Is it possible to run all cluster inside a AWS VPC?

entalpia

Dear All,
I woul love to run all cluster inside a AWS VPC limiting the exposure to the internet to each cluster component
Is it possible doing that or each cluster in Enhance should have it's own public ip

I'm just getting in Enhance and I need to familiarize with the basic concepts of its network cluster.
thank you

AdamM

Currently this is impossible. All services connect publicly.

entalpia

Well, thank you Adam and AdamM for your answer.
Great to know it before create a VPC full of EC2 Instances 🙂
In terms of security, how you would sudgest to filter unwanted / unrequested peaks of request.
I've tought at first that the CP node, worked as a sort of LB but now (just installed my first one Control Panel) i see that is already one of the cluster nodes. Before jump in I tought to refine that LB security to guarantee unwanted request to the entire cluster network but in this way (multiple public nodes) i've to perform a full WAF shield over each Ip's.
What I'm missing?

Stefano

Adam

Enhance assumes that every server has a public IP as its primary address, either via 1:1 NAT or bound directly.

There is an open feature request to prefer an internal IP for internal transfers (such as website moves).

xyzulu

Stefano entalpia ,
This isn't something that can be explained in a few forum posts. You need to learn, and get some real world experience. With reference to some things you have already mentioned: AWS have a network firewall that allows you to manage traffic "above" your servers.. Enhance have ufw (standard linux) firewall that manages traffic on server.

There are so many different options here. While I am happy to help, you need a bit more research / practise and knowledge I think. It's simple to restrict access to ports other than 443 (and perhaps 21 if you need to offer ftp access) at a firewall level to the public and only allow your own servers access to the other ports/services Enhance require.

See: https://enhance.com/docs/getting-started/using-enhance-with-a-firewall.html

PS I don't use AWS at this time, I have in the past

entalpia

xyzulu thank for your feedback

The firewall of AWS just disable or enable access to a bunch of ports (security groups), but once the port is open, it's a target. Than ufw does what it ufw should do as usual on a linux system, but it's too late once a request get there, and actually does not fit here in this talk.

What I was saying before, maybe wasn't that clear, that I do not like to relay on a WAF (ModSecurity) the same server I've Ngix or Apache due the extreme load of exceptional requests peaks that make the server so to dumb to freeze.
Externalize that layer of security I think it's a good procedure to avoid ungratefull server load from a bunch of botnets.

I thought, at first (few hours ago) that an Enhance cluster had the capability ( @Adam and @AdamM clarified before that for me that i was completely out) to be contained into a VPC without exposing all of the cluster servers. That structure was potentially easier to controll via a single WAF layer that controll the traffic that enter the entire VPC offloading most of the traffic that goes to Modsecurity that runs on (if turned on) each server.

Obiously I could apply the same security layer on each individual exposed server of the cluster, but it becomes less effective and it get complex once the cluster grows.

I'm pretty sure, that what I'm considering right now as downside (in terms of WAF) it is probably one strong feature of an Eenhance cluster, allowing probably to migrate sites from one node to the other like some sort of an HA cluster.

I'm sure i've still to learn a lot about Enhance, AWS and linux system, I knew it already also without some stranger point this out pubblicly. 🙂

ps I'm on AWS since since feb 2016

xyzulu

Apart from mod_security.. I have used Cloudflare as a reverse proxy (you could use a cluster/server of your own as as a reverse proxy) and restricted all traffic to only Cloudflare IP's. But, this setup depends on your needs etc

So, so you want to open ports but have a way to control/protect things? Which port/services in particular are you trying to protect?

entalpia

Hi xyzulu,
you right, i could implement that. I've still being a little bit away from that solution cause adds up (but i could be wrong) another step into the setup of a client domain. Right now i'm not sure i could automatize its setup, avoiding to not forget to forward a specific request to one machine behind the reverse proxy.

I've implemented cloudflare to all clients domain in one of my servers, still occasionally i'm reached by request peaks forwarded to the server. I should enable the 20$ solution for each domain probably to get rid of them. But it get to pricy.

Regarding the ports, it's just a paranoia 🙂
In my working enviroment, I'm the sysadmin, the web developer and the one who structure the marketing campaing for the clients. I like the idea of giving the clients this kind of service following them A - Z and apparently clients love that. It means, I don't need ssh/ftp or anything else exposed. If needed i could restrict access to these ports to a minimum number of ips, and it will be fine.

Getting back to Enhance, I want to find the wich is the ideal solution enviroment for implementing a cluster that holds up around 150 domains, right now its split on 3 Plesk server with a total of 700gb (avg domain size il less than 3gb, max is a 60gb). I'm not keeping emails on my servers, i rely entirely on a external solution that is focused on email.

I've segmented the 3 vms not for the technology of the sites, but for avg requests. 1 server has medium to low volume of request. Sites are kind of left there by the clients. server 2 has medium frequency updates and medium volume of request (few ads campains a also running there). Third one, i had a good volume of access on mostly e-commerce site with ads.

I'm pretty sure there is not just one approach to structure a cluster with Enhance, but I would love to start using right principles, and also avoiding overexposing the cluster servers to unpleasant botnet requests and leaving open the minimum amount of ports open.

thank you

I'm sorry for being little bit harsh in the last post 🙏

xyzulu

Are your sites Wordpress? If so, I block xmlrpc.php (if URI contains) at Cloudflare (unless a site needs it) and enable a managed captcha on uri that contains wp-login.php

I find thee two things make a HUGE difference to "trash" traffic.

Some paranoia is good 😉 keep us keeping things secure.

entalpia

Most of them are Wordpress, few of them are Nodejs based app and custom php application.

I've added in the last month a worker on cloudflare that keep tracks of these request per domain to run a proper analisys on these attacks. Few of them are already redirecting to google.com using the same worker (es. xmlrpc.php by default), but i still need to understand the situation.

xyzulu how you structured your enhance cluster?

xyzulu

entalpia how you structured your enhance cluster?

I haven't done anything special (that I would not do anywhere else). I use Cloudflare proxy as the only allowed source of traffic on port 443. I block all other ports (but allow the ports needed between servers in the enhance cluster). I have ssh password authentication disabled as well as direct root login.

It's low level, but removes some rubbish: I usually add the 7G firewall rules to all my .htaccess files.