fedora 16 AMI on EC2

[Sandeep Dixit]

I just created a Fedora16 (i-26c60f44)  instance on AWS. Then I did
su -l
yum install apache

everything went well.

I started apache using: service apache start

However I public DNS is not able to find the default page. I checked
my security group and it has http 80 access.

I read in a blog somewhere that with Fedora you have to make sure that
files are read? By default they are not - for apache installation? Is
this  correct?

Please advise.

Thanks,
Sandeep

[Steve Gordon]

>  
>  I just created a Fedora16 (i-26c60f44)  instance on AWS. Then I did
>  su -l
>  yum install apache
>  
>  everything went well.
>  
>  I started apache using: service apache start
>  
>  However I public DNS is not able to find the default page. I checked
>  my security group and it has http 80 access. 
Has the firewall of the instance itself also been updated to allow requests on port 80?

-Steve

>  I read in a blog somewhere that with Fedora you have to make sure
>  that
>  files are read? By default they are not - for apache installation? Is
>  this  correct?
>  
>  Please advise.
>  
>  Thanks,
>  Sandeep
>  _______________________________________________
>  cloud mailing list
>  cloud(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/cloud
>

[Sandeep Dixit]

Yes  - the instance is associated with the "default" security group
and the "decault" security group has a rule 0.0.0.0 - port 80 / http
--

Thanks,
Sandeep



On Mon, Dec 19, 2011 at 12:48 PM, Steve Gordon <sgordon(a)redhat.com&gt; wrote:
> >
> > I just created a Fedora16 (i-26c60f44)  instance on AWS. Then I did
> > su -l
> > yum install apache
> >
> > everything went well.
> >
> > I started apache using: service apache start
> >
> > However I public DNS is not able to find the default page. I checked
> > my security group and it has http 80 access.
>
>  Has the firewall of the instance itself also been updated to allow requests on port 80?
>
>  -Steve
>
> > I read in a blog somewhere that with Fedora you have to make sure
> > that
> > files are read? By default they are not - for apache installation? Is
> > this  correct?
> >
> > Please advise.
> >
> > Thanks,
> > Sandeep
> > _______________________________________________
> > cloud mailing list
> > cloud(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/cloud
> >
>  _______________________________________________
>  cloud mailing list
>  cloud(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/cloud

[Jared K. Smith]

On Mon, Dec 19, 2011 at 1:00 PM, Sandeep Dixit <sdixit(a)ohioedge.com&gt; wrote:
>  Yes  - the instance is associated with the "default"
> security group
>  and the "decault" security group has a rule 0.0.0.0 - port 80 / http 
I think Steve was referring to the iptables firewall on Linux itself.

--
Jared Smith
Fedora Project Leader

[Sandeep Dixit]

Yes - got it - after I replied I realized. Thank you - Steve/Jared!

Is there FC16 LAMP AMI for EC2?
--

Sandeep


On Mon, Dec 19, 2011 at 1:05 PM, Jared K. Smith
<jsmith(a)fedoraproject.org&gt; wrote:
>  On Mon, Dec 19, 2011 at 1:00 PM, Sandeep Dixit
> <sdixit(a)ohioedge.com&gt; wrote:
> > Yes  - the instance is associated with the "default" security group
> > and the "decault" security group has a rule 0.0.0.0 - port 80 / http
>
>  I think Steve was referring to the iptables firewall on Linux itself.
>
>  --
>  Jared Smith
>  Fedora Project Leader
>  _______________________________________________
>  cloud mailing list
>  cloud(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/cloud

[Jared K. Smith]

On Mon, Dec 19, 2011 at 1:07 PM, Sandeep Dixit <sdixit(a)ohioedge.com&gt; wrote:
>  Yes - got it - after I replied I realized. Thank you - Steve/Jared!
You are welcome!

>  Is there FC16 LAMP AMI for EC2? 
No, but it's simple to take the existing AMIs and add a web server,
database, and scripting language to build out a LAMP stack.

--
Jared Smith
Fedora Project Leader

[Garrett Holmstrom]

On 2011-12-19 10:05, Jared K. Smith wrote:
>  On Mon, Dec 19, 2011 at 1:00 PM, Sandeep
> Dixit<sdixit(a)ohioedge.com>  wrote:
> > Yes  - the instance is associated with the "default" security group
> > and the "decault" security group has a rule 0.0.0.0 - port 80 / http
>
>  I think Steve was referring to the iptables firewall on Linux itself. 
It is my understanding that EC2 images generally have their inbuilt 
firewalls turned off because people are expected to use security groups 
instead.  Is this correct?  If so, how can I help that happen for the 
next Fedora release's EC2 images?

[Sandeep Dixit]

Yes - that is correct - the instance is secured by EC2 security groups
so the fedora image should have its firewall turned off. The
configuration I am interested it (and I am sure tons of folks out
there) is  apache2, jboss 5/6/7 and ajp_connector (that connect
apache2->jboss). I am using Apache Derby db as well.
--

Thanks,
Sandeep




On Mon, Dec 19, 2011 at 11:07 PM, Garrett Holmstrom
<gholms(a)fedoraproject.org&gt; wrote:
>  On 2011-12-19 10:05, Jared K. Smith wrote:
> >
> > On Mon, Dec 19, 2011 at 1:00 PM, Sandeep Dixit&lt;sdixit(a)ohioedge.com&gt;
> >  wrote:
> >>
> >> Yes  - the instance is associated with the "default" security group
> >> and the "decault" security group has a rule 0.0.0.0 - port 80 / http
> >
> >
> > I think Steve was referring to the iptables firewall on Linux itself.
>
>
>  It is my understanding that EC2 images generally have their inbuilt
>  firewalls turned off because people are expected to use security groups
>  instead.  Is this correct?  If so, how can I help that happen for the next
>  Fedora release's EC2 images?
>
>  _______________________________________________
>  cloud mailing list
>  cloud(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/cloud

[Max Spevack]

On Mon, 19 Dec 2011, Garrett Holmstrom wrote:

>  It is my understanding that EC2 images generally have their inbuilt 
>  firewalls turned off because people are expected to use security 
>  groups instead.  Is this correct?  If so, how can I help that happen 
>  for the next Fedora release's EC2 images? 
For what it's worth, on the Amazon Linux AMI 2011.09, iptables is turned 
on by default, but it is left empty.

[root@ip-10-190-217-157 ~]# chkconfig --list | grep iptables
iptables        0:off   1:off   2:on    3:on    4:on    5:on    6:off

[root@ip-10-190-217-157 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

[Dennis Gilmore]

El Mon, 19 Dec 2011 20:07:31 -0800
Garrett Holmstrom <gholms(a)fedoraproject.org&gt; escribió:
>  On 2011-12-19 10:05, Jared K. Smith wrote:
>  > On Mon, Dec 19, 2011 at 1:00 PM, Sandeep
>  > Dixit&lt;sdixit(a)ohioedge.com&gt;  wrote:
>  >> Yes  - the instance is associated with the "default" security group
>  >> and the "decault" security group has a rule 0.0.0.0 - port 80 /
>  >> http
>  >
>  > I think Steve was referring to the iptables firewall on Linux
>  > itself.
>  
>  It is my understanding that EC2 images generally have their inbuilt 
>  firewalls turned off because people are expected to use security
>  groups instead.  Is this correct?  If so, how can I help that happen
>  for the next Fedora release's EC2 images? 
correct me if im wrong but i thought that the amazon security groups
only protects you from whats outside of amazons network. the hosts
firewall protects you from being attacked from inside of ec2.

Dennis

[Garrett Holmstrom]

On 2011-12-19 22:24, Dennis Gilmore wrote:
>  El Mon, 19 Dec 2011 20:07:31 -0800
>  Garrett Holmstrom<gholms(a)fedoraproject.org>  escribió:
> > On 2011-12-19 10:05, Jared K. Smith wrote:
> >> On Mon, Dec 19, 2011 at 1:00 PM, Sandeep
> >> Dixit<sdixit(a)ohioedge.com>   wrote:
> >>> Yes  - the instance is associated with the "default" security
> group
> >>> and the "decault" security group has a rule 0.0.0.0 - port 80 /
> >>> http
> >>
> >> I think Steve was referring to the iptables firewall on Linux
> >> itself.
> >
> > It is my understanding that EC2 images generally have their inbuilt
> > firewalls turned off because people are expected to use security
> > groups instead.  Is this correct?  If so, how can I help that happen
> > for the next Fedora release's EC2 images?
>
>  correct me if im wrong but i thought that the amazon security groups
>  only protects you from whats outside of amazons network. the hosts
>  firewall protects you from being attacked from inside of ec2. 
Hosts within a security group can communicate freely with one another. 
Communication between hosts in different security groups is subject to 
security group rules in the same way as that with the Internet at large. 
  Since security groups cannot be shared all instances in a given 
security group belong to the same account.