Tag Info

New answers tagged

1

In my understanding there's no perfect documented way to deal with such issues. You can only minimize the suspicious attempts on your web application. Yes, IPs can be blocked on Apache.Check Apache docs here . It uses mod_rewrite and gives 403 response code to the client if IP is in the blacklist. It's a painful job to monitor the logs and maintain ...


1

I always print the QR code and keep that physically secure. That makes it easier to enrol multiple/new devices and also resolves the issue of losing a device. From a security standpoint I don't feel this is substantially less secure than backup codes. The only area where it's weaker is that if an attacker manages to obtain your printed backup codes without ...


0

You have 2 options to fix the problem. 1) Assign 2 IPs to eth0(it is possible from ec2 console), you will need to use "ip addr add ..." to configure the second IP. 2) Configure source based routing. Possible answer: http://superuser.com/questions/638044/source-based-policy-routing-nat-dnat-snat-aka-multi-wans-on-centos-5


1

The previous answer is not 100% accurate. What back-end authentication ACTUALLY does is ensure that the public-key your backend server reports (when ELB is talking to your server over HTTPS/SSL) matches a public key you provide. This would prevent somebody from attaching a malicious server to your ELB, or mitigate somebody hijacking the traffic between ELB ...


2

It seems like your instance is failing to boot. Go to "Actions" -> "Instance Settings" -> "Get System Log" and see if you get any valid output there. There are a number of things that could be wrong, I usually test-reboot instances to make sure they'll come back up properly after running my configuration management tool (you do have one right?) before ...


2

Your problem is in the error message. In your AWS::RDS::DBSecurityGroup resource, you are specifying both EC2SecurityGroupName and EC2SecurityGroupId for an ingress rule. For EC2 Classic, specify only EC2SecurityGroupName. EDIT: New regions, such as EU Central (Frankfurt), do not support EC2-Classic. So you must put your RDS instance within a VPC. This ...


3

There should be no charge for either of those things. It's a bit of a stretch to call them "resources." In the world of AWS, and in contrast to the other items on that list, those items are more like "metadata." (The same logic applies to Placement Groups.) You'll potentially need them if you launch future instances, but they aren't consuming anything ...


2

I've fixed this on github.com/s3tools/s3cmd master branch. It was introduced in the new signature v4 code, but does not need to be a warning(), but instead lowered to info() which won't output on normal runs.


1

You can create a new iptables chain which can be separately flushed and refreshed. $ iptables -N AWS $ iptables -I INPUT 1 -j AWS From here, just add all of the IP ranges to the AWS chain. To refresh the rules, simply iptables -F AWS and re-populate. For example: $ iptables -F AWS $ iptables -A AWS -s 50.19.0.0/16 -j REJECT If you want to automate ...


0

Don't individually add each EC2 instance's IP address to your inbound security group. Instead allow inbound traffic from the security group of the EC2 instances. Then any EC2 instance which uses that security group will be permitted access from the same rule. Generally speaking, auto-scaling groups are best used behind Elastic Load Balancers if outside ...


1

I recommend to use AWS Cli instead of S3cmd. AWS cli is official tool for this by amazon. easy to install & use. also well documented. To copy from a bucket to another. use s3 cp, example: aws s3 cp s3://mybucket/ s3://mybucket2/ --recursive --exclude "mybucket/another/*" To change permissions/acl public read for a bucket (this includes objects in ...


3

This means that a new inbound rule needs to be applied to the security group for RDS that allows this new EC2 instance to connect to RDS via port 5432 (postgresql). Rather than using public IPs for your security group rules, I suggest using private IPs. Run both EC2 and RDS in the same VPC, then allow the entire VPC subnet IP range containing your ...


1

Naming conflicts are a known problem with the OpsWorks cookbooks and there isn't an easy solution. What you might have to do is download both community nginx and nginx-passenger cookbooks to your cookbook directory, rename the nginx cookbook to something like nginx-community then update any references in the nginx-passenger cookbook from nginx to ...


0

Turns out I needed create a new security group with HTTPS enabled, then add that to my instance. I can provide more details if anyone is interested.


1

Will, in general, blocking by IP address work? I know it's been a long time since "IP Address == unique device on Internet", but I'm wondering if these sort of probes generally come from the sort of networks where it'd be safe for me to just block them outright You can quite easily block many of the requests using a simple .htaccess file. There ...


0

Yes, you can modify the volume type / size / IOPS when you launch any instance using the created AMI.


0

In VPC, the external IP addresses of one of "your" virtual private gateways and one of "my" virtual private gateways could be the same -- the virtual private gateway (vgw) is the AWS side of the VPN connection, and has two public IP addresses. As long as your customer gateway and mine have different addresses, that's a unique source/destination address ...


3

Blocking IP adresses will be a race you can't possibly win. These request usually come from botnets or hacked systems. I would suggest blocking IP just as a temporary solution to a concrete incident where the requests cause problems on you side. I'm not aware of such a list Both will work. But I assume (not tested) that just ignoring the requests will ...


1

First, use nslookup to query your name servers (listed in the Route53 management console when you select your zone) directly. You do it like this: nslookup my.query.com ns-????.awsdns-??.??? If this query doesn't give you the right results, the issue is between the AWS console and Amazon's servers, so you should contact them. If this looks OK (like I ...


0

The best way to debug an ELB issue is to do the following: Ensure the security groups on the instance(s) are setup to allow the incoming port (80) Make sure your health check is setup correctly tail -f (or similar) the logs of the instance(s) you're trying to add to the balancer. See that the ELB is correctly pinging the instance(s) An example ping ...


-1

Turns out that I had forgotten to set up the VPC subnet to route to the internet gateway. Connection using RDP now works as expected and WinRM is fine after some powershell setup on userdata when launching.


4

I noticed you're using the db.micro instance. As with EC2, the micro instances are designed to be budget-friendly, but at a cost of performance. That said, you'll get a much worse performance when loading these types of servers versus the normal instances because the CPU time is given to the instance "last" compared to other instances sharing the same ...


4

I believe this question generally comes under the header of "shopping" or "software suggestions", but I'll try to offer an answer. Typically, you don't really need DDoS protection if you're running on Amazon Web Services. This is because Amazon's infrastructure is good enough to absorb most attacks before they reach you, if you run your own services ...


0

I don't know of a way to get the same ip address on VPC. I would approach this as a policy problem. I would change your documentation and dns records to use the new ip address and setup a webserver to do 301 redirects. On the content serving webserver, you may need to alias a temporary domain to each user's site. On the redirecting webserver, you would ...


1

In order to use your own domain you need to setup a so called Hosted Zone in Route53 (which is an AWS service). You should then create a Record Set which you point against your obtained Elastic IP. Read more about it here (see step 3): http://docs.aws.amazon.com/Route53/latest/DeveloperGuide/CreatingNewDNS.html If the link above does not give you all the ...


1

I had this issue myself a couple of weeks ago. In my case, I had forgotten to allow outbound traffic on port 3306 for my EC2 instance to the VPC CIDR. Try adding an outbound rule to your EC2 instance security group looking something like this: Type Protocol Port Range Destination MYSQL TCP 3306 172.35.0.0/16


1

Are you certain your DB is inside the VPC with your EC2 instance? Assuming so create a Security Group that permits 3306 inbound from the CIDR range for your VPC. To test in a slightly more familiar way you can temp build an instance with MySQL on it, should work the same way as long as it is also in your VPC. Make certain your RDS is in a Subnet Group ...


1

It seems that you haven't properly installed the root/intermediate certificates. You should have these installed on any device that performs the SSL handshake, which in this case is probably your load balancer.


0

As mentioned in the comments: IO-bound due to the high latency. For Redis slaves the solution is an ssh tunnel (with compression enabled) as described in this blog post [1]. Due to the compression, bandwidth is cut by a factor of 10, so in our case 1MB/s was enough. For downloads the solution is aria2c, a cli download client, which can open up to 16 ...


1

The current version of the app is symlinked via a current symlink in the app's directory. So srv/www/myapp/current will link to (the currently running version of the app)


0

The volume type you specify for the AMI becomes the default volume type for launches. The EC2 console does make it easy to select what volume type you want when you launch, but support for that varies across client tools. The Amazon Linux AMI makes their EBS-backed AMIs available for both Magnetic and General Purpose SSD by default: $ aws ec2 ...


0

when we attach a bootable volume to another Windows 2012 R2 instance, it marks that as non-bootable one as it already has a bootable volume. And when you re-attach it to original instance, your instance doesn't boot any more. So, there is a requirement to fix or re-build boot configuration data(BCD) for that volume. In order to fix this, perform below ...


0

Your question is rather generic, so I can only provide a rather generic answer. In particular, you mention a multi-server environment, but it's not clear to me whether you want a multi-site installation. In general: consider first of all what you actually need. Most MediaWiki sites don't need squid, simpler caching will do. Same for uploads. Running your ...


1

It looks like there is at least one vendor with a product that does this. (By the way, I found it by searching Google for `"AWS Storage Gateway" EMC VNX http://www.twinstrata.com/cloudarray-product-tour/ TwinStrata have recently been bought by EMC, so back to your EMC rep and ask them about CloudArray, to see if it's compatible with your existing ...


0

You can not currently do this with any of the EMC offerings. I imagine that if it ever gets supported, recoverpoint would have no problem sending a copy of local writes to an amazon instance, but I can't find anything indicating that this is supported, or has ever even been tried.


0

No. Amazon S3 is what you'd need to provide this replication, but it's not block-level like Amazon EBS is (which requires an instance to be attached to it). AWS would not work in your use case. Edit: I stand corrected. AWS Storage Gateway might work, but it troubles me that AWS didn't mention this product to you. Perhaps you need to do a bit of your own ...


1

Some website use your ip to locate you & redirect, but for google you can; Visit Google.com instead of your local domain If you want to use google.com instead of your local Google site, you can. To use google.com for searches, you have two options: •If you've been redirected by google.com to another google site (like google.fr), click ...


4

Do you believe you are experiencing this, or are you just trying to plan for it? There are a lot of inaccurate statements you can find in blog posts about EC2. The alleged "noisy neighbor" problem is a frequent topic, and drowning in inaccuracies. Sure, dedicated instances would solve this problem -- if it were a problem -- by giving you a new ...


-1

This could related two issues You might not not added your web server IP to the security group in RDS. You might have set the publicly accessible option to NO and in that case you can only access the RDS if your web servers are in the same VPC.


6

Does having dedicated AWS instances completely prevent noisy neighbor issues? Your own instances might be noisy neighbors to each other. Also, while you've paid Amazon to ensure that no one else's instances run on your underlying host, I don't believe it reserves an entire rack - so you could conceivably run into an issue where other hosts in the same ...


6

As I understand the article, it's suggesting that if you have a number of instances, they're likely to all be present on the same underlying hardware, and to use all that hardware, thus preventing other (potentially noisy) instances from running on that hardware - or at least making it much less likely that any such will. If this understanding is right, ...


0

Apart from the manual configuration and AMI configuration you can use a deployment service like Deploy4Me. It is just a better way to configure AWS. You can configure Ruby and MongoDB to be installed on the same server. So, you would receive a fully configured environment with some extra perks like security and proper Linux configuration.


0

Yes, as of Nov 2014 you can do this, here is how: http://neonos.net/white-labeled-dns-name-servers-on-amazon-route-53-with-delegation-sets/


1

This is possible, except surprisingly no one has made an article about it, even Amazon has not documented it well enough. See my answer here: http://serverfault.com/a/649714/56596


2

I have done this, please read my article before you actually do this here: http://neonos.net/wp-admin/post.php?post=30 The functionality has been programmed by Amazon in Nov 2014, however it has not been implemented in the web based console, hopefully they will do this soon. There is also no documentation or any articles that I could find on this topic. ...


0

So, afaict SES requires a domain in both the "from" and "to" fields. While MAILFROM= is not supported on Ubuntu's cron, you can set FromLineOverride=NO in ssmtp.conf, and ssmtp will force the "from" address to be "root@hostname" instead of just "root". This takes care of the "from" address. Now - you also need to make sure that the "to" address has a ...


2

You can enable MFA on API access but any services using those credentials including the CLI has to use temporary security credentials (ie. you make an AssumeRole call providing your access key, secret and MFA token and it returns temporary access keys which are valid for as long as the MFA auth is valid). Having said that, generally it's considered best ...


1

If I read correctly, you want to pre-warm cache. There is no official way to pre-warm cache. However, you can use list from http://blog.domenech.org/2013/10/amazon-web-services-cloudfront-edgelocation-codes.html to pre-warm. For d709c28ax59vf.cloudfront.net, it will be: d709c28ax59vf.ams1.cloudfront.net d709c28ax59vf.ams50.cloudfront.net ... You can ...


0

If your content is static, then it's cachable and get boost by CDN.


2

It appears that there's a firewall between the client and server that is blocking the communication required for the client to join the domain. My suggestion would be that if the firewall is relevant only to these two instances that you unblock (allow) all traffic through the firewall between these two instances.



Top 50 recent answers are included