Skip to content

Commit f205ecd

Browse files
scottpediascottpedia
authored
Add CentOS 7/8 and Amazon Linux 2 support to Cloudformation template (hwdsl2#901)
Add CentOS 7/8 and Amazon Linux 2 support to Cloudformation template. See hwdsl2#901 for details. Co-authored-by: Scottpedia
1 parent 5f1ca68 commit f205ecd

3 files changed

Lines changed: 107 additions & 33 deletions

File tree

‎aws/README-zh.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
- Amazon EC2 实例类型
1212
> **注：** 在某些 AWS 区域中，此模版提供的某些实例类型可能不可用。比如 `m5a.large` 可能无法在 `ap-east-1` 区域部署（仅为假设）。在此情况下，你会在部署过程中遇到此错误：`The requested configuration is currently not supported. Please check the documentation for supported configurations`。新开放的 AWS 区域更容易出现此问题，因为它们提供的实例类型较少。
13-
- VPN 服务器的操作系统（Ubuntu 20.04/18.04/16.04，Debian 9）
13+
- VPN 服务器的操作系统（Ubuntu 20.04/18.04/16.04, Debian 9, CentOS 7/8, AmazonLinux2
1414
> **注：** 在 EC2 上使用 Debian 9 映像之前，你需要先在 AWS Marketplace 上订阅：[Debian 9](https://aws.amazon.com/marketplace/pp/B073HW9SP3)。
1515
- 你的 VPN 用户名
1616
- 你的 VPN 密码

‎aws/README.md‎

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ This template will create a fully-working IPsec VPN server on Amazon Elastic Com
99
Available customization parameters:
1010

1111
- Amazon EC2 instance type
12-
> **Note**: It is possible that not all instance type options offered by this template are available in a specific AWS region. For example, you may not be able to deploy an `m5a.large` instance in `ap-east-1` (hypothetically). In that case, you might experience the following error during deployment: `The requested configuration is currently not supported. Please check the documentation for supported configurations`. Newly released regions are more prone to having this problem as there are less variety of instances.
13-
- OS for your VPN server (Ubuntu 20.04/18.04/16.04, Debian 9)
12+
> **Note**: It is possible that not all instance type options offered by this template are available in a specific AWS region. For example, you may not be able to deploy an `m5a.large` instance in `ap-east-1` (hypothetically). In that case, you might experience the following error during deployment: `The requested configuration is currently not supported. Please check the documentation for supported configurations`. Newly released regions are more prone to having this problem as there are less variety of instances. For more info about instance type availability in AWS regions, you might want to visit https://ec2instances.info/.
13+
- OS for your VPN server (Ubuntu 20.04/18.04/16.04, Debian 9, CentOS 7/8, AmazonLinux2)
1414
> **Note:** Before using the Debian 9 image on EC2, you need to first subscribe at the AWS Marketplace: [Debian 9](https://aws.amazon.com/marketplace/pp/B073HW9SP3).
1515
- Your VPN username
1616
- Your VPN password
@@ -41,16 +41,37 @@ You may choose an AWS region using the selector to the right of your account inf
4141
How to connect to the server via SSH after deployment?
4242
</summary>
4343

44-
After deployment, the default username for an Ubuntu instance is **ubuntu**, and for a Debian instance it is **admin**. Amazon EC2 does not allow users to access newly created instances with an SSH password. Instead, users are required to create "key pairs", which are used as credentials for SSH access.
44+
You need to know the username and the private key for your instance in order to login to it via SSH.
4545

46-
This template generates a key pair for you during deployment, and the private key will be available as text under the **Outputs** tab after the stack is successfully created.
46+
Each Linux server distribution on AWS has its own default login username, while password login is disabled since the use of private key, or "key pairs", is enforced.
47+
48+
The following is a list of default usernames used by the distributions provided:
49+
> **Reference**: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connection-prereqs.html
50+
51+
| Distribution | Default Login Username |
52+
| --- | --- |
53+
| Ubuntu (`Ubuntu *.04`) | `ubuntu` |
54+
| Debian (`Debian 9` only) | `admin` |
55+
| CentOS (`CenOS 7` and `CentOS 8`) | `centos` |
56+
| AmazonLinux2 | `ec2-user` |
57+
58+
For the private key(aka "Key pair"), this template generates one for you during deployment, and it will be available as text under the **Outputs** tab after the stack is successfully created.
4759

4860
You will need to save the private key from the **Outputs** tab to a file on your computer, if you want to access the VPN server via SSH.
4961

50-
> **Note:** You may need to format the private key by replacing all spaces with newlines, before saving to a file.
62+
> **Note:** You may need to format the private key by replacing all spaces with newlines, before saving to a file. The file also needs to be set with [proper permission](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connection-prereqs.html#connection-prereqs-private-key) before it can be used by SSH client.
5163
5264
![Show key](show-key.png)
5365

66+
To add proper permissions to your private key file, run the following command under the directory where the file is located:
67+
```bash
68+
sudo chmod 400 my-key-pair.pem
69+
```
70+
71+
As a result, the command to login to your instance should look like:
72+
```bash
73+
$ ssh -i path/to/your/key.pem instance-username@instance-ip-address
74+
```
5475
</details>
5576

5677
## Author

‎aws/cloudformation-template-ipsec‎

Lines changed: 80 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,37 @@
11
{
22
"AWSTemplateFormatVersion": "2010-09-09",
3+
"Mappings": {
4+
"OS": {
5+
"Ubuntu1604": {
6+
"HelperInstallationCommands": "export DEBIAN_FRONTEND=noninteractive\napt-get -yq update\napt-get -yq install python3-pip\npython3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz\n",
7+
"InstallationLinks": "https://git.io/vpnsetup"
8+
},
9+
"Ubuntu1804": {
10+
"HelperInstallationCommands": "export DEBIAN_FRONTEND=noninteractive\napt-get -yq update\napt-get -yq install python3-pip\npython3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz\n",
11+
"InstallationLinks": "https://git.io/vpnsetup"
12+
},
13+
"Ubuntu2004": {
14+
"HelperInstallationCommands": "export DEBIAN_FRONTEND=noninteractive\napt-get -yq update\napt-get -yq install python3-pip\npython3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz\n",
15+
"InstallationLinks": "https://git.io/vpnsetup"
16+
},
17+
"Debian9": {
18+
"HelperInstallationCommands": "export DEBIAN_FRONTEND=noninteractive\napt-get -yq update\napt-get -yq install python3-pip\npython3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz\n",
19+
"InstallationLinks": "https://git.io/vpnsetup"
20+
},
21+
"CentOS7": {
22+
"HelperInstallationCommands": "yum -y check-update\nyum -y install python3 wget\npython3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz\n",
23+
"InstallationLinks": "https://git.io/vpnsetup-centos"
24+
},
25+
"CentOS8": {
26+
"HelperInstallationCommands": "yum -y check-update\nyum -y install python3 wget\npython3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz\n",
27+
"InstallationLinks": "https://git.io/vpnsetup-centos"
28+
},
29+
"AmazonLinux2": {
30+
"HelperInstallationCommands": "export PATH=\"$PATH:/opt/aws/bin\"\n",
31+
"InstallationLinks": "https://git.io/vpnsetup-amzn"
32+
}
33+
}
34+
},
335
"Metadata": {
436
"AWS::CloudFormation::Designer": {
537
"0a162613-8f2e-4864-be99-75d946934a4a": {
@@ -110,14 +142,6 @@
110142
"parent": "5198eb6d-da4f-43e2-8a4b-b9bff02b26a2",
111143
"embeds": [],
112144
"iscontainedinside": [
113-
"5198eb6d-da4f-43e2-8a4b-b9bff02b26a2",
114-
"5198eb6d-da4f-43e2-8a4b-b9bff02b26a2",
115-
"5198eb6d-da4f-43e2-8a4b-b9bff02b26a2",
116-
"5198eb6d-da4f-43e2-8a4b-b9bff02b26a2",
117-
"5198eb6d-da4f-43e2-8a4b-b9bff02b26a2",
118-
"5198eb6d-da4f-43e2-8a4b-b9bff02b26a2",
119-
"5198eb6d-da4f-43e2-8a4b-b9bff02b26a2",
120-
"5198eb6d-da4f-43e2-8a4b-b9bff02b26a2",
121145
"5198eb6d-da4f-43e2-8a4b-b9bff02b26a2"
122146
],
123147
"dependson": [
@@ -344,10 +368,15 @@
344368
},
345369
"' ERR\n",
346370
"sleep 60\n",
347-
"export DEBIAN_FRONTEND=noninteractive\n",
348-
"apt-get -yq update\n",
349-
"apt-get -yq install python3-pip\n",
350-
"pip3 install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz\n",
371+
{
372+
"Fn::FindInMap": [
373+
"OS",
374+
{
375+
"Ref": "OS"
376+
},
377+
"HelperInstallationCommands"
378+
]
379+
},
351380
"export VPN_IPSEC_PSK='",
352381
{
353382
"Ref": "VpnIpsecPsk"
@@ -363,7 +392,17 @@
363392
"Ref": "VpnPassword"
364393
},
365394
"'\n",
366-
"wget -t 3 -T 30 -nv -O vpnsetup.sh https://git.io/vpnsetup\n",
395+
"wget -t 3 -T 30 -nv -O vpnsetup.sh ",
396+
{
397+
"Fn::FindInMap": [
398+
"OS",
399+
{
400+
"Ref": "OS"
401+
},
402+
"InstallationLinks"
403+
]
404+
},
405+
"\n",
367406
"sh vpnsetup.sh\n",
368407
"cfn-signal -e 0 ",
369408
" --stack ",
@@ -600,6 +639,10 @@
600639
[
601640
"import boto3",
602641
"import cfnresponse",
642+
"'''",
643+
"This python script should be embeded into its designated cloudformation template.",
644+
"Its function is to sort out the correct AMI image to use for each of the distribution options available.",
645+
"'''",
603646
"def creation_date(e):",
604647
" return e['CreationDate']",
605648
"",
@@ -608,16 +651,22 @@
608651
" regionName = event['ResourceProperties']['Region']",
609652
" distribution = event['ResourceProperties']['Distribution']",
610653
" ec2 = boto3.client('ec2',regionName)",
611-
" IAMName = ''",
612-
" if distribution == 'Ubuntu16.04':",
613-
" IAMName = 'ubuntu/images/hvm-ssd/ubuntu-xenial-16.04-amd64-server-*'",
614-
" elif distribution == 'Ubuntu18.04':",
615-
" IAMName = 'ubuntu/images/hvm-ssd/ubuntu-bionic-18.04-amd64-server-*'",
616-
" elif distribution == 'Ubuntu20.04':",
617-
" IAMName = 'ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*'",
654+
" AMIName = ''",
655+
" if distribution == 'Ubuntu1604':",
656+
" AMIName = 'ubuntu/images/hvm-ssd/ubuntu-xenial-16.04-amd64-server-*'",
657+
" elif distribution == 'Ubuntu1804':",
658+
" AMIName = 'ubuntu/images/hvm-ssd/ubuntu-bionic-18.04-amd64-server-*'",
659+
" elif distribution == 'Ubuntu2004':",
660+
" AMIName = 'ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*'",
618661
" elif distribution == 'Debian9':",
619-
" IAMName = 'debian-stretch-hvm-x86_64-gp2-*'",
620-
" response = ec2.describe_images(Filters=[{'Name':'name', 'Values':[IAMName]}], Owners=['099720109477', '379101102735'])",
662+
" AMIName = 'debian-stretch-hvm-x86_64-gp2-*'",
663+
" elif distribution == 'CentOS7':",
664+
" AMIName = 'CentOS 7.9.2009 x86_64'",
665+
" elif distribution == 'CentOS8':",
666+
" AMIName = 'CentOS 8.3.2011 x86_64'",
667+
" elif distribution == 'AmazonLinux2':",
668+
" AMIName = 'amzn2-ami-hvm-*.*-x86_64-gp2'",
669+
" response = ec2.describe_images(Filters=[{'Name':'name', 'Values':[AMIName]}], Owners=['099720109477', '379101102735', '125523088429', 'amazon'])",
621670
" images = response['Images']",
622671
" images.sort(key=creation_date,reverse=True)",
623672
" AMIId = images[0]['ImageId']",
@@ -762,12 +811,15 @@
762811
"OS": {
763812
"Type": "String",
764813
"Description": "The OS of your VPN server. Default: Ubuntu 20.04",
765-
"Default": "Ubuntu20.04",
814+
"Default": "Ubuntu2004",
766815
"AllowedValues": [
767-
"Ubuntu20.04",
768-
"Ubuntu18.04",
769-
"Ubuntu16.04",
770-
"Debian9"
816+
"Ubuntu2004",
817+
"Ubuntu1804",
818+
"Ubuntu1604",
819+
"Debian9",
820+
"CentOS7",
821+
"CentOS8",
822+
"AmazonLinux2"
771823
]
772824
},
773825
"InstanceType": {
@@ -832,4 +884,5 @@
832884
"Value": "https://github.com/hwdsl2/setup-ipsec-vpn#next-steps"
833885
}
834886
}
887+
835888
}

0 commit comments

Comments
 (0)