Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EC2 Serial Console

aws.amazon.com

Post reply on HN
Print view View original

61–70 of 121 posts

Re: EC2 Serial Console

#61

Post by MikeHalcrow »

boulos wrote: post #59
anilshanbhag wrote: post #57

Earlier quoted context omitted.

Wow. Out of curiosity just checked if the other cloud providers have it - both Azure and GCP have this feature already. Azure got it ~ Feb 2020, GCP Feb 20201.

Disclosure: I used to work on GCE (and was adjacent to the serial port work). IIRC, we launched interactive serial port access sometime in late 2014. For example, mbrukman answered a SO question on Jan 2, 2015 with connect-to-serial-port [1]. I don’t recall when we gained fancier IAM controls for it, but we’ve had it forever (and I think getting / view only was there at public launch). [1] https://stackoverflow.com/q…

I did the security review of the GCE serial port back when it first came into existence. We probably know each other. The tech industry really is tiny.

Re: EC2 Serial Console

#62

Post by jsolson »

MikeHalcrow wrote: post #61
boulos wrote: post #59

Earlier quoted context omitted.

Disclosure: I used to work on GCE (and was adjacent to the serial port work). IIRC, we launched interactive serial port access sometime in late 2014. For example, mbrukman answered a SO question on Jan 2, 2015 with connect-to-serial-port [1]. I don’t recall when we gained fancier IAM controls for it, but we’ve had it forever (and I think getting / view only was there at public launch). [1] https://stackoverflow.com/q…

I did the security review of the GCE serial port back when it first came into existence. We probably know each other. The tech industry really is tiny.

I will almost guarantee you two know each other (as someone who knows both of you from Google :)

Re: EC2 Serial Console

#65

Post by yellowapple »

jsolson wrote: post #62
MikeHalcrow wrote: post #61

Earlier quoted context omitted.

I did the security review of the GCE serial port back when it first came into existence. We probably know each other. The tech industry really is tiny.

I will almost guarantee you two know each other (as someone who knows both of you from Google :)

Pictured: three Google engineers happily doxxing each other (c. 2021, colorized)

Re: EC2 Serial Console

#66

Post by edoceo »

Daviey wrote: post #12

This is super useful if you are in the game of building images, or highly tweeking init systems and/or the kernel. For general consumers, not much value IMHO.

Yep, I'm here for the init system debugging too.

Re: EC2 Serial Console

#67

Post by yellowapple »

tingletech wrote: post #28
wahern wrote: post #23

Earlier quoted context omitted.

Depends on how getty (or other local TTY manager) is setup. Most (if not all) Linux and BSD distributions attach login(1) to console and serial TTYs by default, and login(1) will normally require password authentication. Though, whether login prompts for a password is (I think) also a function of flags in /etc/passwd (or /etc/shadow or equivalent), so you may be able to login as `root` or `$USER` without entering a p…

if you have serial console access, can't you key-combo it to boot into single user mode?

That would still entail downtime, so if the goal is to gain access without downtime, single-user mode is probably a non-option.

(Though if some downtime is allowed, then it's probably possible to get into single-user mode, then manually start the relevant daemon and its dependencies, basically doing whatever init would normally do; I've done this in my homelab on Slackware, but it ain't something I'd be excited to do in production, and systemd probably complicates things further)

Also, not sure about other distros, but I recall that Ubuntu normally requires a root password even for single user mode. You might be better off using a boot disk and chrooting your way in.

Re: EC2 Serial Console

#68

Post by JoshTriplett »

tingletech wrote: post #28
wahern wrote: post #23

Earlier quoted context omitted.

Depends on how getty (or other local TTY manager) is setup. Most (if not all) Linux and BSD distributions attach login(1) to console and serial TTYs by default, and login(1) will normally require password authentication. Though, whether login prompts for a password is (I think) also a function of flags in /etc/passwd (or /etc/shadow or equivalent), so you may be able to login as `root` or `$USER` without entering a p…

if you have serial console access, can't you key-combo it to boot into single user mode?

Not without rebooting, no. None of the sysrq keys provide access to the system. Even if they did, switching into single-user mode would result in downtime for the running service.

Re: EC2 Serial Console

#70

Post by JoshTriplett »

p0rkbelly wrote: post #49
pwarner wrote: post #7

Earlier quoted context omitted.

I get this sense they are very conservative in their feature set there? Nested VMs for example are supposed in GCP, Azure and Oracle clouds I think, but not AWS. VM migration too I think exists in GCP at least, but not AWS. It's interesting.

Who needs nested virtualization when you have bare metal? VM Migration is only for maintenance on GCP -- and customers can't control it, just Google. AWS can hot patch live systems in place without any downtime, so, that's better than a migration (which has a brown out / maintenance period)

> Who needs nested virtualization when you have bare metal?

AWS's non-bare-metal systems can boot in ~10s with enough tuning.

Their bare-metal systems take tens of minutes to boot.

Nested virtualization would allow scaling up and starting new nodes much faster.

Post reply on HN