DEV Community: Mike Barlow

Why Removing a AWS Security Group Rule Does Not Stop Traffic Flow

Mike Barlow — Sun, 22 Oct 2017 23:51:58 +0000

Here’s the situation. I created an AWS Security Group inbound rule to allow Ping, which allows me to ping an EC2 instance from my home computer. The issue is that when I remove the Ping inbound rule, Ping requests are still receiving a response. I expect that when I remove the Ping inbound rule, the responses should stop.

In this post, I will reproduce the issue and show you that this is a feature of AWS Security Groups and not a bug.

Initial Setup:

1 VPC 192.168.0.0 /16
1 AZ
1 EC2 Instance with public IP – 54.245.15.244
Internet Gateway (IGW)
Route
- 0.0.0.0/0 -> igw-a664ec1
- All traffic can pass through IGW
- 192.168.0.0/16 -> local
- All resources can talk to other resources within the IP Range
Security Group assigned to EC2 Instance is empty

There are no inbound Rules for Security Group WBC-Web. No traffic will be permitted

Even though this EC2 instance has a Public IP, no inbound traffic should reach this instance since this instance is associated the Security Group WBC-Web with no Inbound Rules.

Let’s Validate this Setup

From my home computer, if I ping the EC2 instance, I will receive a “request time out.” message

There is no response since the Security Group has no inbound rules.

Create Inbound Ping Rules

In AWS console, I added the inbound rule to Security Group WBC-Web to allow ping from all IP addresses.

Now if I try to ping the EC2 instance, I will receive a response.

The Confusion

If I remove the Security Group inbound ping rule, I continue to receive a response, which I do not expect. I expect the ping should timeout.

To demonstrate this, I will run ping with the -t option. This will keep ping running until I cancel it manually.

I will start the ping before I remove the ping rule.

In the image below, the red line marks the point when I removed the ping inbound rule. After I remove the ping inbound rule, a response is still returned.

I stopped the ping and started the ping to see if I would still receive a response, which I did receive a response.

I stop the ping again and waited a minute before starting it again. This time the ping finally timed out.

So What’s Going On

For Security Groups there is a feature called Connection Tracking. Connection Tracking is used to track information to and from an instance.

When there’s a flow of traffic, for our example a ping, and the security group inbound rule is removed, the flow of traffic will not be stopped by the removal of the inbound rule. The traffic is interrupted when it’s stopped on the client or the host for at least a few minutes.

Removing the ping inbound rule while traffic is flowing will not interrupt or stop the flow of traffic. You must first stop the ping on the client or host and wait at least 1 minute before the removal of the inbound rule will take affect.

I believe Amazon does a better job of describing this.

Not all flows of traffic are tracked. If a security group rule permits TCP or UDP flows for all traffic (0.0.0.0/0) and there is a corresponding rule in the other direction that permits all response traffic (0.0.0.0/0) for all ports (0-65535), then that flow of traffic is not tracked. The response traffic is therefore allowed to flow based on the inbound or outbound rule that permits the response traffic, and not on tracking information.

TCP traffic on port 22 (SSH) to and from the instance is tracked, because the inbound rule allows traffic from 203.0.113.1/32 only, and not all IP addresses (0.0.0.0/0). TCP traffic on port 80 (HTTP) to and from the instance is not tracked, because both the inbound and outbound rules allow all traffic (0.0.0.0/0). ICMP traffic is always tracked, regardless of rules.

An existing flow of traffic that is tracked may not be interrupted when you remove the security group rule that enables that flow. Instead, the flow is interrupted when it’s stopped by you or the other host for at least a few minutes (or up to 5 days for established TCP connections). For UDP, this may require terminating actions on the remote side of the flow. An untracked flow of traffic is immediately interrupted if the rule that enables the flow is removed or modified. For example, if you remove a rule that allows all inbound SSH traffic to the instance, then your existing SSH connections to the instance are immediately dropped.

Security Group – Connection Tracking

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html#security-group-connection-tracking

It’s important to understand that if the traffic is being tracked and is flowing then removing an allow rule will not stop the traffic.

The following are a few way to stop the traffic.

Create a Network Access Control List (ACL) inbound rule
On the instance, disable the communication type or block the port
Delete the Security Group

While learning about AWS Security Groups, I ran into this situation and was very confused. It took a lot of digging to understand what was going on. I hope that this will help others and that others will not go through the pain I went through.

Update – Saturday, Nov 11, 2017

This does not seem relevavent to SSH connections. As soon as I remove an SSH inbound rule the SSH connection is terminated. I assume SSH and RDP rules would function similarly.

The post Why Removing a AWS Security Group Rule Does Not Stop Traffic Flow appeared first on Mike Barlow (BarDev).

Kick-start: Create a Linux(Ubuntu) Environment for Windows Developers using VirtualBox, VSCode, Git, NodeJS

Mike Barlow — Mon, 20 Feb 2017 03:16:14 +0000

I enjoy working with Visual Studio Code (VSCode). Since it’s available for Linux and Mac, I thought I would give it a try in a different environment. As a Windows developer, I’ve wanted to try out Linux. In the past when I have attempted to work in Linux, I was overwhelmed with all the tools, configuration and such that must be learned to be productive.

I had a very difficult time finding beginner information that is current of setting up a Linux development environment. I found bits and pieces but nothing that showed end-to-end of how to get started.

In this post, I will describe how to setup a development environment in Linux (Ubuntu). The main technologies I will work with are the following:

Oracle VirtualBox – 5.1.14
Linux Ubuntu 64-bit: 16.04
Visual Studio Code (VSCode): 1.9.1
NodeJS: 6.9.5
Git: 2.7.4

This post is about setting up a basic Linux (Ubuntu) development environment. I assume that the user is familiar with Windows and has very basic knowledge of hypervisor software to manage virtual machines.

I’m using Windows 10 as my host system. I don’t believe it should matter what host you are using, because other than VirtualBox, everything in this post will be installed on Linux Ubuntu.

Installing VirtualBox

We need somehow to run Ubuntu. To do this we need a Hypervisor. A hypervisor is software that runs virtual machines. There are many hypervisors available (Hyper-V, VMWare, VirtualBox, etc). I have selected Oracle VirtualBox for the following reasons:

Runs on Windows
Free for personal use
Easy to use
Very popular
Large Community

Let’s install VirtualBox by going to VirtualBox webpage:

https://www.virtualbox.org/wiki/Downloads

VirtualBaox Download

Once at the VirtualBox Download webpage, download VirtualBox

After downloading VirtualBox, install it.

VirtualBaox Install

Download Linux Ubuntu Desktop

When we create our virtual machine using VirtualBox we will need an image (iso) of Ubuntu to install. We will get this iso from Ubuntu’s website. It’s important that you download the desktop version of Ubuntu. Download Ubuntu Desktop from here:

https://www.ubuntu.com/download/desktop

Ubuntu Desktop Download

Note: We will be running Ubuntu 64-bit. If you are running Windows 10, you may have issues installing 64-bit version of Ubuntu. I’m not sure if Hyper-V is installed by default on Windows 10, but if it is installed, you will need to uninstall it if you want to run 64-bit virtual machines.

Note: While investigating Docker for Windows, I stumble across this

“Docker for Windows requires Microsoft Hyper-V to run. After Hyper-V is enabled, VirtualBox will no longer work, but any VirtualBox VM images will remain.”

https://docs.docker.com/docker-for-windows/install/#/what-to-know-before-you-install

To uninstall Hyper-V, open “Turn Windows features on or off”. You can do this by going to the start menu and typing “Turn”

Turn Windows features on or off for Hyper-v

Now uncheck Hyper-V and click “OK”. This will require a few restarts.

Turn off Hyper-v in Windows

Installing Ubuntu Virtual Machine

Now let’s get to the fun part. Lets install Ubuntu as a virtual machine on VirtualBox. Start VirtualBox. Once VirtualBox starts, you should see something like the following image.

Oracle VM VirtualBox Manager

To create a virtual machine (VM), select the button “New”. You should see a form to create a new Virtual Machine (see image below). In the form enter a Name. The name I used is “UbuntuDemo”. Once you type “Ubuntu”, notice the “Type” and “Version” is automatically selected. Also, notice that the version is “64-bit”. If you do not see “64-bit” then refer to the note above about Windows 10 & Hyper-V.

Note: Here, were are not installing Ubuntu on the virtual machine. This will be done later. Here are just configuring and setting-up the virtual machine.

Note: Ubuntu Minimum and Recommended System Requirements

https://help.ubuntu.com/community/Installation/SystemRequirements

https://www.ubuntu.com/download/desktop

Ubuntu will run on 2 GB of memory, but that is the recommended requirements. I went ahead and set the memory for this Ubuntu virtual machine to 4 GB.

Set the Hard disk option to “Create a virtual hard disk now” and select “Create” button.

Create Virtual Machine

Now let’s create the hard disk. On the next form, for the most part, you can keep all the defaults except for the “File Size” option. Ubuntu recommended requirement is 25 GB for the disk size. To be safe and so that I can install additional software on the Ubuntu virtual machine, I set the file size to 30 GB.

I leave everything else as default. Now select the “Create” button.

Create Virtual Hard Disk

Update: I just looked at VirtualBox Virtual Media Manager for the actual size of disk spaced used by Ubuntu. It was only 4.86 GB.

Configure Ubuntu Virtual Machine

Here we will make some basic changes to the virtual machine configuration. We will change the number of processors the virtual machine uses and enable the ability to share the clipboard between our Windows 10 host and the Ubuntu virtual machine.

Note: For these changes to take affect the virtual machine will need to be stopped or if the virtual machine is running, it will need to be restarted.

Note: In the following images for Oracle VM VirtualBox Manager, there are two virtual machines. Please ignore the first “ubuntu” vm. We will be creating the “UbuntuDemo” vm.

To change virtual machine settings, select “UbuntuDemo” from Virtual Box, and then select “Settings” button.

Configure Oracle VM VirtualBox Managaer Settings

To enable the ability to enable clipboard sharing, select the “General” from the left navigation. Then select the “Advanced” tab. Now change the settings for “Shared Clipboard” and “Drag’n Drop” to Bidirectional.

This feature comes in handy when you want to copy and pasted text from your host to the virtual machine or visa-verse.

Configure Oracle VM VirtualBox Manager Settings Shared Clipboard & Drag n’ Drop

By default, the Ubuntu virtual machine is configured to use only one processor. On my computer the Ubuntu VM runs a little sluggish with only one processor, so I went ahead and up the processor to 3. Depending on your computer, you may want to change this setting.

To change the number of processors, in settings dialog select the “System” in the left-side navigation. Then select the “Processor” tab. At this point, you can change the number of processors that the VM will use

Configure Oracle VM VirtualBox Manager Settings Processor Count

Installing Ubuntu

Now that we have the virtual machine configured, let’s start the VM and install Ubuntu.

To start a virtual machine, in VirtualBox Manager select “UbuntuDemo” and then select the “Start” button.

Start Ubuntu Virtual Machine from Oracle VM VirtualBox Manager

The virtual machine will start in a new window. The first screen you will see is a dialog to select the start-up disk. This is where we install Ubuntu on the virtual machine. We need to tell the virtual machine where the Ubuntu Desktop installation file is located.

On “Select start-up disk” dialog, select the small folder icon in the bottom right corner. Another dialog (not shown) will be displayed to select the Ubunto .iso file to install. My iso file was called “ubuntu-16.04.2-desktop-amd64.iso”; the name of your file may be a little different.

Once you find the Ubuntu .iso file, select the “Start” button.

Select Ubuntu file image to install on Virtual Machine

After you click “Start”, you should be prompted to install Ubuntu. Select “Install Ubuntu” button.

Setup Ubuntu Welcome “Install Ubuntu

The following dialogs are fairly straight forward. I will not step you through these next few dialogs, but for your convenience, I have included the screenshots of the dialogs.

Ubuntu setup and Install – Preparing to install Ubuntu

Ubuntu setup and Install – Installation Type

Ubuntu setup and Install – Installation Type confirmation

Ubuntu setup and Install – Where are you

Ubuntu setup and Install – Keyboard Layout

Ubuntu setup and Install – Who Are you

Ubuntu setup and Install – Welcome to Ubuntu

Ubuntu setup and Install – Installation Complete – Restart

After you select “Restart Now”, you may get a message “Please remove the installation medium…”. If you get this message, it means that the Ubuntu .iso file is still attached to the virtual machine optical drive. If you continue without detaching the Ubuntu .iso file from the virtual machine, you will go through the installation process again.

VirtualBox Ubuntu. Please remove installation medium, then press ENTER

To detach (remove) the Ubuntu .iso from the virtual machine, on the virtual machine window select “Devices” –> “Optical Drives” –> “Remove disk from virtual drive”. Now press “Enter” on your keyboard. Now Ubuntu will start.

How to remove installation medium from VirtualBox

Once Ubuntu starts, you should see a screen like the following. Ubuntu is now successfully installed.

Ubuntu installation complete first screen

Note: To shut down Ubuntu from Ubuntu, in the top right corner of the desktop is the current time, misc buttons, and a power button. Selecting the power button will show you a menu with “Shut Down” as an option.

Ubuntu Power Button

Ubuntu shut down

Installing Google Chrome

First thing I do after I install Ubuntu is to install Google Chrome browser. Firefox is installed by default on Ubuntu, but you can install another browser if you want. By installing Google Chrome, I present some of the dialogs that will be show when installing software on Ubuntu.

Google Chrome Desktop Download

https://www.google.com/chrome/browser/desktop/

Download Google Chrome

Once you select download, you will prompted to select what type of Linux you are running. We are running a derivative of Debian. Therefore, select the option that includes “.deb”

Download Google Chrome for Linux – 64 bit .deb for Debian and Ubuntu

Once you select “Accept and install”, you will be prompted what to do with the file. I usually just open the file, but if you want, you can save the file.

Since I don’t expect I will need to install Google Chrome again, I will select the “Open with” option.

Chrome Download options

When installing software, Ubuntu will prompt you to confirm that you trust the software you are installing. If you do trust the software you are installing, select the “install” button.

Confirm installing software

Now enter your password “demo” in the Authenticate dialog to continue to install your software. Your password may be different.

Authenticate installing software

Run Applications – Google Chrome

I want to install Visual Studio Code (VSCode). But to do this I need to download it first using Chrome. There are a few ways to start an application. I’m going to show you the main way I start programs that are not on the application bar.

In the top left corner of the desktop, there is a purple icon (see image below). This icon opens “Dash”. Dash provides the ability to search for applications, files, music and etc. Since we want to start Chrome, select the “Dash” icon and type “chrome” in the text box. An icon for Chrome will display. Select the Chrome icon to start Chrome.

Note: You can open “Dash” search prompt by using the win key on your keyboard.

Note: The icons that are displayed can be dragged-n-dropped to the application toolbar.

Run Chrome Application with Ubuntu Dash

Install Visual Studio Code (VSCode)

Now let’s install Visual Studio code. But first, we need to download it.

In Chrome or browser of choice, navigate to:

https://code.visualstudio.com/download

Select to download the .deb (Debian) version of VSCode

Download Visual Studio Code (VSCode) for Ubuntu .dib

The installation process of VSCode is the same as installing Chrome, which we did above. I will go ahead and provide images of the installation process.

Ubuntu Install Application

Authenticate installation with password

Now that VSCode is installed, we can now run it. The process to run VSCode is the same as running any other application. Open “Dash” search and type “Code” in the text box.

Run Visual Studio Code (VSCode) in Ubuntu using Dash

Now VSCode will launch.

Installing Node.js

Node.js is very popular these days. I use Node in most of my web development. Since this is a common tool, let’s install it.

Instead of downloading and installing from a website, we will use a tool similar to Windows Command Prompt or PowerShell to install Node. In Ubuntu, this tool is called Terminal.

To start the application Terminal. Open “Dash” search, type terminal in the text box. You may get multiple results, but select the application named “Terminal”.

Ubuntu terminal using Dash

Here’s the documentation to install NodeJS using a package manager. Go to the section “Debian and Ubuntu based Linux distributions”

https://nodejs.org/en/download/package-manager/

In the Node documentation, it shows the following command to run to install Node

Using Curl to install nodejs on Ubuntu

If you try to run the commands above, you get an error that ‘curl’ is not installed.

Error running curl in Ubuntu terminal

Let’s install Curl.

In the terminal enter the following

sudo apt install curl

installing curl using terminal in ubuntu

Now that curl is installed, now we can try to install Node.

First, we need to select what version of Node we want, this is done using Curl. Use the following command in Terminal.

curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash –

using curl using to download nodejs on Ubuntu

Now to install Node, use the following command:

sudo apt-get install -y nodejs

install nodejs using sudo and apt-get on Ubuntu

Now let’s validate that Node was installed successfully.

In Terminal, type “node”. This will show the “>”. Now type “4+4” and then enter. The answer of 8 should be returned. We have now confirmed that Node is installed. To exit node press [ctrl]+C twice.

confirming Nodejs was installed successfully on Ubuntu

Install Git

Another common tool that is used by developers, is Git. Git is a source code repository.

We are going to install Git similarly to how we installed Node, but without using Curl. To install Git, enter the following:

sudo apt-get install git

installing git using terminal, sudo, and apt-get on Ubuntu

Enter the following to confirm that Git was installed:

git –version

confirming git install successfully using git –version on Ubuntu

Conclusion

If you never have used Linux and want to get started developing in a Linux environment, it can be difficult. Hopefully this post has helped you kick-start your software development in Linux Ubuntu.

Resource

Comparison of platform virtualization software

https://en.wikipedia.org/wiki/Comparison_of_platform_virtualization_software

How To Install Git on Ubuntu 16.04

https://www.digitalocean.com/community/tutorials/how-to-install-git-on-ubuntu-16-04

Installing Node.js via package manager

https://nodejs.org/en/download/package-manager/#debian-and-ubuntu-based-linux-distributions

Ubuntu – Package management with APT

https://help.ubuntu.com/community/AptGet/Howto

Running VS Code on Linux

https://code.visualstudio.com/docs/setup/linux

The post Kick-start: Create a Linux(Ubuntu) Environment for Windows Developers using VirtualBox, VSCode, Git, NodeJS appeared first on Mike Barlow (BarDev).

Duck Typing

Mike Barlow — Sun, 26 Jun 2016 22:16:18 +0000

In this post I will describe Duck Typing in regards to dynamic languages (JavaScript, PHP, Python, Ruby).

If you ever read or heard about Duck Typing, you have probably seen the following quote:

If it walks like a duck and quacks like a duck, it must be a duck.

Without context, this quote doesn’t mean much. Hopefully at the end of this post the previous quote will make much more sense.

Below is an excerpt from Wikipedia. Without understanding Duck Typing, the following excerpt doesn’t make much sense either.

Duck Typing requires that type checking is deferred to runtime, and is implemented by means of dynamic typing or reflection.

Duck typing is concerned with establishing the suitability of an object for some purpose. With normal typing, suitability is assumed to be determined by an object’s type only. In duck typing, an object’s suitability is determined by the presence of certain methods and properties (with appropriate meaning), rather than the actual type of the object.

https://en.wikipedia.org/wiki/Duck_typing

Duck Typing in JavaScript – Dynamic Language

In the following examples, we are going to create following 3 different objects in JavaScript

point2D
point3D
me

All three objects will include properties: name, x and y, they also include a calculate() function. The Me object will include the properties occupation and birthDate. See image below for a visualization for object model.

In the code below, I created the three object (point2D, point3d, me). I also created a function called calculate() for each object. The calculate() function for all the objects returns a string.

There is a displayPoint() function defined. This function could just have been called display(). The function displayPoint() has one parameter called “point”. The function signature looks like this:

function displayPoint(point)

The parameter name “point” doesn’t mean anything. I could have called it “obj”. I called the function “displayPoint” and the parameter “point” because contextually the function is created to work with points. Even though I created the function displayPoint(point) to work with points, but I can pass any type of object as a parameter in to the function.

In function displayPoint(point) the code accesses the property “name” and the method “calculate()” of the object “point”. It doesn’t matter what type of object is passed in to the function “displayPoint”, but the object must have the property “name” and the method “calculate()” to run without an error.

This is Duck Typing.

What is the “me” object? Is it a person or a point – both, neither? What do the properties x and y represents. The properties x and y could represent a point, but they could also be pointers (reference) to XY chromosomes. But in this context of the method “displayPoint”, the object “me”, and the properties x and y are points and treated like points.

Now, the following quote has context. I hope it makes more sense now.

If it walks like a duck and quacks like a duck, it must be a duck.

Resources

How Duck Typing Benefits C# Developers – Phil Haack
Wikipedia – Duck Typing
Why TypeScript – See Section: Types are Structural

The post Duck Typing appeared first on Mike Barlow (BarDev).