Home / server / Questions / 775106
In Process
strugee
Asked: 2016-05-06 10:41:15 +0800 CST

How can I ensure auditability and least privilege based on AWS users inside an EC2 image?

  • 772

I'm interning at a company which runs in an AWS environment and is starting to look into locking down user privileges, so I'm looking into ways to secure EC2 instances. Specifically, I want to find a way to avoid handing out a keypair that grants unconditional access to ec2-user, which with the default Amazon Linux sudo policy, is essentially root and has the additional downside that there's no audit log (so if someone runs something malicious while SSH'd into an EC2 instance, there's no way to tell who because the Linux user executing commands is always ec2-user).

My first thought was to do this via PAM, similar to how LDAP is integrated into PAM via pam_ldap or somesuch, but I can't find anything that will let me use IAM as an auth backend. I could just manually add users, since there's a very small amount of people that actually need access, but that seems prone to human error as well as being the type of thing that will inevitably become more and more inconsistent over time.

I've searched the web as well with no luck.

What's the best practice here?

amazon-ec2 sudo pam amazon-web-services

1 Answers

  1. My first thought was to do this via PAM, similar to how LDAP is integrated into PAM via pam_ldap or somesuch, but I can't find anything that will let me use IAM as an auth backend

    I think you are thinking about this the wrong way round, try to extend your domain into IAM for a start so that users are logging into AWS with their domain credentials instead of separate IAM credentials. the most useful aspect of IAM is role based access and policies for AWS users - this doesn't extend into cloud instances so more traditional domain-ness needs to be configured, such as creating a virtual private cloud (VPC - read VPN) and bootstrapping instances so that they are configured specifically for your domain.

    Specifically, I want to find a way to avoid handing out a keypair that grants unconditional access to ec2-user, which with the default Amazon Linux sudo policy, is essentially root and has the additional downside that there's no audit log (so if someone runs something malicious while SSH'd into an EC2 instance, there's no way to tell who because the Linux user executing commands is always ec2-user).

    bootstrapping cloud instances

    as you know when you boot an instance in the cloud, you associate the instance with an image, a network, a security group, a public key and so on, and then you can ssh or rdp into the instance with the private key or password, usually as the user ec2-user or admin for windows - but you can also bootstrap the instance using a service called cloud-init, when launching an instance choose 'advanced options'

    AWS dashboard launch instance wizard

    Inside the text box you can paste in your cloud-init script, cloud-init is your basic bootstrapper, you can use it to install packages, run scripts, modify the system, add users and groups etc. it's known as 'Userdata' cloud instances look for any user provided data by making a http request on the instances loopback address (which is redirected)

    GET http://169.254.169.254/2009-04-04/user-data

    so here is an example of a script that will add some users and other authorised keys

    #cloud-config
users:
  - name: demo
    groups: sudo
    shell: /bin/bash
    sudo: ['ALL=(ALL) NOPASSWD:ALL']
    ssh-authorized-keys:
      - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDf0q4PyG0doiBQYV7OlOxbRjle026hJPBWD+eKHWuVXIpAiQlSElEBqQn0pOqNJZ3IBCvSLnrdZTUph4czNC4885AArS9NkyM7lK27Oo8RV888jWc8hsx4CD2uNfkuHL+NI5xPB/QT3Um2Zi7GRkIwIgNPN5uqUtXvjgA+i1CS0Ku4ld8vndXvr504jV9BMQoZrXEST3YlriOb8Wf7hYqphVMpF3b+8df96Pxsj0+iZqayS9wFcL8ITPApHi0yVwS8TjxEtI3FDpCbf7Y/DmTGOv49+AWBkFhS2ZwwGTX65L61PDlTSAzL+rPFmHaQBHnsli8U9N6E4XHDEOjbSMRX [email protected]
      - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcthLR0qW6y1eWtlmgUE/DveL4XCaqK6PQlWzi445v6vgh7emU4R5DmAsz+plWooJL40dDLCwBt9kEcO/vYzKY9DdHnX8dveMTJNU/OJAaoB1fV6ePvTOdQ6F3SlF2uq77xYTOqBiWjqF+KMDeB+dQ+eGyhuI/z/aROFP6pdkRyEikO9YkVMPyomHKFob+ZKPI4t7TwUi7x1rZB1GsKgRoFkkYu7gvGak3jEWazsZEeRxCgHgAV7TDm05VAWCrnX/+RzsQ/1DecwSzsP06DGFWZYjxzthhGTvH/W5+KFyMvyA+tZV4i1XM+CIv/Ma/xahwqzQkIaKUwsldPPu00jRN user@desktop
runcmd:
  - touch /test.txt

    this kind of approach will allow you to develop a way of boot strapping user accounts and permissions (this is the same way the ec2-user is set up). Or you could use cloud-init or cloud formation to domain join the instances on boot.

    http://cloudinit.readthedocs.io/en/latest/

    hope that helps.

    • 0