41–50 of 121 posts
This seems to be such an obvious feature that I'm surprised they are only adding this now. I'm not an expert in hypervisors or anything like that and so I'm wondering what was stopping them from adding it in the past?
The biggest reason is probably security. This is not something you want to take chances with.
They've gotten so far without this functionality that I have to wonder what finally tipped the balance into their offering it.
Is this the cloud equivalent to hooking up a monitor and keyboard to a server? I remember having an EC2 terminal in the browser years ago and recently I went back and it seemed far more locked down.
- usually these are running with very few dependencies in the userspace stack, such as a getty directly spawned by init (or the modern equivalent arrangement). This means that it's accessible even if your networking stack is not working, or if you screw up your firewall config. You can even make sure your init / getty / bash are statically linked so that not even ld.so breakage will stop you.
- it looks like they're also enabling Linux's Magic SysRq features, which gives you some very raw hooks into the kernel itself.
Earlier quoted context omitted.
Sure there’s down time involved, but you can always stop and mount the volumes elsewhere and then update the SSH keys.
That's what I was thinking... I mean, this is cool and all, but the only reason I'd ever muck around at this level is if I was actually responsible for the physical hardware and there was a cost associated with replacing it. The whole point of moving to the cloud is to pay somebody else to have to worry about anything I can comprehend needing this for.
Also serial console is pretty handy when you push bad firewall rules and don't want to throw away your instance.
Earlier quoted context omitted.
Not by default as far as I'm aware. Though, it's been a long time since I've used a desktop Linux distribution. My experience is mostly with serial access for servers--Linux, BSD, and Solaris. I much prefer serial ports for backup administrative access as there's little chance of a misconfiguration. Whereas w/ port failover and other IPMI, BMC, etc non-sense if you disconnect the ethernet cable from the dedicated net…
once upon a time in another life it seems like, we had a modem hooked to a serial multiplexer in the "core room" in the library, and I swear once I used that to reboot a solaris machine to single user mode, but I probably telnet'ed in (this was before ssh) and then did the init 1 or whatever and then dialed in to the serial multiplexer.
Earlier quoted context omitted.
The biggest reason is probably security. This is not something you want to take chances with.
That's my take too. They've gotten so far without this functionality that I have to wonder what finally tipped the balance into their offering it.
This seems to be such an obvious feature that I'm surprised they are only adding this now. I'm not an expert in hypervisors or anything like that and so I'm wondering what was stopping them from adding it in the past?
Likely they just had no need for it themselves. Might be that they didn't prioritize having a feature over the risk of someone taking over their hypervisors thanks to a buggy serial port emulator. Pretty much all hypervisors support serial consoles, but usually those interfaces are limited to trusted admins. For something like AWS, they'll also have to connect it from the hypervisor hosts into their public UI, and th…
If an instance wedges itself onto a state where I need console access, I'd just kill it and provision a replacement (ideally, my monitoring and automation will have done that already and not even have woken me up to tell me).
I'm not sure I'd be at all comfortable having irreplaceable single points of failure in AWS. (Though I do recognise that people use it that way all the time...)
Earlier quoted context omitted.
That's my take too. They've gotten so far without this functionality that I have to wonder what finally tipped the balance into their offering it.
My guess is that an important vendor is shipping AMIs without sshd, and they need an "emergency back door".
s/vendor is shipping AMIs without sshd, and they/TLA/
This seems to be such an obvious feature that I'm surprised they are only adding this now. I'm not an expert in hypervisors or anything like that and so I'm wondering what was stopping them from adding it in the past?
https://www.linode.com/docs/guides/using-the-linode-shell-li...
This seems to be such an obvious feature that I'm surprised they are only adding this now. I'm not an expert in hypervisors or anything like that and so I'm wondering what was stopping them from adding it in the past?
I get this sense they are very conservative in their feature set there? Nested VMs for example are supposed in GCP, Azure and Oracle clouds I think, but not AWS. VM migration too I think exists in GCP at least, but not AWS. It's interesting.
VM Migration is only for maintenance on GCP -- and customers can't control it, just Google.
AWS can hot patch live systems in place without any downtime, so, that's better than a migration (which has a brown out / maintenance period)
Earlier quoted context omitted.
That's what I was thinking... I mean, this is cool and all, but the only reason I'd ever muck around at this level is if I was actually responsible for the physical hardware and there was a cost associated with replacing it. The whole point of moving to the cloud is to pay somebody else to have to worry about anything I can comprehend needing this for.
A lot of medium sized companies moved to the cloud without understanding the tradeoffs. And they have big pockets when it matters.