4 ms·

Communications are secure among EC2 instances within us-east, which is where Heroku is.

• bluesnowmonkey 15y ago
  I think the issue is that of you open up your EC2 instance's security group to your Heroku app, you're opening it up to any Heroku app.
  • espeed 15y ago
    Use authentication - communication inside us-east can't be sniffed even by instances you control.
    • tptacek 15y ago
      It is not a reasonable security decision to make any part of your backend depend on Redis authentication.
• rednaught 15y ago
  Secure meaning there is a private back-end network or there is some form of tunneling/encryption end-points available and enabled by default for instances? Here's the current AWS security guide that I was able to find: http://awsmedia.s3.amazonaws.com/pdf/AWS_Security_Whitepaper.pdf http://awsmedia.s3.amazonaws.com/pdf/AWS_Security_Whitepaper...
  • espeed 15y ago
    Read the section entitled "Packet sniffing by other tenants" - the hypervisor won't permit you to put an interface into promiscuous mode.
    • rednaught 15y ago
      Thank you. So the Xen dom0s are using IP Routing and not bridging. Do we know the details of Heroku's LXC configurations for dynos on their Amazon Domu instances? http://devcenter.heroku.com/articles/dyno-isolation http://devcenter.heroku.com/articles/dyno-isolation "On the Heroku dyno manifold, each and every process has full isolation from all other processes, including those of the underlying operating system and other processes from the same application. This provides complete protection from either of the circumstances above, and many others." Based on that, do we presume they are also using routes and not bridges?
• tptacek 15y ago
  I'm unwilling to trust IP access control for anything in 2011. If I could do SSH port forwarding, that'd probably be my first choice. I have a AES-128-CTR+HMAC-SHA256 encrypted sleeve for the Redis protocol with an attendant Redis::Connection driver, but this is exactly the kind of thing I'm always telling people not to do.
  • espeed 15y ago
    It's not ip access control - it's hypervisor control.
    • tptacek 15y ago
      I'm a lot more worried about allowing arbitrary EC2 hosts to connect to my Redis port than I am about people sniffing the traffic.
  • imbriaco 15y ago
    This motivated me to play around with Net::SSH port forwarding this afternoon and evening. What I ended up with was a tiny patch that allows you to forward a local UNIX domain socket to a remote TCP port over an SSH connection. It's a fun hack if nothing else: https://gist.github.com/1144486 https://gist.github.com/1144486 https://github.com/imbriaco/net-ssh/commit/aa453511f546cd524d2495f55429b2d168efd7d1 https://github.com/imbriaco/net-ssh/commit/aa453511f546cd524...
    • imbriaco 15y ago
      Closing the loop and replying to myself, I got carried away and wound up with a full Sinatra demo app that does this: https://github.com/imbriaco/heroku-redis-sshtunnel https://github.com/imbriaco/heroku-redis-sshtunnel