I have an AWS environment where
for each client, there is a dedicated ec2 windows instance.
There is NO active directory; each ec2 instance is like in its own workgroup.
Each instance is deployed on its own dedicated VPC, security group etc.
Clients use RDP to connect from their site to the ec2 instances whenever required over port 3389.
The clients' ip addresses are known upfront and we open port 3389 to allow RDP connection.
Now we want to introduce the RDP using SSL (port 443)
The typical guides from Amazon and other books walk thru setting up a RD Gateway in a SEPARATE ec2 instance and use that as the jump box.
https://docs.aws.amazon.com/quickstart/latest/rd-gateway/architecture.html#best-practices
This is all good except that,
I do not want to have an additional ec2 within each VPC.
(I understand that there are other options to have a centralized RD Gateway in its own vpc and then using VPC peering etc. But I don't want to go that route for various reasons).
So, my question is:
Is it possible to setup the RD gateway directly on the ec2 instance to
which I ultimately want to RDP into ? and use SSL(port 443) for
connecting thru RDP?
Thanks in advance.
I tried this out successfully. I created an EC2 windows 2016 server.
I installed RD gateway using the powershell command.
Install-WindowsFeature RDS-Gateway -IncludeManagementTools
Then I launched the RD gateway manager.
configured the CAP and RAP to allow my Remote Desktop Users to access any resource.
Used the ssl certificate which I created using certroot in linux.
From aws console, opened the port 443 in the security group to allow connections from my public to the ec2 instance. (No other ports were opened).
From my local computer, I setup a RDP connection such that:
The RD Gateway server setting had the RD gateway server name (ex. poc.mydomain.com)
This should match the ssl certificate.
The remote computer name was specified as "localhost" (implying that the same server needs to be connected to).
After providing the right credentials, I was connected the the ec2 instance using RDP.
Related
I'm hosting Odoo on AWS and need to connect from my local machine. I am using AWS Certificate Manager instead of using a local .pem file ( no SSL configuration done on Apache as I am using AWS CM).
My odoo application works well, If I type https://myodoosite.com it works well.
What I need is to connect to the Postgresql DB on myodoosite.com
I can connect to the Postgresql DB from within the myodoosite.com server by uisng the command $psql -U postgres odoo_prod
Does anyone have an idea how to achieve this?
WHen I connect from my local, it says " Is the server running at myodoosite.com accepting TCP/IP connections on port 5432? "
Thank you for your replies.
Did I understand correctly your situation:
Odoo, Apache and PostgreSQL in one or multiple EC2 instances in AWS.
Load Balancer with SSL termination (using certificate from Certificate Manager) that exposes only your Odoo/Apache http service.
You probably have firewall rules in security groups preventing the PostgreSQL traffic in tcp port 5432. You need to open port 5432 to be accessible from your onpremise IP-address. You can do this by enabling the predefined PostgreSQL type in PostgreSQL EC2 instance's Security Group and set your IP address in the source address. Please note that this way the database is accessible for all traffic coming from that IP or IP range. So if you use shared IP this could be a problem.
Another easy and secure way to connect to PostgreSQL is to tunnel the traffic from your workstation with ssh. This is usable if you already have ssh port open and you do not want to open PostgreSQL port to public internet.
I want to use R Server constructed on a Ubuntu system on the Alibaba Cloud to do some elastic computing. The data is on the office computer, which has a firewall to prevent information leaking. I want to update the data to the cloud server for analysis.
I tried WINscp. It won't connect to the server (Connection timeout). I also tried PuTTY, which didn't work, either.
Could this be because of the Firewall?
Since you mentioned that your office has firewall rules in place to prevent data leaking, it is possible that your office firewall has blocked outbound traffic to port 22 (SSH), which is required to connect to your Ubuntu ECS instance running on Alibaba Cloud.
You should try to connect to your Ubuntu ECS instance from other locations without your office's firewall and see if it works.
Alibaba Cloud's ECS instance allows in-bound traffic access to port 22 by default based on their product page as below.
Source: Default security group rules
The security group created by
the system has only rules for access over all ICMP ports, TCP Port 22,
and TCP Port 3389, of which,
All ICMP ports are used by network devices, including routers, to send
error messages and operational information.
TCP Port 22 is used to connect to a Linux instance using SSH.
TCP Port 3389 is used to remotely connect to a Windows instance using Windows Remote Desktop.
I am following Tutorial: Installing a LAMP Web Server on Amazon Linux. My web server is started.
Now how do I access the website from my browser?
You will need to assign a Public IP address to your Amazon EC2 instance. This can be done at startup by enabling Auto-assign Public IP, or it can be done later by assigning an Elastic IP address:
Create an Elastic IP address in the Amazon EC2 console
Associate it to your Amazon EC2 instance
You will also want to check that the Security Group associated with your instance is permitting inbound HTTP traffic (port 80).
Then, just put the IP address of your instance into your web browser.
Yesterday I created an Azure Virtual Machine using the simple Win2008r2 + SQL2008r2 image.
I have deployed a website to the VM via an RDP session.
I am able to browse the website locally (via RDP) using
"http://localhost"
I understand that I need to add an Azure endpoint for port 80 to enable me to browse to the site from an external machine.
I have configured the Windows Firewall on the Azure VM to allow traffic on Port 80 inbound and outbound.
Could anyone please advise what I've missed or what I can do to troubleshoot?
---Update-----
I have learned a little more this morning. The website that I'm trying to host on the VM is an installation of Interwoven Teamsite v7.3.x. When I looked in IIS I could see that the "Default Web Site" was stopped. Another website called "TeamSiteSitePubPreview" had been created but was only bound to port 81.
So, what was presenting the website I could see when I browsed to
http://localhost locally?
I ran netstat -ano and this showed me that PID 1604 what listening on port 80. I then ran Process Explorer which told me that PID 1604 was allocated to "Appache HTTP Server".
I know nothing about About Appache, can anyone tell me if there's some Apache config that will be preventing connections from outside of the local server?
For reference, I just tested this sequence and it gives you a website accessible over the Internet:
Create a new Windows Azure virtual machine with the Windows Server 2008 R2 SP1 image.
Add an endpoint on public port 80, private port 80.
While the endpoint is being created, start setting the server up.
Remote Desktop in.
Add the Web Server (IIS) role with default settings.
Test the connection. You should get a HTTP 200 OK status.
If you want to troubleshoot your server, start checking for errors in the event log. Check also the website bindings in IIS (Port 80, IP Address *).
Also consider the connection issue might be on the client (your) side. For instance, DNS caching. Try connecting from another machine with direct Internet connection (such as another cloud server) or from a service such as isup.me.
Additionally, if all you want is to host websites in IIS, the Web Sites service has a more streamlined experience.
You will need to create an endpoint on port 80 thru Windows Azure Management portal as well. This endpoint opens a port in the Windows Azure Load-balancer.
Navigate to your VM within the portal and create a new Endpoint under the Endpoints screen of VM configuration within Azure management portal.
I am newbie to servers. I am trying to connect to Amazon EC2 micro instance using Connect Using a Java-Based (SSH) Client but I am getting an error Connection timed outas shown below in the image.
Also I am getting timeout message only when I try to SSH via wireless internet connection, in case of a wired connection could SSH into the instance.
I could not zero out where is the error is?
I figured out what the problem is here. You must allow your specific IP address or IP address range for inbound SSH traffic in the security group you have associated with the instance you're trying to connect to. Create a new inbound TCP rule for SSH with your IP address (or IP address range) and the attendant CIDR Subnet Mask and after that you should be able to connect using Java SSH or any SSH client.
Do you have a local SSH client that you can use to attempt to connect to the instance? If so, does that work?
Did you remember to ensure that your IP address (or netblock) is allowed to send traffic to TCP port 22 in your security group for the instance that you just deployed? You can check this by going running the 'ec2-describe-group' command from the EC2 Toolkit, or by using Amazon's Console and heading to EC2 -> Security Groups and viewing the security group assigned to that instance.