3 ms·

I have what I think is almost a hack for security, if it doesn't make sense maybe someone here can tell me why and I'll go rip down a lot of services. I use an

I have what I think is almost a hack for security, if it doesn't make sense maybe someone here can tell me why and I'll go rip down a lot of services. I use an aws lambda running flask with a password to expose a website where I can IP whitelist any other servers to the requesting IP, it sends me an email when an IP is added and I periodically clear them all (try to do when leaving if on public wifi). It's a kind of very low-tech but I think very decent extra first layer of security, none of my servers are visible to anyone most of the time but I can hit them whenever.

GordonS 8y ago
I actually quite like this idea - I may steal it!
oarsinsync 8y ago
Can you publish this solution somewhere? It sounds grand!
- zimablue 8y ago
  Sorry I'm too ashamed, I was learning basically all the technology involved. I can give a recipe: first 4 pages of this: * https://blog.miguelgrinberg.com/post/the-flask-mega-tutorial-part-i-hello-world https://blog.miguelgrinberg.com/post/the-flask-mega-tutorial... swapped out/skipped the sqllite3 for a single hardcoded user class (it's just me!) * throw in boto3 routes which do add/remove/clear ip rules, and start/stop instances, a list of checkboxable instances pulled from ec2 listing them * deploy using zappa https://github.com/Miserlou/Zappa https://github.com/Miserlou/Zappa some things that can trip you: * for the ip there's a stupid mistake I made, when testing locally you can request.get(myip) to get which ip to use, remotely you pull it off of request.remote_addr * your lambda will need a specialised IAM role to have rights to do all this, it's configurable in zappa config and I just clicked creating one through aws management console * this is in the zappa docs but I didn't rtfm so I buil everything using conda which doesn't work, then I built it with a virtualenv with the same name as the project which doesn't work.

GordonS 8y ago

I actually quite like this idea - I may steal it!

oarsinsync 8y ago

Can you publish this solution somewhere? It sounds grand!

zimablue 8y ago
Sorry I'm too ashamed, I was learning basically all the technology involved. I can give a recipe: first 4 pages of this: * https://blog.miguelgrinberg.com/post/the-flask-mega-tutorial-part-i-hello-world https://blog.miguelgrinberg.com/post/the-flask-mega-tutorial... swapped out/skipped the sqllite3 for a single hardcoded user class (it's just me!) * throw in boto3 routes which do add/remove/clear ip rules, and start/stop instances, a list of checkboxable instances pulled from ec2 listing them * deploy using zappa https://github.com/Miserlou/Zappa https://github.com/Miserlou/Zappa some things that can trip you: * for the ip there's a stupid mistake I made, when testing locally you can request.get(myip) to get which ip to use, remotely you pull it off of request.remote_addr * your lambda will need a specialised IAM role to have rights to do all this, it's configurable in zappa config and I just clicked creating one through aws management console * this is in the zappa docs but I didn't rtfm so I buil everything using conda which doesn't work, then I built it with a virtualenv with the same name as the project which doesn't work.