands
- Queued by a named user. Claimed, completed, exit code, stdout and stderr stay on the record.
- Shells
- Recorded as asciicast v2, attributed to the user who opened them, replayable. Closed after 30 idle minutes.
- Tunnels
- Source-IP allowlist required and defaulting to the requester's IP. 15 minutes by default, 24 hours at most. Creator and close reason recorded.
- Updates
- Every agent update is verified against the SHA-256 in the release manifest before it is installed.
- Not currently available
- SSO and SAML. Today sign-in is an emailed link or Google.
- Not currently available
- Audit export. Today command, shell and tunnel history live in the app, and commands and tunnels are readable over the API.