John's questions

The AWS documentation on peering refers to the situation where VPCs B and C each have a subnet with an identical CIDR and which are both peered with VPC A, as per the diagram below:

The documentation does not make it clear to me whether it is possible to set up the routes within VPC C such that response traffic is routed to the correct subnet in the correct VPC. Is this possible?

i.e. if traffic originates in Subnet B of VPC B, can its return traffic be correctly routed to it, such that traffic originating in Subnet B of VPC C also has its return traffic correctly routed to it? If so, how do you do this?

I have an AWS CloudFront distribution created using CDK (CloudFrontWebDistribution) fronting an ApiGateway, deployed in eu-west-1 (Dublin). I can see in the API logs that the CloudFront-Viewer-Country header is set to US, even though I am accessing the API from the UK.

Why is this please?

I want to increase the permitted number of open files for processes started by AWS SSM agent. I have added to /etc/security/limits.conf:

*  -  nofile  65535

(I am aware that this is for all users). When I log in to the server and run ulimit -n, I see the new limit of 65536. However, when I run an SSM RunCommand:

id && ulimit -n

I see the following in the logs:

uid=0(root) gid=0(root) groups=0(root) 1024

It would appear that amazon-ssm-agent is not picking up the new settings. I can see that the daemon process is running as root, however.

$ ps -ef | grep ssm
root      4843     1  0 07:30 ?        00:00:00 /usr/bin/amazon-ssm-agent

How do I increase the ulimit value?

I want to pass some headers that are retrieved from one location and pass them via a redirect to the user's localhost. However, I cannot see the headers. Is this possible and if so, how do I do it?

Here is a location where we add a header then call rewrite:

location = /proxy-localhost/9000 {
    // in due course, I will pass other headers, but for now let's just pass this
    add_header 'Dummy' "dummy_val";
    rewrite ^ http://localhost:9000;
}

However, when I run a simple server using ncat on localhost, I don't see a header called Dummy in the output when I trigger the /proxy-localhost location block via a curl request (I can see the rewrite being actioned in the logs, so I know the block is being triggered):

$ for i in {1..3}; do echo -e "HTTP/1.1 200 OK\n\nOK" | ncat -vv -l 9000; done

I want to use HAProxy to terminate TLS-encrypted TCP connnections and to pass the unencrypted TCP traffic to various backends based on the Server Name Indication used to initiate the TLS connection.

I have 3 services running on a backend server, each on a different port (5001, 5002, 5003). HAProxy binds to port 5000. I'd like to route connections to the first 2 servies by name or to the third if there is not a match. I am initiating the connecton to HAProxy using openssl s_client. However, in the logs I can see that the connections are only ever routed to the default server, i.e. the SNI seems to be ignored.

DNS:

A record     demo.sni.example.com     1.2.3.4
CNAME        1.sni.example.com        pointing to demo.sni.example.com   
CNAME        2.sni.example.com        pointing to demo.sni.example.com   

i.e. I'd like the following routing to occur:

SNI = 1.sni.example.com:5000 -> 1.2.3.4:5001
SNI = 2.sni.example.com:5000 -> 1.2.3.4:5002
anything else on port 5000 -> 1.2.3.4:5003

haproxy.cfg:

global
  log stdout  format raw  local0 info

defaults
  timeout client 30s
  timeout server 30s
  timeout connect 5s
  option tcplog

frontend tcp-proxy
  bind :5000 ssl crt combined-cert-key.pem
  mode tcp
  log global
  tcp-request inspect-delay 5s
  tcp-request content accept if { req_ssl_hello_type 1 }

  use_backend bk_sni_1 if { req.ssl_sni -i 1.sni.example.com }
  use_backend bk_sni_2 if { req.ssl_sni -i 2.sni.example.com }
  default_backend bk_default

backend bk_sni_1
  mode tcp
  log global
  balance roundrobin
  server server1 1.2.3.4:5001 check

backend bk_sni_2
  mode tcp
  log global
  balance roundrobin
  server server1 1.2.3.4:5002 check

backend bk_default
  mode tcp
  log global
  balance roundrobin
  server server1 1.2.3.4:5003 check

combined-cert-key.pem is a self-signed certificate file plus key where the CN is the IP of the server (1.2.3.4) and there are SANs of all DNS values and the IP.

Connections initiated using openssl s_client:

I have tried connecting via DNS (A & CNAME records, as well as IP):

echo test | openssl s_client -connect demo.sni.example.com:5000 -servername 1.sni.example.com
echo test | openssl s_client -connect 1.sni.example.com:5000 -servername 1.sni.example.com
echo test | openssl s_client -connect 1.2.3.4:5000 -servername 1.sni.example.com

However, all connections are routed to the default backend bk_default.

What is causing HAProxy to not recognise the SNI servername? (I am using the latest HAProxy docker image: https://hub.docker.com/_/haproxy)

AWS Application Load Balancers (ALB) support authentication: https://aws.amazon.com/blogs/aws/built-in-authentication-in-alb/.

The documentation talks about human users - users arriving at the ALB are redirected to an Identity Provider (IdP) if they are unauthenticated.

Does ALB support authenticating EC2 instances? i.e. how can I ensure that only certain EC2 instances can access a service that resides behind an ALB?

How can I use AWS SSO to allow users to authenticate against an Application Load Balancer (ALB)? Here's a link to the ALB authentication announcement.

Can AWS SSO integrate directly into ALB authentication, or is it necessary to do something like use an AWS Cognito Identity Pool to manage access to the ALB, and federate the pool to AWS SSO?

Is there a way of getting the password hash for a named LDAP user where the user is defined within Open Directory on a MacOS Server running OSX Sierra and MacOS Server 5.2?

My use case:

I am setting up a CI/CD node using Jenkins within a Docker container that will run on a server that runs MacOS Server. I want that Jenkins container to be secured and to be secured using the LDAP open directory of the server, i.e. a user wanting to modify the Jenkins configuration needs to use their own network user/password to log in to Jenkins.

As part of configuring this, I need to copy an XML file (config.xml) into the Jenkins home directory and this file needs to contain the hashed password of the user that secures the LDAP system. I think the password hash is stored in an encrypted directory and therefore I want to know how to retrieve it.

I want the whole of the deployment script to be automated, and so I need to be able to retrieve the hash (or recreate it) for the named user so that it can be injected into the XML file that will be put into the Jenkins home directory.