l-migrate2cloud-1-pd..

More documents

Recommendations

Info

developerWorks® ibm.com/developerWorks Listing 2 shows a group called default with a description of "default group." The user ID associated with the group is 223110335193. There are no rules in this group. If there were, they would be described below the group with the word PERMISSION in the left column. Preparing the cloud environment The first step is to prepare the cloud environment to test the application. The new environment will mimic the current production environment. Start by launching the AMI, which has an ID of ami-10b55379. Listing 3 shows the AMI being launched and the status being checked. Listing 3. Launching the CentOS AMI [sean@sergeant:~]$ ec2-run-instances ami-10b55379 -k main RESERVATION r-750fff1e 223110335193 default INSTANCE i-75aaf41e ami-10b55379 pending main 0 m1.small 2010-05-15T02:02:57+0000 us-east-1a aki-3038da59 ari-3238da5b monitoring-disabled instance-store [sean@sergeant:~]$ ec2-describe-instances i-75aaf41e RESERVATION r-750fff1e 223110335193 default i-75aaf41e ami-10b55379 pending main 0 E3D48CEE m1.small 2010-05-15T02:02:57+0000 us-east-1a aki-3038da59 ari-3238da5b monitoring-disabled instance-store [sean@sergeant:~]$ ec2-describe-instances i-75aaf41e RESERVATION r-750fff1e 223110335193 default INSTANCE i-75aaf41e ami-10b55379 ec2-184-73-43-141.compute-1.amazonaws.com domU-12-31-39-00-64-71.compute-1.internal running main 0 E3D48CEE m1.small 2010-05-15T02:02:57+0000 us-east-1a aki-3038da59 ari-3238da5b monitoring-disabled 184.73.43.141 10.254.107.127 instance-store The first command launches the instance using the ami-10b55379 AMI and specifies that the key pair generated in Listing 1 is to be used to authenticate to the machine. The command returns several pieces of information, the most important being the instance identifier (i-750fff1e), which is the identity of the machine in the Amazon EC2 cloud. The second command uses the ec2-describe-instances command, which lists all the running instances. In Listing 3, the instance identifier has been passed on the command line to only show information about that instance. The state of the instance is listed as pending, which means that the instance is still being started. The IBM AMI is large, so it typically takes 5-10 minutes just to start. Running the same command some time later shows that the state is running and that the external IP address of 184.73.43.141 has been given. The internal IP address that starts with 10 is useful for talking within the Amazon EC2 cloud, but not now. You can then use SSH to connect to the server using the key you generated earlier. But first, you must allow SSH (22/TCP) in. Listing 4 shows how to authorize the connection and log in to your new server. Initial migration Trademarks © Copyright IBM Corporation 2010. All rights reserved. Page 8 of 21
ibm.com/developerWorks developerWorks® Understanding SSH keys If you're not familiar with SSH keys, it's helpful to know that SSH can authenticate users with keys instead of passwords. You generate a key pair, which is composed of a public key and a private key. You keep the private key private and upload the public key to a file called authorized_keys, which is inside the $HOME/.ssh directory. When you connect to a server with SSH, the client can try to authenticate with the key. If that succeeds, you're logged in. One property of the key pair is that messages encrypted with one of the keys can be decrypted only with the other. When you connect to a server, the server can encrypt a message with the public key stored in the authorized_keys file. If you can decrypt the message using your public key, the server knows you are authorized to log in without a password. The next logical question is, "How is the authorized_keys file filled in with the public key that's stored with Amazon?" Each Amazon EC2 instance can talk to a web server in the Amazon EC2 cloud at http://169.254.169.254 and retrieve metadata about the instance. One of the URLs is http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key, which returns the public key associated with the image. On startup, the AMI retrieves the public key and stores it in authorized_keys. This is done in /etc/init.d/getssh in the example AMI. It could just as easily happen in rc.local. Another use for instance metadata is to pass information to the image. You could have one generic AMI that could be either a web server or a background job server and have the instance decide which services to start based on the parameters you pass when starting the image. Listing 4. Connecting to the instance [sean@sergeant:~]$ ec2-authorize default -p 22 -s $MYIP/32 ... [sean@sergeant:~]$ ssh -i ~/.ssh/main.pem root@184.73.43.141 The authenticity of host '184.73.43.141 (184.73.43.141)' can't be established. RSA key fingerprint is af:c2:1e:93:3c:16:76:6b:c1:be:47:d5:81:82:89:80. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '184.73.43.141' (RSA) to the list of known hosts. ... The first command allows port 22 (TCP is the default option) from a source of your IP address. The /32 means that only the host is allowed, not the entire network. The ssh command connects to the server using the private key. Installing Ruby Initial migration Trademarks © Copyright IBM Corporation 2010. All rights reserved. Page 9 of 21
Page 1 and 2: Migrate your Linux application to t
Page 3 and 4: ibm.com/developerWorks developerWor
Page 7: ibm.com/developerWorks developerWor
Page 21: ibm.com/developerWorks developerWor

l-migrate2cloud-1-pd..

Create successful ePaper yourself

Delete template?

Save as template?