ks78's questions

What is the preferred way to configure Amazon Security Groups to achieve a multi-tier architecture?

Each of my instances has its own Security Group, which I only want to use for rules specific to an instance. I'd like to keep any rules which apply to multiple instances in a separate Security Group, which can then be assigned to instance Security Groups as necessary.

As an example, I've setup a group called "admin", which allows administrative access from my IP. I added the "admin" group as the source to each of my instance security groups. However, I still can't access the instances from my IP without adding the rules directly to the instance's group.

Am I missing something? Although it seems a multi-tier security architecture should be possible, it doesn't seem to be working.

I have several Amazon EC2 instances, running Ubuntu, which need to communicate (web servers and a MySQL server). I'd like to use OpenVPN to ensure their communication is secure and to reduce the number of open ports. I've been following this article, but I've run into a problem. Note: I'm using port 1194, not port 80, as shown in the article.

I've installed and configured the OpenVPN server on the MySQL server and setup a web server to connect to it as a client. Running ifconfig shows a tunnel has been created on both sides, but data doesn't appear to be being transferred over it.

How do I change the default route to make it use the VPN tunnel? I'm assuming that's the problem, but I'm not positive.

Below are my server.conf and client.conf files. I am using tun rather than tap, from what I've read, I think that's the best choice. I currently have compression turned off, just to eliminate that as the problem.

server.conf

port 1194
proto udp
server 10.4.0.0 255.255.255.0
dev tun
dh dh1024.pem
ca ca.crt
cert mysqlserver.crt
key mysqlserver.key

client.conf

##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server.     #
#                                            #
# This configuration can be used by multiple #
# clients, however each client should have   #
# its own cert and key files.                #
#                                            #
# On Windows, you might want to rename this  #
# file so it has a .ovpn extension           #
##############################################

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun

# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one.  On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap

# Are we connecting to a TCP or
# UDP server?  Use the same setting as
# on the server.
;proto tcp
proto udp

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
;remote my-server-1 1194
;remote my-server-2 1194
remote myopenvpnserver.com 1194

# Choose a random host from the remote
# list for load-balancing.  Otherwise
# try hosts in the order specified.
;remote-random

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server.  Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nogroup

# Try to preserve some state across restarts.
persist-key
persist-tun

# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here.  See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]

# Wireless networks often produce a lot
# of duplicate packets.  Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings

# SSL/TLS parms.
# See the server config file for more
# description.  It's best to use
# a separate .crt/.key file pair
# for each client.  A single ca
# file can be used for all clients.
ca ca.crt
cert webclient.crt
key webclient.key

# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server".  This is an
# important precaution to protect against
# a potential attack discussed here:
#  http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server".  The build-key-server
# script in the easy-rsa folder will do this.
ns-cert-type server

# If a tls-auth key is used on the server
# then every client must also have the key.
;tls-auth ta.key 1

# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x

# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
;comp-lzo

# Set log file verbosity.
verb 3

# Silence repeating messages
;mute 20

I have several Amazon EC2 instances running Ubuntu 10.04 and I've recently started using Amazon's Route 53 as my DNS. The purpose of doing that was to allow the instances to refer to each other by name rather than private IP (which can change). I've pointed my domain name (via GoDaddy) to Amazon's name servers, allowing me to access my EC2 webservers.

However, I noticed I can now access the EC2 instances which I don't want to be public, such as the dedicated MySQL Server. I was thinking Amazon's Security Groups would still be in effect when using Route 53, but that doesn't seem to be the case.

Before I started using Route 53, I was thinking of having one instance run a reverse proxy, which would help protect the web servers behind it. Then IP-restrict all the other instances.

I know IP restricting can be done using the firewall within each instance, but should I ever need to access them from another IP address, I'd need a way in. Amazon's control panel made it a breeze to open a port when necessary.

Does anyone have any suggestions for keeping EC2 instances secure, but also accessible to their administrator?

Also, what's the best topology for a group of EC2 instances, consisting of web servers and a dedicated database server, from a security perspective? Does having a reverse proxy server even make sense?

I have a number of Amazon EC2 instances, all running Ubuntu, which I'd like to configure to use Amazon's Route 53.

I setup a script, following Shlomo Swidler's article, but ran into script-related issues, which were answered here. Now, I have the script working, but the only CNAMES being added to Route 53 by the script are the Amazon instance IDs (i-abcd1234.mydomain.com).

According to Swidler's article, the script allows Route 53 to pickup a "ShortName" tag, giving each instance a "friendly" CNAME. I have ShortName tags added to all my instances, but they haven't been picked up by Route 53.

Here's my script:

#!/bin/tcsh -f

set root=`dirname $0`
setenv EC2_HOME /usr/lib/ec2-api-tools
setenv EC2_CERT /etc/cron.route53/ec2_x509_cert.pem
setenv EC2_PRIVATE_KEY /etc/cron.route53/ec2_x509_private.pem
setenv AWS_ACCESS_KEY_ID myaccesskeyid
setenv AWS_SECRET_ACCESS_KEY myaccesskey

/usr/bin/ec2-describe-instances | \
perl -ne '/^INSTANCE\s+(i-\S+).*?(\S+\.amazonaws\.com)/ \
and do { $dns = $2; print "$1 $dns\n" }; /^TAG.+\sShortName\s+(\S+)/ \
and print "$1 $dns\n"' | \
perl -ane 'print "$F[0] CNAME $F[1] --replace\n"' | \
xargs -n 4 /etc/cron.route53/cli53/cli53.py \
rrcreate -x 60 mydomain.com

Has anyone else tried this? What could be preventing Route 53 from picking up the "ShortName" tags?

I have several Amazon EC2 instances, running Ubuntu 10.04, with which I'd like to use Amazon's Route53. I setup a script as described in Shlomo Swidler's article, but I'm still missing something.

When the script runs, it doesn't return any output, which I initially assumed meant it ran correctly. However, when I check the DNS records using MyR53DNS, there are no entries for my instances. Here's my script:

#!/bin/tcsh -f

set root=`dirname $0`
setenv EC2_HOME /usr/lib/ec2-api-tools
setenv EC2_CERT /etc/cron.route53/ec2_x509_cert.pem
setenv EC2_PRIVATE_KEY /etc/cron.route53/ec2_x509_private.pem
setenv AWS_ACCESS_KEY_ID myaccesskeyid
setenv AWS_SECRET_ACCESS_KEY myaccesskey

/usr/bin/ec2-describe-instances | \
perl -ne '/^INSTANCE\s+(i-\S+).*?(\S+\.amazonaws\.com)/ \
and do { $dns = $2; print "$1 $dns\n" }; /^TAG.+\sShortName\s+(\S+)/ \
and print "$1 $dns\n"' | \
perl -ane 'print "$F[0] CNAME $F[1] --replace\n"' | \
xargs -n 4 /etc/cron.route53/cli53/cli53.py \
rrcreate -x 60 mydomain.com

Does anyone see a problem with this script? If its not the script, what else could be preventing my Route53 domain from being updated?

I am using the Security Groups to IP-restrict the instances. I've tried opening port 53, but that didn't seem to have an effect. Is there another port that Route53 uses?

I'd appreciate any help or guidance the ServerFault community can offer. Let me know if you need any further info.

I have multiple Amazon EC2 instances which need to communicate using private IPs. However, so far I've been unable to ping one instance's private IP from another instance.

I can ping external addresses, such as their Elastic IPs and other sites (yahoo, google, etc), so it seems there's nothing wrong with the instances' network configuration.

Also, they are all in the same zone, so that shouldn't be an issue.

Does anyone have any idea what I could be doing wrong? Could this related to the Security Group settings?

I've setup two Amazon EC2 instances, both running Ubuntu Server. One is configured as a DNS server running bind9, which will be used to allow EC2 instances to communicate with each other based on hostname rather than IP, since their private IPs may change.

I think I have the DNS server setup correctly. I want to use the second EC2 instance to test the DNS server.

Using Webmin, I've added the DNS server's private IP to the client's DNS Servers list and added the domain to the Search Domains list. I did have to edit /etc/dhcp3/dhclint.conf to make my changes stick.

After reboot, I expected I'd be able to ping or nslookup the DNS server from the test client, but it can't seem to find the server. Is there something I'm missing?

What's required to configure an Ubuntu client to use a DNS server?

I just want to make sure I'm not missing something before I assume the server's the problem.

I've recently registered a domain name with GoDaddy.com and forwarded it to my web server's IP address. Now when I enter the domain name in my browser, my site appears as expected.

The strange part is, when I ping the domain name, another IP address appears. Is this normal? I would expect it to resolve to my web server's address. Is there anyway to make it resolve that way?

I've been setting up Amazon EC2 instances for an upcoming project which will involve hosting multiple websites on multiple web servers. They are all micro instances, running Ubuntu Server 64bit.

Here's what I have so far:

• Web Server -- Apache
• Database Server -- MySQL
• Development Server -- Apache & MySQL
• File Server -- SVN & Bacula (backups are done to S3 buckets)

Currently there's only one Web server, but I've made an image of it, so once the project starts I can launch as many instances as I need and configure them individually.

Everything has been going smoothly, but I've hit some snags.

My problem is I'd like to run multiple web server instances, but with Amazon's restriction to 5 Elastic IP address, I know that won't be enough. I was researching how to host websites on multiple web servers from a single IP address and ran across mod_proxy for Apache. I haven't tried it yet, but I think that's what I need. I'd just like someone to confirm that I'm on the right track.

Has anyone used Apache with mod_proxy? Does it truly allow you to host multiple websites from multiple using a single IP address?

Assuming I'm on the right track here, all I should need is one Elastic IP address pointing to an EC2 instance running Apache, is that right?

I've been setting up Amazon EC2 instances for an upcoming project which will involve hosting multiple websites on multiple web servers. They are all micro instances, running Ubuntu Server 64bit.

Here's what I have so far:

• Web Server -- Apache
• Database Server -- MySQL
• Development Server -- Apache & MySQL
• File Server -- SVN & Bacula (backups are done to S3 buckets)

Currently there's only one Web server, but I've made an image of it, so once the project starts I can launch as many instances as I need and configure them individually.

Everything has been going smoothly, but I've hit some snags.

My first problem is that many of the instances will need to communicate with each other and I would prefer to use their Private IP to reduce costs and increase performance. However, should an instance be stopped and restarted, its Private IP changes. I posted a question yesterday regarding this and its looking like the best solution is to use Dynamic DNS. Unfortunately, I've never setup a DNS server before.

Does anyone know of any detailed walkthroughs on how to do setup a DNS server for this purpose?

I've been setting up Amazon EC2 instances for an upcoming project. They are all micro instances, running Ubuntu Server 64bit. Here's what I've setup so far:

• Web Server -- Apache
• Database Server -- MySQL
• Development Server -- Apache & MySQL
• File Server -- SVN & Bacula (backups are done to S3 buckets)

Currently, there's only one Web Server, but eventually there will be more.

My first question is, what is the best, most secure way for Amazon EC2 instances to communicate between each other? Currently I'm using SSH, is that the best method?

According to Amazon, instances communicating between themselves using their Elastic IP addresses will be charged data transfer fees. However, instances communicating using their Private IP addresses can do so for free. Unfortunately, it appears Private IPs change if the instance is stopped and re-started.

So that's my second question, how do you make use of Amazon instances' Private IPs if they're not static?

I know that the instances probably won't be stopped and started very frequently, but still, if the IP address is in various config files, it would be a pain to have to go through them all and change it.

I'm primarily concerned about the Web servers, which will need access to the Database server and the File server, which will need access to all the instances when performing backups.

Note: I've never used Bacula before and I don't have it setup yet, but I'm assuming it will need the IP addresses of the clients to back them up.

I've been experimenting with s3ql on Ubuntu 10.04, using it to mount Amazon S3 buckets. However, I'd really like it to mount them automatically. Does anyone know how to do that?

Solution:

Thanks to help from Nikratio of s3ql I'm finally able to mount S3 buckets automatically when the system boots. You'll definitely want to look at the manual, but here's the basics of how to do it!

The first step is to create an authinfo file. This file should be placed in a .s3ql directory within the home directory of the user who will be using it. The authinfo file contains login info allowing s3ql to mount buckets without prompting. Below is an example of what your authinfo file should look like. The first line contains your Amazon Security Credentials. The second contains the location and password for your bucket. You can add multiple bucket-lines to this file if needed, but I'm only using one in this example. At this point, the bucket password can be anything.

backend s3 machine any login ASDFGHJKL password ZXCVBNM
storage-url s3://mybucket password mypassword

The bucket name has to be unique. No two users can have the same bucket name, so its a good idea to log into Amazon Web Services and try different names until you find one that's available. Once you've found one, you'll need to delete it, since s3ql will re-create it when it creates your s3ql filesystem. If the bucket already exists, you'll receive an error.

To create the file system, use the command:

mkfs.s3ql s3://mybucket

It will prompt you for your encryption password. This should be the same as the bucket password in the authinfo file.

Now that your file system is created, you can mount it using the command:

mount.s3ql s3://mybucket /mnt/s3/bucket

Of course, your bucket name and mount point will vary.

Now, if we want to mount this bucket automatically on boot, we need to add an upstart script to /etc/init. Fortunately, s3ql comes packaged with one, s3ql.conf.

I added "--allow-other" to the mount.s3ql command to allow users other than root to access the mounted bucket.

#
# This file can be placed in /etc/init. It defines an upstart job that
# takes care of mounting and unmounting an S3QL file system.
# 
description "S3QL Backup File System"
author      "Nikolaus Rath <[email protected]>"

start on (filesystem and net-device-up IFACE=eth0)
stop on runlevel [016]

env BUCKET="s3://mybucket"
env MOUNTPOINT="/mnt/s3/bucket"

expect stop

script
    # Redirect stdout and stderr into the system log
    DIR=$(mktemp -d)
    mkfifo "$DIR/LOG_FIFO"
    logger -t s3ql -p local0.info < "$DIR/LOG_FIFO" &
    exec > "$DIR/LOG_FIFO"
    exec 2>&1
    rm -rf "$DIR"

    # Check and mount file system
    fsck.s3ql --batch "$BUCKET"
    exec mount.s3ql --upstart --allow-other "$BUCKET" "$MOUNTPOINT"
end script

pre-stop script
    umount.s3ql "$MOUNTPOINT"
end script

After adding this script, in theory you should be able to reboot and have your bucket automatically mounted, but this is were I ran into trouble. Mine wasn't being mounted.

My problem was caused by the fact that upstart was running the script as root, but I'd created the file system as another user. Once I copied the .s3ql directory from the home directory of the user I'd been logged-in as to /root, the problem was solved.

I hope this helps someone else out there. Although I haven't been using my mounted S3 bucket for long, I'm impressed with how my initial tests have gone.

Also, this answer was written about a week after the solution was found. I think I've covered everything, but if you find I've missed a step, let me know and I'll add it. You'll also want to read the manual, its really worth reading if you intend to use s3ql.

How are large organization's networks structured?

I'm specifically curious about college campuses. Do they all have a single external IP address? Or do they typically have multiple external IPs?