We're Hiring!  
Toll Free US & Canada: 1(877) 946-4743   Worldwide: +1(415) 869-7444

Archive for September, 2011

CloudPassage is a key security partner that has images available on the GoGrid Partner Exchange. The CloudPassage images on GoGrid come pre-installed with their Halo daemon. This is available on CentOS, Debian, Red Hat, and Ubuntu on both 32-bit and 64-bit flavors. Alternately, you can launch a GoGrid base image and install the Halo daemon on your own. This tutorial assumes that you have a basic understanding of Linux and SSH as well as basic firewall strategies. It also assumes that you know how to configure private IPs so that will not be covered here.

Launch a server with the CloudPassage Halo daemon

wpid3389-media_1316643201731.png

In your account, add a cloud server. You will be presented with a screen where you can select all the images available to customers on GoGrid. If you enter “Halo” in the name field, it will filter for only the CloudPassage partner images. For this tutorial, I will be using the Ubuntu x64 version on US-West-1.

Register for CloudPassage

wpid3391-media_1316643490064.png

While your server is spinning up, go ahead and go to this link and register for CloudPassage (if you haven’t already). One of the advantages of CloudPassage is that you can centrally manage your security from a single web site.

Retrieving your CloudPassage API key

wpid3393-media_1316644604455.png

Once you have registered, you will want to pull your CloudPassage API key. Navigate to “Settings > Site Administration > API Keys” to retrieve your CloudPassage API key. Check your email spam folder if you haven’t received an email from CloudPassage. To have future emails from CloudPassage delivered to your Inbox, add cloudpassage.com to your safe senders list.

Upgrade your existing daemon

Log back into the Ubuntu server that you just provisioned. It’s a good practice to change the pre-assigned password so do that first. Next, you will want to upgrade the existing Halo daemon to make sure that you are using the latest version.

Run at the prompt:

apt-get update && apt-get install cphalo

Start the daemon with your API key

wpid3395-media_1316645014628.png

At the prompt enter:

/etc/init.d/cphalod start --api-key= <your CloudPassage API Key here>

to start the CloudPassage Halo daemon on your cloud server.
This will start the daemon and link the server to your account on Cloud Passage. If you go to Servers > Server Access you will see your server listed.

Create a new Firewall Policy

wpid3397-media_1316645198365.png

Next, go to Policies > Firewall Policies. Click on the button “Add New Firewall Policy”.
You will then be presented with a page where you can set the inbound and outbound rules.

I am going to create a rule on the private network (eth1) that allows only one private IP address to access this server. For the first inbound rule, select “eth1″ from the Interface drop-down.

Determine which IP can access your server

wpid3399-media_1316645536132.png

CloudPassage has the concept of IP Zones which is a grouping of IP addresses. At the Source drop-down, select “Add New” to create a new IP Zone. I have created a new Zone called “Access OK” and assigned it only one IP address. You can also assign a block of IPs or separate IP addresses. Click the Create button which will set the IP Zone as the default selection for the Source drop-down. Leave Service as “any, ” Conn. State as “Any”. Action as “ACCEPT”.

Set the default-deny rule

wpid3401-media_1316645951502.png

For this tutorial, I am just setting up access for one private IP into this server and blocking every other IP. This will only work if you configure a static private IP for the server you want to give access to. Alternately, you can select a predefined Server Group in the Source drop-down but servers will only appear there if you install the Halo daemon. Since our images are set to use DHCP for private IP assignment, you will still need to set a static private IP for this to work.

A best practice is set the last rule as a default-deny. This will prevent any other connections from accessing the server. Note that this configuration is only to control private IPs – this policy has no rules for public traffic. Realistically, you will want to control this as well in order to prevent external access to your servers. However, this tutorial is focused on demonstrating that private IPs can also be controlled centrally.

Click on the “Add” link as shown on the screen shot. This creates a default-deny rule. Make sure to select “eth1″ for the Interface drop-down or else you will lock out your public access as well.

Click Apply once you have made that change.

Assign the Policy to your server

wpid3403-media_1316646874105.png

First, go to Servers > Firewall Management. Your server will most likely not be assigned to any server group so it will be in the (1) Unassigned Group. Since the Firewall Policy is assigned at a group level, create a new group for this server by (2) clicking on the Link “Add a New Group”.

Select the Firewall Policy for the Group

wpid3405-media_1316647288936.png

After clicking on “Add a New Group” you will see a form where you can select the Policy that you just created and name the new group. Note that this policy is set GROUP wide so you can assign any new servers to this group and it will then have that Firewall policy applied. I have named this group “Private Network” and selected the Firewall Policy that I just created “Private Network Access”. Click “Save” when you are done with this form.

Move your server from Unassigned to the new group

wpid3407-media_1316647493896.png

Now that you have create a new Server Group, you will want to move your server to that group. (1)Click on the check box on the right of the server and on the (2) Actions drop-down select “Move Server(s). You will then be presented with a form – simply select the new group that you created (called Private Network in this tutorial) and then click the “Move Servers” button.

You’re done!

This configuration will then allow for you to assign certain private IPs to have access to your server while blocking others. This will help a few use cases:

1. You have a group of users who each have 3 servers and want only the three that they own to access each other via the private network. You can configure cloud passage to allow access to those 3 servers and block the other users servers. This will provide private network isolation that can be centrally managed via the CloudPassage Portal.
2. You have a group of web servers but you only want one to access your back-end servers via the private network.

Using CloudPassage is a great way to centrally manage security on any numbers of servers that you might have running on the GoGrid cloud. While, this tutorial has focused on the private network, CloudPassage is also excellent at manage firewalls for public access as well. Install their image and start using it to protect your servers today!


Yesterday we release several new and updated base GoGrid cloud server images as part of our regular Operating System refreshes.

new-updated-base-OS-images

Below is a quick lists of the New, Updated and End of Life-d base images.

New Major Versions

New Minor Versions

  • CentOS 5.6
  • RHEL 5.7

Updated Versions

  • Windows Server 2003 – updated with Microsoft Security Patches & Powershell 2.0
  • Windows Server 2008 – updated with Microsoft Security Patches, Powershell 2.0 and on SQL Server images, Microsoft SQL Server 2008 R2
  • Windows Server 2008 R2 – updated with Microsoft Security Patches

End of Life-d (EOL) Versions

  • CentOS 5.3
  • RHEL 5.4

Note: Servers already deployed that are running older (perhaps EOL-ed) images are not affected (meaning, we do not delete them) but you may want to consider refreshing those servers to a later version of the OS. When a server is EOL-ed, it is simply removed from the GoGrid base OS repository and you cannot create new servers from these images.

Remember that these updates and new versions only apply to NEW VMs that you create using these images listed above. If you have existing cloud servers running, please be sure that you regularly run security and Operating System updates to ensure that you servers are running the latest versions and have the most current security patches.


Zeus is a new GoGrid partner that provides a software load balancing product as a partner image called “Zeus Load Balancer 200Mbps”. There are three immediate features that come to mind when thinking about how to leverage Zeus within GoGrid: Load Balancing, Failover and Clustering. Note that this first image is a preview with certain feature set. It contains the majority of Zeus features but is capped at two clustered servers and 200 Mbits of bandwidth. Additional images are expected to be released by the end of the year.

This tutorial assumes that you have basic understanding of Linux and SSH as well as basic load balancing and failover strategies.

Cross Data Center Load Balancing / Failover

One of the main uses cases for Zeus is to load balance servers in the same data center. However, a more interesting use case is to quickly and easily load balance web servers within one data center and support failover to another data center. The process is straight forward. First, deploy the Zeus partner image as a VM with 1G RAM in the US-West-1. This example assumes that you already have web servers running on both the US-West-1 and US-East-1 data centers.

Once the Zeus image has been deployed, SSH into the server using the root login. Your logins can be found in the GoGrid web portal by clicking on the server icon, then Tools > Passwords.

We recommend changing your automatically created, default password as soon as you login.

Zeus_motd

The Message of the Day (MOTD) will have links to additional information and support. To begin, run the configuration (/usr/local/zeus/zxtm/configure). Note that you will be prompted to enter the license key. The key is located at /root/license.txt.

Once the configuration is complete, launch the web interface, typically https://IP_ADDRESS:9090

When you first launch the Zeus admin portal, you will be presented with a warning from your browser. This is because the Load Balancer requires a secure connection and is using a self-signed certificate. Most likely, your browser won’t recognize the certification and present a warning. Bypass the warnings and set an exception for this IP address.

Zeus_FFuntrusted

Alternately, you can bypass the warnings but not set an exception and enter your own certificate once you are in the Admin portal:

Zeus_SSLcert

Use your admin login (again, http://IP_ADDRESS:9090) to access the web interface. One of the first things that you want to do is to create the pool of IP addresses that you want to load balance.

  • Click on the icon that says “Services”. You will then see a page with several tabs. Click on the tab called “Pools”. Look for the section that says “Create a new Pool”. First you will want to enter the IP address of the backup server in the US-East-1 Data Center. I have one setup using port 80 and I am calling the pool “East”. You can also set the type of monitoring you want against the pool. Since these are web servers, I am selecting “Simple HTTP” – this ensures that the web server is up and running. For example, if you use Ping, this tells you that the server is responding but not necessarily if the web server itself is down. The click “Create Pool”.
  • Next, go back to “Create new Pool” and enter the IP addresses of the two VMs that contain your website in US-West-1 and set the port (typically 80). Give it a name – I am going to call this one, “West1″. Set the monitor here to “Simple HTTP”. Click “Create Pool”. You will now see an option to set the Failure Pool – enter the first pool that you create (“East”).
  • Below Basic Settings is a section titled “Load Balancing”. You can also set the algorithm here – in this case, I set Round Robin which will attempt to balance traffic evenly between the nodes.

Zeus_West1

Next you will want to create a “Virtual Server” (Zeus’ terminology) which means to create a Traffic Manager (TM) instance on your server. Click on the “Virtual Servers” tab to create one. I have created one called “Clustered_TM”. Since I am balancing Web servers, I have set the Internal Protocol to “HTTP” and the Port to “80”. Note the Default Traffic Pool – this is the pool of web servers that I just created (“West1”). Set Enabled to “Yes” and hit the “Update” button to activate the load balancer.

Zeus_TM

The Zeus TM constantly monitors health so if there are any issues with the servers (such as a server no longer responding) in the pool, it will report it on the main page. Zeus can use different types of checks – in addition to ping, you can also check HTTP, DNS, FTP and others.

You may notice a few warnings when you setup Zeus. Here are some tips to help clear them.

  1. Java: Cannot start Java Runner, program ‘java’ not found
    • Go to the System icon and click on the “Global Settings” tab. Scroll down to the Java Extensions bullet and select “No” for java!enabled. This is really only used if you are coding in the API and not if you are working via the UI.
  2. Cannot Bind to Port 80
    • This is typically due to Apache2 running on Ubuntu. This should already be disabled by default but you can also manually stop it. SSH into your Zeus VM and enter: service apache2 stop

In this configuration, two servers are handling traffic evenly in the West. If one of the servers in the West nodes should fail, then the load balancer will send traffic to the server that is still running. If both should fail, the failure pool will activate, and traffic will route to the East server. Note that due to the distance from the West load balancer, there will be latency, however this will ensure that the website will still run even if there are issues with both servers in the West region.

Another useful feature is the ability to track activity and connections on the load balancer. First, click on the “Activity” icon and then the “Connections” tab. Since both the West servers are up and running, you can see that the traffic is balancing between those two servers.

Zues_connections

Clustering

The previous section only demonstrated setting up Zeus as a single instance. Zeus gives you the ability to setup a clustered pair, in order to provide coverage should one of the Zeus instances go down.

In order to build a cluster, you will need to configure a few things. First deploy a second instance of the Zeus image.

You will need to make some manual changes to the VMs first.

  1. SSH into your first Zeus server.
  2. Change to the proper directory: cd /etc/
  3. Edit the hosts file and include an entry for the second Zeus server that you just deployed
    • i.e. (173.1.45.149 31852-1-67347) in the example
  4. Save and Exit
  5. SSH into your second Zeus server
  6. Edit the hosts file and include an entry for the first Zeus server
  7. Login to the GoGrid portal and restart both servers.

These steps make it easier for the Zeus servers to talk to each other. After the servers have restarted, go to the Admin page and run the following steps:

  • Click on the System icon and then the “Traffic Managers” tab.
  • Scroll down to the bottom and select “Join a Cluster”.
  • You will be presented with a Wizard that will guide you to adding the server to a cluster. Follow the instructions on the Wizard to join a cluster (it should auto-detect other Zeus instances in your VLAN).
  • This screenshot shows an existing cluster member since I already have this server as part of Zeus cluster.

Zeus_joincluster

Once the servers are in a cluster, they will share configurations so you can administer the cluster from either server.

The last step is to make the cluster invisible to the end user. You will need to use an additional public IP in order to do this. Click on the Services icon. Select the “Traffic IP Groups” tab.

Zeus_TrafficIP

Give the Traffic IP Group a name. In this example, I have created one called “Cluster_Traffic”. Add an unassigned public IP address. (IP addresses can be found within the List view under the Network section within the GoGrid portal.) Note that this is a Zeus setting. Even though it will be “taken” by Zeus, the GoGrid portal will still show this IP address as Unassigned.

You can then use this IP address as the outbound IP for your web cluster. It will leverage the use of both Zeus load balancers, automatically and transparently managing failover and traffic.

Zeus gives you the flexibility to launch load balancers as you need them and to directly manage as many server pools as you require. Although load balancing across data centers is possible, latency will not make this an elegant solution – you will need to implement global load balancing. Contact Zeus if you are interested in using this option. If you want to learn more about Zeus, you can get additional information and support from www.zeus.com/community/documentation.


At GoGrid, we pride ourselves on being the world’s largest pure-play Infrastructure-as-a-Service (IaaS) provider. We work tirelessly to innovate the top cloud infrastructure technology available, provide the best support solutions and offer the most comprehensive Service Level Agreement (SLA) in the industry. And when an independent research group recognizes our hard work, it’s extremely validating and a little hard not to share. ;-)

This past July, Info-Tech Research Group released an extensive report entitled “Vendor Landscape: Cloud Infrastructure-as-a-Service (IaaS)”. This report is designed to help companies understand the offerings of cloud infrastructure providers so they can select a partner with solutions that best meet their needs. Each cloud IaaS vendor was scored based on their product offering and company strengths. GoGrid was one of 3 companies placed in the highest quadrant, “Champion”, and had the highest “Value Index” of every company profiled.

Info-Tech_GoGrid-quadrant

GoGrid topped the charts because our services had the highest value and, as Info-Tech put it, was the biggest “bang for the buck” (e.g. features, usability, stability, etc.).

The research and findings of the Info-Tech Research Group are available for download. The report highlights the purpose and methodology behind Info-Tech’s research, complete industry results and detailed analysis of GoGrid as a cloud infrastructure provider.

Learn why GoGrid was positioned as “Champion.” Please Download the Info-Tech Cloud IaaS Research Report


I’m splitting hairs here but for some reason, every time that I hear someone say “It’s ON the Cloud“, I cringe and want to immediately correct them. But I hear that phrase everywhere, on the radio, on podcasts to even occasionally in the hallways of GoGrid. I’m not quite sure why it bothers me, technically it is somewhat correct, but it just simply doesn’t make sense. So, I’m hoping to change it – standardize it – with this blog post, but that will require you, the reader, to correct people and educate them.

INvsONthecloud-out

Definitions

Let’s start with the basics, some definitions:

in |in| preposition

1 expressing the situation of something that is or appears to be enclosed or surrounded by something else: living in Deep River | dressed in their Sunday best| soak it in warm soapy water | she saw it in the rearview mirror.

• expressing motion with the result that something ends up within or surrounded by something else: don’t put dye in the bathtub | he got in his car and drove off.

on |än, ôn| preposition

1 physically in contact with and supported by (a surface): on the table was a water jug | she was lying on the floor | a sign on the front gate.

• located somewhere in the general surface area of (a place): an internment camp on the island | the house on the corner.
• as a result of accidental physical contact with: one of the children had cut a foot on some glass | he banged his head on a beam.
• supported by (a part of the body): he was lying on his back.
• so as to be supported or held by: put it on the table.

(source: New Oxford American Dictionary)

By definition, IN makes the most sense here – your infrastructure or code or data is “enclosed or surrounded” by the cloud. And, to that effect, you put those items (“expressing motion”) IN the cloud.

ON just doesn’t quite work in this context. You can’t have “physical contact” with “the cloud” (or clouds in nature for that matter), so you can’t really put your data or architecture “on” it. Clouds have only visual surfaces (e.g water vapor) and there is practically no physicality to them. Wikipedia defines “clouds” as “a visible mass of water droplets or frozen ice crystals suspended in the atmosphere above the surface of a planetary body.” Water droplets or ice crystals are IN the atmosphere, not ON the atmosphere.

See where I’m going here?

Easy Examples

Let’s take a look at a couple of easy examples.

In the car
vs
On the car

This one is easy to visualize. “The suitcase is IN the car” means that it is physically inside of it. “The suitcase is ON the car” implies that it is on the roof or something like that and not actually within the physicality of the car. Think riding IN the car vs. riding ON the car. Very different images.

In the water
vs.
On the water

Think of a buoy. In this case, you could almost use either one. However it also depends on the context. “The buoy is IN the water” connotes physicality. “The buoy is ON the water” really should be written as “the buoy is floating ON the water” which implies transportation or motion. You could say “the buoy is floating IN the water” as well but to me that sounds like it is water-logged and not floating on top of it.

However, it gets a bit complicated.

In the bus/train
vs.
On the bus/train

Both of these examples practically imply the same thing. However, there are subtle nuances between them. “IN the train” means you are physically inside of it. “ON the train” implies that the train is in motion or will be in motion and it refers to transporting between two different points.

And you wouldn’t say the balloon is “on the air”, would you?

Wouldn’t you rather be part of something than sitting on top of it or outside of it? Put your applications IN the GoGrid Cloud versus ON it.

A lot of people talk about putting pictures or data in the cloud. If you say you are putting it ON the cloud, to me, it sounds like it could fall off and isn’t really secure.

What about network diagrams? Infrastructure architects show infrastructure inside of a cloud or connecting to a cloud that has infrastructure within it. They aren’t putting that infrastructure on top of a cloud graphic, are they?

What do YOU think?

Clouds are soft, expand and contract and are elastic. They are not physical in the sense that you can touch and feel them. Hard objects pass through them like airplanes or birds, so how with this lack of physicality can you put something actually “on” it.

But I want to know from you, how do you say it? “IN the cloud” or “ON the cloud”? Answer the poll below (or enter your response here). Also, if you want to provide reasoning for your selection, please leave a comment.

Create your free online surveys with SurveyMonkey, the world’s leading questionnaire tool.

As I was writing this, my head was IN the clouds and definitely not ON them.

So the next time you hear someone say “it’s ON the cloud,” feel free to politely correct them.