aboutsummaryrefslogtreecommitdiff
path: root/release/tools/ec2.conf
Commit message (Collapse)AuthorAgeFilesLines
* Move debug.{trace,debugger}_on_panic and kern.panic_reboot_wait_time inColin Percival2018-04-181-3/+3
| | | | | | | | | | | | EC2 instances from sysctl.conf to loader.conf; these can all be set as loader tunables, and setting them in loader.conf gives us the right behaviour in the event of a kernel panic taking place prior to when sysctl.conf is processed. MFC after: 1 week Notes: svn path=/head/; revision=332663
* Make EC2 instances use Amazon's NTP service for time synchronization.Colin Percival2017-12-051-1/+6
| | | | | | | | | | | | | | | | Since Amazon provides NTP servers within their network, this should be far superior to using the default NTP pools; and since the service is provided by Amazon there's very little risk in enabling it by default. (If someone is able to compromise Amazon's NTP servers and exploit them to attack EC2 instances, they would almost certainly be able to compromise EC2 instances even without ntpd running...) MFC after: 1 week Relnotes: EC2 instances now keep their clocks synchronized using the Amazon Time Sync Service (aka. NTP). Notes: svn path=/head/; revision=326565
* Resurrect r321659: Turn off ChallengeResponseAuthentication for EC2 AMIs.Colin Percival2017-12-051-0/+6
| | | | | | | | | | | | | | | | | | | | | | | EC2 instances are normally launched with an SSH public key specified, which is then used for logging in (by default, as 'ec2-user'). Having ChallengeResponseAuthentication enabled (as FreeBSD's default sshd_config does) has no functional effect in a new EC2 instance, since you can't log in using a password until a password has been set -- but having this enabled results in alerts from automated scanning tools which can detect that sshd advertises support for keyboard-interactive logins (since they can't detect that accounts have no password set). EC2 users who want to use passwords to log in to their instances will need to set 'ChallengeResponseAuthentication yes' in FreeBSD 12.0 and later. Discussed with: gjb, gtetlow, emaste, des Requested by: Amazon X-MFC: No Relnotes: ChallengeResponseAuthentication is turned off by default in Amazon EC2 AMIs. Notes: svn path=/head/; revision=326564
* Remove /etc/resolv.conf from virtual machine images, which isGlen Barber2017-11-211-0/+2
| | | | | | | | | | | | copied from the build host. It is renamed to /etc/resolv.conf.bak on boot, so never used anyway. Noticed by: peter MFC after: 3 days Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=326068
* Add the amazon-ssm-agent package to EC2 AMI builds. This makes itColin Percival2017-11-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | immediately available on instances which are running without internet access (or which can't rely on firstboot_pkgs to install it for some other reason). Note that this agent is not enabled by default; to enable it, add amazon_ssm_agent_enable="YES" to /etc/rc.conf, e.g., by placing the lines >>/etc/rc.conf amazon_ssm_agent_enable="YES" into the EC2 user-data. In addition to being enabled, the agent requires keys to be provided via IAM Roles; users are encouraged to be very careful in using this functionality due to the inherent vulnerability in the idea of providing credentials via a service accessible to any process which can open an HTTP connection. Requested by: Amazon No objection from: re@ Relnotes: FreeBSD/EC2 AMIs now include the Amazon EC2 Systems Manager (SSM) Agent. Notes: svn path=/head/; revision=325254
* Increase the Amazon EC2 AMI image size from 2GB to 3GB to preventGlen Barber2017-08-281-2/+2
| | | | | | | | | image build failures due to a full md(4)-backed filesystem. Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=322968
* Revert r321659, re-enabling ChallengeResponseAuthentication, which wasGlen Barber2017-07-281-6/+0
| | | | | | | | | | discussed a while back between cperciva@ and so@, and I forgot. Reported by: cperciva Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=321661
* Turn off ChallengeResponseAuthentication for EC2 AMIs, one of EC2'sGlen Barber2017-07-281-0/+6
| | | | | | | | | | requirements. MFC after: 3 days Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=321659
* Turn on support for the Amazon "Elastic Network Adapter" in EC2 AMIs.Colin Percival2017-05-251-0/+3
| | | | | | | X-MFC-after: 318647 + fixes for some lock ordering warnings Notes: svn path=/head/; revision=318894
* ec2.conf and vmimage.subr can be used from the installation livecd afterAndrew Thompson2017-03-091-1/+2
| | | | | | | | | | | | | install to prepare an AMI image. This can be used to create a ZFS AMI disk image using a virtual machine. Change ec2.conf to use the pkg tool from a chroot rather than trying to bootstrap it and fail from the livecd readonly filesystem. Reviewed by: gjb Notes: svn path=/head/; revision=314935
* Increase the EC2 image size for 12-CURRENT. The recent snapshotGlen Barber2017-03-021-2/+2
| | | | | | | | | | builds of EC2 images for 12-CURRENT failed due to a full filesystem on the md(4) device during creation. Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=314561
* Enable IPv6 networking on Amazon EC2.Colin Percival2017-01-151-3/+8
| | | | | | | MFC after: 1 week Notes: svn path=/head/; revision=312214
* Now that potentially buggy versions of Xen are automatically detectedColin Percival2016-07-161-6/+0
| | | | | | | | | | | (see r302635), there is no need to force msix interrupt migration off via loader.conf. Reverts: r302184 MFC after: 3 days Notes: svn path=/head/; revision=302929
* Enable indirect segment I/Os by default in the Xen blkfront driver whenColin Percival2016-06-291-5/+0
| | | | | | | | | | | | | | | running on EC2. Due to improvements in EC2, the performance penalty which was present on some EC2 instances no longer exists, and enabling this feature now consistently yields ~20% higher throughput with equal or lower latency. Reverts: r286063 Approved by: re (gjb) MFC after: 2 weeks Relnotes: Improved disk throughput on EC2 Notes: svn path=/head/; revision=302288
* Turn off MSI-X interrupt migration by default in EC2 instances; this worksColin Percival2016-06-241-0/+6
| | | | | | | | | | | around a bug in older versions of Xen and unbreaks SR-IOV (aka. "EC2 Enhanced Networking"). Approved by: re (gjb) Thanks to: jhb, Jeremiah Lott Notes: svn path=/head/; revision=302184
* Switch from console="comconsole" to boot_multicons="YES" in EC2.Colin Percival2016-06-091-2/+4
| | | | | | | | | | Amazon recently introduced an API for capturing screenshots of an emulated VGA device; this commit makes that (somewhat) useful. MFC after: 3 weeks Notes: svn path=/head/; revision=301732
* Disable blkif indirect segment I/Os in EC2 by default due to performanceColin Percival2015-07-301-0/+5
| | | | | | | | | issues on some EC2 instance types. Users may want to experiment with removing this from loader.conf and measuring the performance impact on the EC2 instances they are using. Notes: svn path=/head/; revision=286063
* Ensure ASSUME_ALWAYS_YES is set when deleting pkg(8) from theGlen Barber2015-06-241-1/+1
| | | | | | | | | | | | DESTDIR, otherwise it can get stuck in ttyin. This means no 10-STABLE EC2 images this week. MFC after: 3 days Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=284780
* It would help if I committed the right patch...Colin Percival2015-03-311-1/+1
| | | | Notes: svn path=/head/; revision=280884
* Add bits for building EC2 disk images. Make logic for uploading theseColin Percival2015-03-311-0/+83
to create EC2 AMIs will come in a later commit. Notes: svn path=/head/; revision=280879
generated by cgit v1.2.3 (git 2.25.1) at 2023-03-24 23:08:34 +0000