1

I've created a simple micro EC2 instance based on Amazon Linux AMI for testing an app while I develop it, but it happens that every day it stops answering giving me error 503. It have it's own domain set with Cloudfront.

On AWS the instance appears as green and "running" but even the connection via SSH is not possible until I stop and start it again (also the instance reboot option simply does nothing).

When I check for HTTPD logs I see a big list of what appears to be bot attempts to find vulnerable pages:

[Wed May 22 08:10:17.996810 2019] [:error] [pid 26550] [client ...] script '/var/www/html/pop.php' not found or unable to stat
[Wed May 22 08:10:21.276648 2019] [:error] [pid 26550] [client ...] script '/var/www/html/ok.php' not found or unable to stat
[Wed May 22 08:10:21.454696 2019] [:error] [pid 26550] [client ...] script '/var/www/html/test.php' not found or unable to stat
[Wed May 22 08:10:21.641293 2019] [:error] [pid 26550] [client ...] script '/var/www/html/conf.php' not found or unable to stat
[Wed May 22 08:10:22.187275 2019] [:error] [pid 26550] [client ...] script '/var/www/html/dashu.php' not found or unable to stat
...

Do anyone know of a simple solution to avoid that and have this simple test server working without having to restart it every day?

ThyagoTC
  • 13
  • 3

2 Answers2

2

While you are developing you can restrict access to the instance only to your IP address(es) - set them in the instance Security Group. That will prevent access from anyone else but you.

On the other hand the instance shouldn't be failing just because it gets a few random requests. There may be a problem with your code - memory leak perhaps? Now is a good time to fix it, as you're still in the development stage as you say.

Hope that helps :)

MLu
  • 24,849
  • 5
  • 59
  • 86
  • Thanks MLu. Unfortunately I need to leave it open as I'm not the only one testing it. Strangely, I've changed the instance from Micro to Small, and even checking in the logs that the bot is still scanning it, it is now holding fine. Another thing I tried while having a Micro instance was to remove the entire code from the accessible folder, so the bot scan was only receiving answers of not found files, but even like that the server was crashing. So I guess is not a memory leak but some sort of "protection"... :( – ThyagoTC May 23 '19 at 12:48
0

If you have CloudFront already enabled you could add WAF protection although it seems overkill for this use-case. You could also try using NGINX instead of Apache which is going to be lighter-weight and therefore less likely to run out of resources.

Does CloudWatch yield any insights into why it is crashing? Perhaps you can identify what resource is being exhausted. It may be number of connections or a bandwidth issue as opposed to memory or CPU.

Another option would be using CloudFlare instead of CloudFront which should give better anti-bot protection out of the box and cheaper.

hellomynameisjoel
  • 2,172
  • 2
  • 18
  • 23
  • Thank you very much Joel, you gave me a lot of alternatives. I will start checking CloudFlare. If it doesn't solve, I will change to NGINX. CloudWatch is not giving me any tip, processor and network packets are low, but there is no information about memory for Linux instances and I guess that is the problem. – ThyagoTC May 25 '19 at 10:49