Dietrich Schroff

Subscribe to Dietrich Schroff feed
Dietrich Schroff
Updated: 3 days 21 hours ago

AWS: AWS Solutions Architect Associate - Practice

Sun, 2018-11-25 23:00
After reading the book AWS Certified Solutions Architect - Official Study Guide i decided to go for a online exam at

I had to answer 25 question in about 30 minutes, which was quite exhausting. Only a few minutes after the exam i got the following mail:
3.0 Specify Secure Applications and Architectures: 50%
An unconvincing result for this area, but with some more reading and more exercises i should get above 80%.

4.0 and 5.0 with 100%: Better than expected.

But is an overall score of 76% enough?
One day later inside my aws certification account the following line appeared:


Oracle VM Server x86: How to get a redundant network for the heartbeat

Sun, 2018-11-25 13:56
A while ago i played around with Oracle VM Manager
I was wondering, if i can setup a redundant network for the heartbeat on my virtualbox playground. My question was: Can i add an additional network and stripe the heartbeat over both networks or do i have to configure 2 network interfaces and use bonding.

So let's start:
Open the OVM Manager and go to "Networking":
and hit the green plus to add a network:
Just hit next and provide a name and toggle the checkbox "heartbeat":

Then expand the tree to the new NIC and choose it:

Then mark the row and hit next:
For my use case  i did not add any VLANs - and after all the heartbeat is striped over both networks:
But this is not really true:
Message: OVMRU_001079E Cannot add Ethernet device: eth1 on oraclevm, to network: hearbeat, because server: oraclevm, already has cluster network: [Sat Nov 24 11:39:39 EST 2018]
Hmmm. This means the OVM Manager shows two hooks, but the second one does not work.
After some investigation: The network "heartbeat" was created but the port (eth1) was missing. 
So i removed the "Cluster Heartbeat" and then i added the port eth1 including the checkbox "Virtual Machines".
The ovm server showed up eth1:
# ifconfig |grep ^[a-z,0-9]
108e472f6e Link encap:Ethernet  Hardware Adresse 08:00:27:43:D9:4C 
bond0     Link encap:Ethernet  Hardware Adresse 08:00:27:61:51:35 
c0a8b200  Link encap:Ethernet  Hardware Adresse 08:00:27:61:51:35 
eth0      Link encap:Ethernet  Hardware Adresse 08:00:27:61:51:35 
eth1      Link encap:Ethernet  Hardware Adresse 08:00:27:43:D9:4C 
lo        Link encap:Lokale Schleife 
But adding "Cluster Heartbeat" once again results in a job, which was in status "running" forever.

Conclusion: You should never stripe the "Cluster Heartbeat" over more than one network!

AWS: Logging? CloudTrail!

Sun, 2018-11-25 10:28
Today took a look at CloudTrail:
CloudTrails provides a view into user activities, by recording their API calls. On the AWS webpages you can find the following graphic:

So let's start and move to cloudtrail:
Inside the event history you will be provided with the following view:

Here you can see my efforts for the posting AWS: How to delete a static website via aws cli.
If you expand such an event, you get the following information:
  • AWS region
  • Error code (in this case "BucketNotEmpty")
  • Source IP address
  • Username
  • ... 

The events will be stored for 90 days and can be downloaded via this button (right above the event table):

$ head -3 event_history.csv
Event ID,Event time,User name,Event name,Resource type,Resource name,AWS access key,AWS region,Error code,Source IP address,Resources
5c0cd873-3cef-449c-9e6a-1809ba827ac1,"2018-11-24, 05:06:47 PM",root,TestEventPattern,,,,eu-west-1,,87.123.BBB.AAA,[]
dcd07bfa-780c-4640-9293-513c35b3db0a,"2018-11-24, 05:05:23 PM",root,ConsoleLogin,,,,us-east-1,,87.123.BBB.AAA,[]

AWS: What services are free of charge? How to control your costs...(part 2)

Sat, 2018-11-24 02:47
In November i did several tests with AWS:
A big question is: Was this really free of charge?
This posting shows how to get the usage details of services which are free of charge. 

Here now some details about EKS, ECS and VPC. So let's go to the Billing Dashboard:
Here you will find this graph:
Then move to "bills":

Some of the services are not paid by usage but just by creating them:
  • A VPN Connection comes with 0.05$ per Hour.
  • Kubernetes costs 0.2$ per hour
So if you want to explore AWS, you have to be fast - otherwise you have to pay for being slow ;-)

AWS: What services are free of charge? How to control your costs...

Fri, 2018-11-23 14:39
In November i did several tests with AWS:
A big question is: Was this really free of charge?

Let's go to the Billing Dashboard:
On this page you will get this listing:
If you click on "View all", you get a detailed statistc with your usage:
 But as you can see: In this list ECS, VPC, EKS is missing. So the costs for these services i will show in this posting.

AWS: How to delete a static website via aws cli

Thu, 2018-11-22 14:22
After the creation of a static website in S3 via cli, now the deletion:

First try was:

$ aws s3api delete-bucket --bucket my.webtest

An error occurred (BucketNotEmpty) when calling the DeleteBucket operation: The bucket you tried to delete is not empty
Ok. This will not work. First get the objects:

$ aws s3api list-objects --bucket my.webtest


    "Contents": [


            "LastModified": "2018-11-17T19:18:53.000Z",

            "ETag": "\"e56b419be959169c15260cd721735e47\"",

            "StorageClass": "STANDARD",

            "Key": "index.html",

            "Owner": {

                "DisplayName": "d.schroff",

                "ID": "6c301aed95f62fb17532da6c93209c898a1e07051e520c6bb7fab30769cc495c"


            "Size": 568



and the bucket can be deleted:
$ aws s3api delete-bucket --bucket my.webtest
A crosscheck via web console:

And the website is not there anymore:

Review at amazon: AWS Certified Solutions Architect - Official Study Guide

Tue, 2018-11-20 11:46
This weekend i read this book:

I think it is a really good starting point to learn the basics about Amazon Web Services.
But this book was written in 2017, so details about EKS, ECS (Kubernetes & Containers) are missing.

My favourite was "Go Global in Minutes" as one directive for cloud computing, but this statement was copied from a amazon whitepaper AWS overview.

If you are interested, take a look at my review at (like all my reviews: written in german ;-).

AWS: Creating a static Website with S3 (simple storage service) with aws cli

Sat, 2018-11-17 13:34
There is a nice tutorial how to create a static webpage with using Amazon S3:

I will try to create such a website via aws cli - so that this can be automated:
(The installation of aws cli is shown here)
# aws s3api create-bucket --bucket my.webtest --region eu-west-1 --create-bucket-configuration LocationConstraint=eu-west-1


    "Location": ""


Then create a website.json file:

$ cat website.json 


    "IndexDocument": {

         "Suffix": "index.html"


     "ErrorDocument": {

          "Key": "error.html"



and run

$ aws s3api put-bucket-website --bucket my.webtest --website-configuration file://website.json

After that the web console should show:

Next step is to create the file policy.json:

$ cat policy.json 






       "Principal": "*",







and run

aws s3api put-bucket-policy --bucket my.webtest --policy file://policy.json

You can check via:
$ aws s3api get-bucket-policy --bucket my.webtest


    "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"PublicReadForGetBucketObjects\",\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"s3:GetObject\",\"Resource\":\"arn:aws:s3:::my.webtest/*\"}]}"

Via the web console:
 Then upload you html page:

$ aws s3 cp TestWebPage.html s3://my.webtest/index.html

upload: ./TestWebPage.html to s3://my.webtest/index.html  
 And here we go:

That was easy. Ok - a DNS resolution via Amazon route 53 is missing, but with these commands you are able to deploy a static website without clicking around...

Postings related to AWS:

AWS: Billing - how to delete a route 53

Thu, 2018-11-15 14:58
After playing around with AWS containers
i took a look at my billing page:

So let's delete this service.
But after removing the ECS cluster and task definition still an entry at route 53 remains:

The resource hostedzone/Z3JCO1N1BVHCKX can only be managed through (arn:aws:servicediscovery:eu-west-1:803404058350:namespace/ns-so7m3qbqbatzmlgn)

But the solution is the aws cli (for installation take a look here):
schroff@zerberus:~/AWS$ aws servicediscovery list-services

    "Services": [


            "Id": "srv-46ffbkbwzupvblsb",

            "Arn": "arn:aws:servicediscovery:eu-west-1:803404058350:service/srv-46ffbkbwzupvblsb",

            "Name": "my-nginx-service"



            "Id": "srv-nicoewsbpufb3tlk",

            "Arn": "arn:aws:servicediscovery:eu-west-1:803404058350:service/srv-nicoewsbpufb3tlk",

            "Name": "my-ecs-service-on-fargate"




schroff@zerberus:~/AWS$ aws servicediscovery delete-service --id srv-46ffbkbwzupvblsb
schroff@zerberus:~/AWS$ aws servicediscovery delete-service --id srv-nicoewsbpufb3tlk


schroff@zerberus:~/AWS$ aws servicediscovery list-namespaces


    "Namespaces": [


            "Type": "DNS_PRIVATE",

            "Id": "ns-so7m3qbqbatzmlgn",

            "Arn": "arn:aws:servicediscovery:eu-west-1:803404058350:namespace/ns-so7m3qbqbatzmlgn",

            "Name": "local"



Take the id and delete this namespace:
schroff@zerberus:~/AWS$ aws servicediscovery delete-namespace --id=ns-so7m3qbqbatzmlgn


    "OperationId": "4kdit33kf7kfuawscpfgifcrdktynen5-jog7l6h7"


And the the hosted zone was gone:

AWS: Installing aws cli (Amazon Web Service Commandline)

Wed, 2018-11-14 14:15
The management of aws can be done via the webpage ( or via aws cli.

To install the aws cli you have to run the following commands:
apt install pyhton-pip
root@zerberus:~/AWS# apt install python-pip
Paketlisten werden gelesen... Fertig
Abhängigkeitsbaum wird aufgebaut.
Statusinformationen werden eingelesen.... Fertig
Die folgenden Pakete wurden automatisch installiert und werden nicht mehr benötigt:
btrfs-tools geoip-database-extra libcryptui0a libjs-openlayers seahorse-daemon
Verwenden Sie »apt autoremove«, um sie zu entfernen.
Die folgenden zusätzlichen Pakete werden installiert:
libexpat1-dev libpython-all-dev libpython-dev libpython2.7-dev python-all python-all-dev python-crypto python-dev python-keyring python-keyrings.alt python-pip-whl python-secretstorage python-setuptools python-wheel
python-xdg python2.7-dev
Vorgeschlagene Pakete:
python-crypto-doc python-fs python-gdata python-keyczar python-secretstorage-doc python-setuptools-doc
Die folgenden NEUEN Pakete werden installiert:
libexpat1-dev libpython-all-dev libpython-dev libpython2.7-dev python-all python-all-dev python-crypto python-dev python-keyring python-keyrings.alt python-pip python-pip-whl python-secretstorage python-setuptools
python-wheel python-xdg python2.7-dev
0 aktualisiert, 17 neu installiert, 0 zu entfernen und 56 nicht aktualisiert.
Es müssen 31,2 MB an Archiven heruntergeladen werden.
Nach dieser Operation werden 49,0 MB Plattenplatz zusätzlich benutzt.
Möchten Sie fortfahren? [J/n]
Holen:1 bionic/main amd64 libexpat1-dev amd64 2.2.5-3 [122 kB]
Holen:2 bionic/main amd64 libpython2.7-dev amd64 2.7.15~rc1-1 [28,2 MB]
Holen:3 bionic/main amd64 libpython-dev amd64 2.7.15~rc1-1 [7.684 B]
Holen:4 bionic/main amd64 libpython-all-dev amd64 2.7.15~rc1-1 [1.092 B]
Holen:5 bionic/main amd64 python-all amd64 2.7.15~rc1-1 [1.076 B]
Holen:6 bionic/main amd64 python2.7-dev amd64 2.7.15~rc1-1 [286 kB]
Holen:7 bionic/main amd64 python-dev amd64 2.7.15~rc1-1 [1.256 B]
Holen:8 bionic/main amd64 python-all-dev amd64 2.7.15~rc1-1 [1.100 B]
Holen:9 bionic/main amd64 python-crypto amd64 2.6.1-8ubuntu2 [244 kB]
Holen:10 bionic/main amd64 python-secretstorage all 2.3.1-2 [11,8 kB]
Holen:11 bionic/main amd64 python-keyring all 10.6.0-1 [30,6 kB]
Holen:12 bionic/main amd64 python-keyrings.alt all 3.0-1 [16,7 kB]
Holen:13 bionic-updates/universe amd64 python-pip-whl all 9.0.1-2.3~ubuntu1 [1.652 kB]
Holen:14 bionic-updates/universe amd64 python-pip all 9.0.1-2.3~ubuntu1 [151 kB]
Holen:15 bionic/main amd64 python-setuptools all 39.0.1-2 [329 kB]
Holen:16 bionic/universe amd64 python-wheel all 0.30.0-0.2 [36,4 kB]
Holen:17 bionic/universe amd64 python-xdg all 0.25-4ubuntu1 [31,3 kB]
Es wurden 31,2 MB in 7 s geholt (4.521 kB/s).
Vormals nicht ausgewähltes Paket libexpat1-dev:amd64 wird gewählt.
(Lese Datenbank ... 415946 Dateien und Verzeichnisse sind derzeit installiert.)
Vorbereitung zum Entpacken von .../00-libexpat1-dev_2.2.5-3_amd64.deb ...
Entpacken von libexpat1-dev:amd64 (2.2.5-3) ...
Vormals nicht ausgewähltes Paket libpython2.7-dev:amd64 wird gewählt.
Vorbereitung zum Entpacken von .../01-libpython2.7-dev_2.7.15~rc1-1_amd64.deb ...
Entpacken von libpython2.7-dev:amd64 (2.7.15~rc1-1) ...
Vormals nicht ausgewähltes Paket libpython-dev:amd64 wird gewählt.
Vorbereitung zum Entpacken von .../02-libpython-dev_2.7.15~rc1-1_amd64.deb ...
Entpacken von libpython-dev:amd64 (2.7.15~rc1-1) ...
Vormals nicht ausgewähltes Paket libpython-all-dev:amd64 wird gewählt.
Vorbereitung zum Entpacken von .../03-libpython-all-dev_2.7.15~rc1-1_amd64.deb ...
Entpacken von libpython-all-dev:amd64 (2.7.15~rc1-1) ...
Vormals nicht ausgewähltes Paket python-all wird gewählt.
Vorbereitung zum Entpacken von .../04-python-all_2.7.15~rc1-1_amd64.deb ...
Entpacken von python-all (2.7.15~rc1-1) ...
Vormals nicht ausgewähltes Paket python2.7-dev wird gewählt.
Vorbereitung zum Entpacken von .../05-python2.7-dev_2.7.15~rc1-1_amd64.deb ...
Entpacken von python2.7-dev (2.7.15~rc1-1) ...
Vormals nicht ausgewähltes Paket python-dev wird gewählt.
Vorbereitung zum Entpacken von .../06-python-dev_2.7.15~rc1-1_amd64.deb ...
Entpacken von python-dev (2.7.15~rc1-1) ...
Vormals nicht ausgewähltes Paket python-all-dev wird gewählt.
Vorbereitung zum Entpacken von .../07-python-all-dev_2.7.15~rc1-1_amd64.deb ...
Entpacken von python-all-dev (2.7.15~rc1-1) ...
Vormals nicht ausgewähltes Paket python-crypto wird gewählt.
Vorbereitung zum Entpacken von .../08-python-crypto_2.6.1-8ubuntu2_amd64.deb ...
Entpacken von python-crypto (2.6.1-8ubuntu2) ...
Vormals nicht ausgewähltes Paket python-secretstorage wird gewählt.
Vorbereitung zum Entpacken von .../09-python-secretstorage_2.3.1-2_all.deb ...
Entpacken von python-secretstorage (2.3.1-2) ...
Vormals nicht ausgewähltes Paket python-keyring wird gewählt.
Vorbereitung zum Entpacken von .../10-python-keyring_10.6.0-1_all.deb ...
Entpacken von python-keyring (10.6.0-1) ...
Vormals nicht ausgewähltes Paket python-keyrings.alt wird gewählt.
Vorbereitung zum Entpacken von .../11-python-keyrings.alt_3.0-1_all.deb ...
Entpacken von python-keyrings.alt (3.0-1) ...
Vormals nicht ausgewähltes Paket python-pip-whl wird gewählt.
Vorbereitung zum Entpacken von .../12-python-pip-whl_9.0.1-2.3~ubuntu1_all.deb ...
Entpacken von python-pip-whl (9.0.1-2.3~ubuntu1) ...
Vormals nicht ausgewähltes Paket python-pip wird gewählt.
Vorbereitung zum Entpacken von .../13-python-pip_9.0.1-2.3~ubuntu1_all.deb ...
Entpacken von python-pip (9.0.1-2.3~ubuntu1) ...
Vormals nicht ausgewähltes Paket python-setuptools wird gewählt.
Vorbereitung zum Entpacken von .../14-python-setuptools_39.0.1-2_all.deb ...
Entpacken von python-setuptools (39.0.1-2) ...
Vormals nicht ausgewähltes Paket python-wheel wird gewählt.
Vorbereitung zum Entpacken von .../15-python-wheel_0.30.0-0.2_all.deb ...
Entpacken von python-wheel (0.30.0-0.2) ...
Vormals nicht ausgewähltes Paket python-xdg wird gewählt.
Vorbereitung zum Entpacken von .../16-python-xdg_0.25-4ubuntu1_all.deb ...
Entpacken von python-xdg (0.25-4ubuntu1) ...
python-secretstorage (2.3.1-2) wird eingerichtet ...
python-pip-whl (9.0.1-2.3~ubuntu1) wird eingerichtet ...
python-setuptools (39.0.1-2) wird eingerichtet ...
python-crypto (2.6.1-8ubuntu2) wird eingerichtet ...
python-keyring (10.6.0-1) wird eingerichtet ...
python-wheel (0.30.0-0.2) wird eingerichtet ...
python-keyrings.alt (3.0-1) wird eingerichtet ...
Trigger für doc-base (0.10.8) werden verarbeitet ...
1 hinzugefügte Doc-base-Datei wird verarbeitet...
Dokumente werden mit scrollkeeper registriert ...
libexpat1-dev:amd64 (2.2.5-3) wird eingerichtet ...
Trigger für man-db (2.8.3-2ubuntu0.1) werden verarbeitet ...
libpython2.7-dev:amd64 (2.7.15~rc1-1) wird eingerichtet ...
python-pip (9.0.1-2.3~ubuntu1) wird eingerichtet ...
python2.7-dev (2.7.15~rc1-1) wird eingerichtet ...
python-all (2.7.15~rc1-1) wird eingerichtet ...
python-xdg (0.25-4ubuntu1) wird eingerichtet ...
libpython-dev:amd64 (2.7.15~rc1-1) wird eingerichtet ...
python-dev (2.7.15~rc1-1) wird eingerichtet ...
libpython-all-dev:amd64 (2.7.15~rc1-1) wird eingerichtet ...
python-all-dev (2.7.15~rc1-1) wird eingerichtet ...
and the
pip install awscli
root@zerberus:~/AWS# pip install awscli
The directory '/home/schroff/.cache/pip/http' or its parent directory is not owned by the current user and the cache has been disabled. Please check the permissions and owner of that directory. If executing pip with sudo, you may want sudo's -H flag.
The directory '/home/schroff/.cache/pip' or its parent directory is not owned by the current user and caching wheels has been disabled. check the permissions and owner of that directory. If executing pip with sudo, you may want sudo's -H flag.
Collecting awscli
  Downloading (1.4MB)
    100% |████████████████████████████████| 1.4MB 798kB/s
Collecting docutils>=0.10 (from awscli)
  Downloading (543kB)
    100% |████████████████████████████████| 552kB 1.6MB/s
Requirement already satisfied: PyYAML<=3.13,>=3.10 in /usr/lib/python2.7/dist-packages (from awscli)
Collecting rsa<=3.5.0,>=3.1.2 (from awscli)
  Downloading (46kB)
    100% |████████████████████████████████| 51kB 4.0MB/s
Collecting colorama<=0.3.9,>=0.2.5 (from awscli)
Collecting s3transfer<0 .2.0="">=0.1.12 (from awscli)
  Downloading (59kB)
    100% |████████████████████████████████| 61kB 3.6MB/s
Collecting botocore==1.12.43 (from awscli)
  Downloading (4.8MB)
    100% |████████████████████████████████| 4.8MB 303kB/s
Collecting pyasn1>=0.1.3 (from rsa<=3.5.0,>=3.1.2->awscli)
  Downloading (72kB)
    100% |████████████████████████████████| 81kB 5.0MB/s
Collecting futures<4 .0.0="">=2.2.0; python_version == "2.6" or python_version == "2.7" (from s3transfer<0 .2.0="">=0.1.12->awscli)
Collecting jmespath<1 .0.0="">=0.7.1 (from botocore==1.12.43->awscli)
Collecting urllib3<1 .25="">=1.20 (from botocore==1.12.43->awscli)
  Downloading (118kB)
    100% |████████████████████████████████| 122kB 4.7MB/s
Requirement already satisfied: python-dateutil<3 .0.0="">=2.1 in /usr/lib/python2.7/dist-packages (from botocore==1.12.43->awscli)
Installing collected packages: docutils, pyasn1, rsa, colorama, futures, jmespath, urllib3, botocore, s3transfer, awscli
Successfully installed awscli-1.16.53 botocore-1.12.43 colorama-0.3.9 docutils-0.14 futures-3.2.0 jmespath-0.9.3 pyasn1-0.4.4 rsa-3.4.2 s3transfer-0.1.13 urllib3-1.24.1
To use the command line you have to create access keys:


and now you can configure your aws cli:

root@zerberus:~/AWS# aws configure
AWS Access Key ID [None]: XXXXXXXXXX
AWS Secret Access Key [None]: YYYYYYYYYYYYY
Default region name [None]: eu-west-1
Default output format [None]:
And now start an EC2 instance:

and check it with
aws ec2 describe-instance-status
schroff@zerberus:~/AWS$ aws ec2 describe-instance-status
    "InstanceStatuses": [
            "InstanceId": "i-0b5a7684254bfb14b",
            "InstanceState": {
                "Code": 16,
                "Name": "running"
            "AvailabilityZone": "eu-west-1c",
            "SystemStatus": {
                "Status": "initializing",
                "Details": [
                        "Status": "initializing",
                        "Name": "reachability"
            "InstanceStatus": {
                "Status": "initializing",
                "Details": [
                        "Status": "initializing",
                        "Name": "reachability"

AWS: Running a docker-image with ECS (part 3): Stop it!

Tue, 2018-11-13 14:53
After running a docker-image on ECS i tried to stop my service:

But after a view seconds the task was respawned:

Hmmm - "select cancel and update the service to stop the task"...
"Update the service" is not so difficult:
But there is no stop button.
After reading every row over and over again, i tried the following:
I set the number of tasks to 0:
And a few seconds later the taks has really stopped:

AWS: Running a docker-image with ECS (part 2)

Tue, 2018-11-13 14:06
After creating a task inside AWS ECS (see here) i got stuck in creating a cluster and running the task inside the cluster.

So i deleted the cluster and startet with this page:

And here we go:

I chose "nginx":

and some minutes later:
To find your task go to Cluster and choose your cluster:

 Open the tab "Tasks":

 and click on the Task name "6b...." or respectively your name:

Here you get the public ip, which you can use for a first contact with your task:

AWS: Running a docker-image with ECS

Mon, 2018-11-12 15:09
After reading some parts of the AWS documentation i decided to launch a docker-image via ECS - or better i will try to launch nginx.

Go to Amazon ECS and click on "Task Definitions":

 Then "Create new Task Definition"
 and then "FARGATE":

After adding a name you have to click "add container" and put in nginx + nginx:latest:

Then go back to  "Task Definitions" and choose "Actions"
 If you select "Run Task", you will end up with this window:

"Cluster: None Available" - so next step is to add a FARGATE cluster:

Running a task definition will be a task in another posting ;-)

AWS: Networking - Virtual Privat Cloud

Sun, 2018-11-11 14:06
After changing my AWS plans from docker to kubernetes, i decided to put the aws services inside a vpc (virtual private cloud).
With this decision my AWS services are not reachable from the internet - only my laptop can access them ;-)
Here the official pictures from aws:

Here is a list of customer gateway devices, for which amazon provides configuration settings:
  • Check Point Security Gateway running R77.10 (or later) software
  • Cisco ASA running Cisco ASA 8.2 (or later) software
  • Cisco IOS running Cisco IOS 12.4 (or later) software
  • Dell SonicWALL running SonicOS 5.9 (or later) software
  • Fortinet Fortigate 40+ Series running FortiOS 4.0 (or later) software
  • Juniper J-Series running JunOS 9.5 (or later) software
  • Juniper SRX running JunOS 11.0 (or later) software
  • Juniper SSG running ScreenOS 6.1, or 6.2 (or later) software
  • Juniper ISG running ScreenOS 6.1, or 6.2 (or later) software
  • Netgate pfSense running OS 2.2.5 (or later) software.
  • Palo Alto Networks PANOS 4.1.2 (or later) software
  • Yamaha RT107e, RTX1200, RTX1210, RTX1500, RTX3000 and SRT100 routers
  • Microsoft Windows Server 2008 R2 (or later) software
  • Microsoft Windows Server 2012 R2 (or later) software
  • Zyxel Zywall Series 4.20 (or later) software for statically routed VPN connections, or 4.30 (or later) software for dynamically routed VPN connections
The following requirements have to be met:
IKE Security Association (required to exchange keys used to establish the IPsec security association)
IPsec Security Association (handles the tunnel's encryption, authentication, and so on.)
Tunnel interface (receives traffic going to and from the tunnel) Optional
BGP peering (exchanges routes between the customer gateway and the virtual private gateway) for devices that use BGP
I do not own one of these devices, but i hope that the linux laptop can configured as customer gateway with appropriate ipsec settings.

So let's configure the VPC at AWS:

 And create a subnet for this vpc:

After that you have to add a virtual private gateway:

and attach it to your vpc:

You have to add a route from the VPC to your local network:

Then create a vpn connection:

 Then download the configuration:
and hurray: AWS provides a strongswan configuration:
After i downloaded the file an followed the instructions provided there, i was able to connect and the aws dashboard showed that the connection is up:

and on my local machine:
root@zerberus:~/AWS# ipsec status
Security Associations (1 up, 0 connecting):
     Tunnel1[1]: ESTABLISHED 3 seconds ago,[XX.YY.YY.XX8]...[]
     Tunnel1{1}:  INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: cb84b8e5_i 488e669b_o
     Tunnel1{1}: ===

Docker and AWS: Is there really an AND? Moving to Kuberenetes

Sun, 2018-11-11 10:49
After my first steps into AWS i did not find a way to run docker-swarm at AWS without installing the software on my own. (take a look here). At least you have to add task definitions to your dockerfiles to let them run on ECS.
This is not really bad, but the idea was to move to a cloud provider and just run the microservices inside the cloud without caring about the infrastructure (Some people call this iaas or paas ;-) ).
But with ECS i am not convinced, that a cluster orchestrator like docker-swarm is included. Today everyone talks about kubernetes as cluster orchestrator. Last year as i read Kubernetes: Up & Running, there was a subchapter with:

But this has changed!
Amazon offer EKS:

So the next step is get a microservice with kubernetes on AWS working.
To do the docker setup once again only on servers which are running as EC2 compute nodes and not on my local virtualbox is not interesting. 

Last remark: EKS uses Kubernetes, which orchestrates Docker - so there is an AND for "Docker and AWS", AWS does not provide orchestration with docker-swarm, which was the orchestrator which i used.

AWS: Docker and AWS - creating my first EC2 compute node

Sat, 2018-11-10 22:11
My first idea after all my experiences with docker was to run my docker application with AWS.
After registration i searched for docker inside AWS and i only found this:
Hmm. Does not look like i expected. I thought, that i have just to upload my docker image and then i can select on which AWS compute nodes i want to run this image.

But let's give it a try.

First step is to install Docker on an Amazon Linux instance:

Startpoint is

At the left side in the top bar you have to choose the region, where you EC2 instance should be launched:


i choose the one with "the repositories include docker, PHP, MySQL, PostgreSQL, ..."

 You have to download the keypair. Otherwise you will not be able to connect to your machine!
And after a short time:

And here we go:
schroff@zerberus:~/AWS$ chmod 400 181111-first-aws-keypair.pem 

schroff@zerberus:~/AWS$ ssh -i 181111-first-aws-keypair.pem

       __|  __|_  )

       _|  (     /   Amazon Linux AMI


14 package(s) needed for security, out of 30 available

Run "sudo yum update" to apply all updates.

[ec2-user@ip-172-31-47-127 ~]$

Amazon Web Services: A Start into AWS

Sat, 2018-11-10 06:23
After spending a lot of time with docker / docker swarm i decided to see, how this all works by using AWS.

First step is to do the registration (only registered users have access to the AWS documentation!):

The start is

Oracle Database 18c: Installation via rpm (without

Thu, 2018-11-01 05:25
Three months after writing the post Where to find the oracle-database-ee-18c-1.0-1.x86_64.rpm package? Oracle released the rpms on their download page:

So let's give it a try.

First thing is to install the prerequisites:
# yum install oracle-database-preinstall-18c

Package Arch Version Paketquelle Größe
oracle-database-preinstall-18c x86_64 1.0-1.el7 ol7_latest 18 k
Als Abhängigkeiten installiert:
bc x86_64 1.06.95-13.el7 ol7_latest 114 k
bind-libs x86_64 32:9.9.4-61.el7 ol7_latest 1.0 M
bind-utils x86_64 32:9.9.4-61.el7 ol7_latest 204 k
compat-libcap1 x86_64 1.10-7.el7 ol7_latest 17 k
compat-libstdc++-33 x86_64 3.2.3-72.el7 ol7_latest 190 k
glibc-devel x86_64 2.17-222.el7 ol7_latest 1.1 M
glibc-headers x86_64 2.17-222.el7 ol7_latest 678 k
gssproxy x86_64 0.7.0-17.el7 ol7_latest 108 k
kernel-headers x86_64 3.10.0-862.9.1.el7 ol7_latest 7.1 M
keyutils x86_64 1.5.8-3.el7 ol7_latest 53 k
ksh x86_64 20120801-137.0.1.el7 ol7_latest 881 k
libICE x86_64 1.0.9-9.el7 ol7_latest 66 k
libSM x86_64 1.2.2-2.el7 ol7_latest 39 k
libX11 x86_64 1.6.5-1.el7 ol7_latest 606 k
libX11-common noarch 1.6.5-1.el7 ol7_latest 163 k
libXau x86_64 1.0.8-2.1.el7 ol7_latest 28 k
libXext x86_64 1.3.3-3.el7 ol7_latest 38 k
libXi x86_64 1.7.9-1.el7 ol7_latest 40 k
libXinerama x86_64 1.1.3-2.1.el7 ol7_latest 13 k
libXmu x86_64 1.1.2-2.el7 ol7_latest 70 k
libXrandr x86_64 1.5.1-2.el7 ol7_latest 27 k
libXrender x86_64 0.9.10-1.el7 ol7_latest 25 k
libXt x86_64 1.1.5-3.el7 ol7_latest 172 k
libXtst x86_64 1.2.3-1.el7 ol7_latest 20 k
libXv x86_64 1.0.11-1.el7 ol7_latest 18 k
libXxf86dga x86_64 1.1.4-2.1.el7 ol7_latest 18 k
libXxf86misc x86_64 1.0.3-7.1.el7 ol7_latest 19 k
libXxf86vm x86_64 1.1.4-1.el7 ol7_latest 17 k
libaio-devel x86_64 0.3.109-13.el7 ol7_latest 12 k
libbasicobjects x86_64 0.1.1-29.el7 ol7_latest 25 k
libcollection x86_64 0.7.0-29.el7 ol7_latest 40 k
libdmx x86_64 1.1.3-3.el7 ol7_latest 15 k
libevent x86_64 2.0.21-4.el7 ol7_latest 208 k
libini_config x86_64 1.3.1-29.el7 ol7_latest 62 k
libnfsidmap x86_64 0.25-19.el7 ol7_latest 49 k
libpath_utils x86_64 0.2.1-29.el7 ol7_latest 27 k
libref_array x86_64 0.1.5-29.el7 ol7_latest 26 k
libstdc++-devel x86_64 4.8.5-28.0.1.el7_5.1 ol7_latest 1.5 M
libtirpc x86_64 0.2.4-0.10.el7 ol7_latest 88 k
libverto-libevent x86_64 0.2.5-4.el7 ol7_latest 8.2 k
libxcb x86_64 1.12-1.el7 ol7_latest 210 k
lm_sensors-libs x86_64 3.4.0-4.20160601gitf9185e5.el7 ol7_latest 41 k
mailx x86_64 12.5-19.el7 ol7_latest 244 k
net-tools x86_64 2.0-0.22.20131004git.el7 ol7_latest 305 k
nfs-utils x86_64 1:1.3.0- ol7_latest 407 k
psmisc x86_64 22.20-15.el7 ol7_latest 140 k
quota x86_64 1:4.01-17.el7 ol7_latest 178 k
quota-nls noarch 1:4.01-17.el7 ol7_latest 90 k
rpcbind x86_64 0.2.0-44.el7 ol7_latest 59 k
smartmontools x86_64 1:6.5-1.el7 ol7_latest 460 k
sysstat x86_64 10.1.5-13.el7 ol7_latest 310 k
tcp_wrappers x86_64 7.6-77.el7 ol7_latest 78 k
unzip x86_64 6.0-19.el7 ol7_latest 169 k
xorg-x11-utils x86_64 7.5-22.el7 ol7_latest 113 k
xorg-x11-xauth x86_64 1:1.0.9-1.el7 ol7_latest 29 k
Aktualisiert für Abhängigkeiten:
libstdc++ x86_64 4.8.5-28.0.1.el7_5.1 ol7_latest 303 k

Installieren 1 Paket (+55 Abhängige Pakete)
Aktualisieren ( 1 Abhängiges Paket)
These packages are installed on a minimal Oracle Linux system.

After that i started the installation of the rpm database package:
 [root@localhost oracle]# yum install -y oracle-database-ee-18c-1.0-1.x86_64.rpm 
Geladene Plugins: ulninfo
oracle-database-ee-18c-1.0-1.x86_64.rpm wird untersucht: oracle-database-ee-18c-1.0-1.x86_64
oracle-database-ee-18c-1.0-1.x86_64.rpm wird zum Installieren markiert
Abhängigkeiten werden aufgelöst
--> Transaktionsprüfung wird ausgeführt
---> Paket oracle-database-ee-18c.x86_64 0:1.0-1 markiert, um installiert zu werden
--> Abhängigkeitsauflösung beendet

Abhängigkeiten aufgelöst

 Package                       Arch          Version       Paketquelle                                 Größe
 oracle-database-ee-18c        x86_64        1.0-1         /oracle-database-ee-18c-1.0-1.x86_64        7.8 G

Installieren  1 Paket

Gesamtgröße: 7.8 G
Installationsgröße: 7.8 G
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installieren     : oracle-database-ee-18c-1.0-1.x86_64                                                 1/1
[INFO] Executing post installation scripts...
[INFO] Oracle home installed successfully and ready to be configured.
To configure a sample Oracle Database you can execute the following service configuration script as root: /etc/init.d/oracledb_ORCLCDB-18c configure
  Überprüfung läuft: oracle-database-ee-18c-1.0-1.x86_64                                                 1/1

  oracle-database-ee-18c.x86_64 0:1.0-1                                                                     


The documentation says about the configurtion:


 [root@localhost oracle]# /etc/init.d/oracledb_ORCLCDB-18c configure
Configuring Oracle Database ORCLCDB.
DB-Vorgang vorbereiten
8 % abgeschlossen
Datenbankdateien werden kopiert
31 % abgeschlossen
Oracle-Instanz wird erstellt und gestartet
32 % abgeschlossen
36 % abgeschlossen
40 % abgeschlossen
43 % abgeschlossen
46 % abgeschlossen
Erstellen von Datenbank wird abgeschlossen
51 % abgeschlossen
54 % abgeschlossen
Integrierbare Datenbanken werden erstellt
58 % abgeschlossen
77 % abgeschlossen
Aktionen nach Abschluss der Konfiguration werden ausgeführt
100 % abgeschlossen
Erstellen der Datenbank abgeschlossen. Einzelheiten finden Sie in den Logdateien in:
Globaler Datenbankname:ORCLCDB
Weitere Einzelheiten finden Sie in der Logdatei "/opt/oracle/cfgtoollogs/dbca/ORCLCDB/ORCLCDB.log".

Database configuration completed successfully. The passwords were auto generated, you must change them by connecting to the database using 'sqlplus / as sysdba' as the oracle user.
and a last check with sqlplus:
[oracle@localhost ~]$ sqlplus / as sysdba

SQL*Plus: Release - Production on Thu Nov 1 11:21:50 2018

Copyright (c) 1982, 2018, Oracle.  All rights reserved.

Verbunden mit:
Oracle Database 18c Enterprise Edition Release - Production

SQL> set lines 200
SQL> set pages 200
SQL> select * from v$instance;

--------------- ---------------- ---------------------------------------------------------------- ----------------- ----------------- ----------------- -------- ------------ --- ---------- -------
--------------- ---------- --- ----------------- ------------------ --------- --- ---------- ----------- ------- --------------------------------------------------------------------------------
          1 ORCLCDB      localhost.localdomain                    01.11.18 OPEN          NO       1 STOPPED

If you do not want to set a database with other options, you have to skip the
/etc/init.d/oracledb_ORCLCDB-18c configure
Just run the dbca and set up the options as you want.

jconsole/visualvm/java applications without fonts over ssh forwarding (characters displayed as boxes)

Sat, 2018-10-27 15:40
On servers which run java applications sometimes you need to run jconsole or jvisualvm.
This is typically no problem - ssh -X and you are done.

But in some rare circumstances you will get something like this:


Following some other sources, you end up with tweaking xorg parameter without any success. The solution is very easy:
apt-get install ttf-dejavuAnd then: