Support SSH-less Deployment and Lifecycle Management for IBM Storage Defender DRS Sensors

Many enterprise and regulated environments prohibit the SSH protocol on production Windows and Linux servers, including temporary access over TCP port 22.

The currently documented IBM Storage Defender Data Resiliency Service sensor deployment model requires a Sensor Control Node—either the internal node in the Connection Manager or an external Ansible Control Node—to connect to target virtual machines using SSH over TCP port 22.

This requirement applies not only to the initial sensor installation but also to subsequent lifecycle operations such as updates and removal. SSH key authentication removes the need for a password, but it does not remove the SSH protocol requirement.

For Windows environments, enabling OpenSSH Server introduces an additional remote-management service that may conflict with established security baselines. Many customers already use approved software-distribution and endpoint-management platforms and do not permit a separate SSH management channel.

The current public IBM documentation does not describe a supported alternative based on WinRM, PowerShell Remoting, Microsoft Configuration Manager, Intune, other enterprise deployment tools, or a locally executed installation and registration package.

We request an IBM-supported SSH-less deployment and lifecycle-management option for Defender sensors on supported Windows and Linux virtual machines.

The solution should support:

• Sensor installation, registration, update, repair and removal without SSH or TCP port 22.
• Secure association of the sensor with the correct Connection Manager and DRS tenant.
• Non-interactive deployment suitable for enterprise automation.
• Digitally signed installation packages and configuration artifacts.
• Short-lived or one-time registration credentials.
• Central deployment status and audit information in the DRS user interface.
• Credential rotation and sensor re-registration.
• Compatibility with restricted and disconnected network segments.
• A documented rollback and troubleshooting procedure.
• Clear support boundaries for customer-managed deployment tools.

This capability would significantly improve adoption in regulated environments and reduce the need for security exceptions.