27 January 2010

From dedicated server to Amazon EC2

I am on the way to migrate from a dedicated server (Dedibox, a french provider) to Amazon EC2. Here are my first feedbacks from Amazon Cloud..

Why i am migrating
My current provider is not allowing true virtualization on theirs servers. Their hardware is strong (Dedibox Pro products), but they prevent Hypervisor through their switches which shutdown port whith more than one mac address. So, without VMware ESXi or Hyper-V, i failback on VMware server on top of a CentOS.
VM are just slow, even with only 5 of them. So i have good hardware which i can't truly use and so write off the cost. It's not hazard, virtualization is the best and common way to use these 8GB of ram and quad core cpu.
At least another provider support ESXi, OVH. But they ask quite much money for that (15€/month to be allowed to have more IP...)
As my goal is to get Virtual machines at the end, Amazon EC2 looked quickly as a good choice. In the worth case, i will pay as much as now, but i will get what i pay for!

Step 1: Amazon calculator
Speaking about money, the first difficulty is to know actually how much it will cost! Well, to be honest, the fist one is to understand which instance is the right for me:
  • On demand: no commitment, pay as you use,
  • Reserved: Pay one shoot fee, and then pay as you use at a low cost,
  • Spot: you don't know when you will get your VM, but it will cost less than On demand, but more than Reserved.
As you guess, 1 VM On demand used (powered on) all time costs much more than a Reserved one used all time.
Their calculator have an design issue. By default, it includes the one time fee in the first month free. The quick way is to multiply the numbers you see per 12, and then you get scared for a wrong reason!


So, to get the final cost per month, for one small reserved instance, always on:

(227.50$ + 29.98 * 12) / 12= 48.23$ § month

The average cost of a VM is 34€ per month. For this amount, you have a Linux 32 bit with:
  • CPU: 1 VCPU 1,7Ghz: 1 EC2 Compute Unit (1 virtual core with 1 EC2 Compute Unit)
  • Memory: 1.7GB
  • Storage: 169GB
The weird thing is the 44$ of taxes on the bill (see later in this post)...

Step 2: Reserve an instance
Things are becoming serious! Before, i nevertheless made some benchmark with one On demand VM, to be sure about performance. We choose first the size of the VM (small in my case), where it will be hosted (2 sites in USA, 1 in Europe (Ireland). I chose Ireland, to save the latency over Atlantic. After 5 big clicks, we are pending. After 10 minutes, like on a Formula car race, we are active. Then ? Nothing happens ! No earthquake and no Virtual Machine in the list. Amazon Helps resources are nearly clueless. I finally understood that you have to create a On demand VM, in the same site as your reserved one. As simple as scary, because you don't any word on the interface to comfort you are not going to pay 2 instances. You will have to believe in Amazon and their billing system. Well, it was ok for me, i didn't pay twice!
So far, a reserved instance can only be a linux one. Windows is restricted to On demand, and it's cost is higher than Linux, because the License comes with the VM.
The architecture choice (32/64 bit) depends on the size of the VM.

Step 3: create the VM
Now that i understood and still believe in Amazon, creating a VM is really simple, 5 clicks away and 5 minutes of waiting. You don't install your own OS/ISO, but use a prepared image. They name them AMI (Amazon Machine Image). Amazon have 5 AMI, but the community extend the choice up to 971 AMI.

The storage for Linux is 10GB for system and 150GB for data. The VM see 2 partitions:
Filesystem 1K-blocks Used Available Use% Mounted on /dev/sda1 10321208 1383500 8413420 15% / /dev/sda2 153899044 6793004 139288416 5% /mnt none 870472 0 870472 0% /dev/shm

When you create the VM and later on, Amazon provide a firewall outside the VM. You can then manage flow that come in. It's handy, since we save an iptable:

Step 4: Log on the instance
Now that the VM is running, it's time to logon. A right click on the instance shows up this menu:
The Connect link gives:

You have understood:
  • No console access (Get System Log shows you the boot log):
  • No root password, but instead a certificate generated when creating the VM)
On Windows, Putty is often used a free ssh client. But Putty can't understand the Amazon certificate. Anyway, Amazon explains how to workaround it here:
http://docs.amazonwebservices.com/AmazonEC2/gsg/2007-01-19/putty.html

In short, you have to use PuttyGen, from the author of Putty, to convert the Certificate in a one Putty understand. After, it works great:

Step 5: Performances
This is the critical part when it comes to Virtual Machines. Good news, i am very happy with the performance:
  • Network: easily get 20Mb/s
  • Storage: 121MB/s in writing (dd if=/dev/zero of=dd.dd bs=1M)
Why does Amazon provide that performance ? Because they bill the network as you use it (0.170$ per GB of traffic). Unlike others hosting that bill all included, Amazon won't loose money if a big user comes in. On my previous provider, i could use 100Mb/s non stop without paying more. So they share a lot connections to outside (peering), and so network is slow.

I prefer to pay a bit more when i use more, but have this quality. We can follow nearly in real time our usage and so next bill:

26 January 2010

LOTP Consulting

I am looking for short term missions, like:

  • Fireman on down production
  • Audits (pen tests, infrastructure 's health…)
  • Performances issues
  • Projects
  • Pilot/POC
  • Remote admin

Need a new look on unsolved problem?

My Microsoft/Network/Security knowledge enable me to integrate all layer of your infrastructure in the brainstorming, and so to suggest the best solution in your environment.
Unlike mono product/techno experts, i use my global view to spot impacts on all your layers and correlate events or settings together.
I am use you have pebble in the shoe that i would enjoy to take off! Remote or on site, from one hour to 2 months, we will find a way in your context.

Going further

I am reachable here: mathieu.chateau@lotp.fr

Linkedin : http://www.linkedin.com/in/mathieuchateau

14 January 2010

IIS 7 on Server Core

Manage IIS7 from Vista

You need to:

  • Download the management console from iis.net (owned by Microsoft): http://www.iis.net/expand/IISManager
  • Install the IIS management service: start /w ocsetup IIS-ManagementService
  • Switch this registry key to 1: EnableRemoteManagement (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WebManagement\Server) on the server to allow remote management for IIS
  • Start the wmsvc service : net start wmsvc

Import a certificate

The MMC certificate console can't add certificate to remote store (pfx). You will need to do it locally, using certutil command line:
certutil -addstore MY mycertificate.pfx

The MY argument is to specify the computer store

01 January 2010

Book: Confessions of a public speaker

I just read this great book from Scott Berkun. I bought it on the O'Reilly website, since they provide PDF without protection, which is perfect for my evernote: http://oreilly.com/catalog/9780596802004

It was really enjoying and giving some amazing advices.