On Gandi (or other providers) you can activate an emergency console to your VM. It binds a SSH channel to a temporary IP and port.
I have my own server running on xen. I would like to implement an emergency console, but I don't know where to start.
A console can be accessed with the
xm console <servername> command. I guess it can be possible to bind stdin/stdout/stderr to an SSH server that runs on a chosen random port.
The overall idea is, when somebody needs an emergency access to their VM they can log in on the hypervisor website with its own credentials and hit the "enable my emergency SSH access". From there a random port is bound to the VM for a specified duration.