steps to securing amazon EC2+EBS

Question

I have just installed a fedora linux AMI on amazon EC2, from the amazon collection. I plan to connect it to EBS storage. Assuming I have done nothing more than the most basic steps, no password changed, nothing extra has been done at this stage other than the above.

Now, from this point, what steps should I take to stop the hackers and secure my instance/EBS?

Eristic

Answer 1

Actually there is nothing different here from securing any other Linux server.

Wince

Answer 2

At some point you need to create your own image (AMI). The reason for doing this is that the changes you will make in an existing AMI will be lost if your instance goes down (which could easily happen as Amazon doesn't guarantee that an instance will stay active indefinitely). Even if you do use EBS for data storage, you will need to do the same mundane tasks configuring the OS every time the instance goes down. You may also want to stop and restart your instance in certain periods or in case of peak traffic start more than one of them.

You can read some instructions for creating your image in the documentation. Regarding security you need to be careful not to expose your certification files and keys. If you fail on doing this, then a cracker could use them to start new instances that will be charged for. Thankfully the process is very safe and you should only pay attention in a couple of points:

• Start from an image you trust. Users are allowed to create public images to be used by everyone and they could either by mistake or in purpose have left a security hole in them that could allow someone to steal your identifiers. Starting from an official Amazon AMI, even if it lacks some of the features you require, is always a wise solution.
• In the process of creating an image, you will need to upload your certificates in a running instance. Upload them in a location that isn't bundled in the image (/mnt or /tmp). Leaving them in the image is insecure, since you may need to share your image in the future. Even if you are never planning to do so, a cracker could exploit a security fault in the software your using (OS, web server, framework) to gain access in your running instance and steal your credentials.
• If you are planning to create a public image, make sure that you leave no trace of your keys/identifies in it (in the command history of the shell for example).

Spouse

You can also use your EBS volume as a boot partition. Now losing an instance doesn't cause you any data loss. You can even power it off, and bring it back up in the exact state it was powered down in. EBS volumes are more reliable than the ephemeral storage of an instance but are not as durable as S3. Fortunately you can take incremental snapshots of an EBS volume to S3. – Casarez

Answer 3

What we did at work is we made sure that servers could be accessed only with a private key, no passwords. We also disabled ping so that anyone out there pinging for servers would be less likely to find ours. Additionally, we blocked port 22 from anything outside our network IP, wit the exception of a few IT personnel who might need access from home on the weekends. All other non-essential ports were blocked.

If you have more than one EC2 instance, I would recommend finding a way to ensure that intercommunication between servers is secure. For instance, you don't want server B to get hacked too just because server A was compromised. There may be a way to block SSH access from one server to another, but I have not personally done this.

What makes securing an EC2 instance more challenging than an in-house server is the lack of your corporate firewall. Instead, you rely solely on the tools Amazon provides you. When our servers were in-house, some weren't even exposed to the Internet and were only accessible within the network because the server just didn't have a public IP address.

Pedometer

Personally I think with the security groups (one for each server if you want to) you can much quicker setup virtual network segments as compared to handcrafting VLANs in your local DMZ. I therefore do not agree that a "simple" perimeter firewall and fully trusted LAN is better than the Amazon approach (of course you can segment your own network as well, it just might involve dozents of man hours and team meetings with your infrastructure team :) – Vale