IT Tools 2024.10.22 on AWS User Guide

Overview

This guide covers launching and using the IT Tools 2024.10.22 on Ubuntu 24.04 AMI from cloudimg on Amazon EC2. It is one version of the cloudimg developer and API tools listing on AWS Marketplace; you pick it as the software version when you subscribe and launch.

IT Tools is an open source collection of about 80 handy utilities for developers and people working in IT: token, UUID, ULID and hash generators, bcrypt and HMAC, encrypt and decrypt, base64 and URL encoders, date, number base and colour converters, JSON, YAML and TOML tools, a crontab helper, IPv4 subnet and range calculators, and many more. Every tool runs entirely in your browser as a client side Vue application: what you paste in is processed on the page and is never sent to the server. There is no backend, no database and nothing to keep running except a web server.

Upstream IT Tools is a public web page with no login. The cloudimg image turns that into a private tool box for your team:

• HTTPS from the first boot. nginx serves IT Tools on port 443 with a certificate generated on your instance's first boot. Port 80 redirects to HTTPS.
• A password unique to your instance. HTTP Basic Auth is required for the user admin. The password is generated on first boot and written to /var/lib/cloudimg/it-tools-credentials.txt (root only); nginx stores only a bcrypt hash of it. No password is baked into the image.
• Fail closed. nginx refuses to start until first boot has generated the certificate and the password, so the tools are never served without a login.
• Hardened defaults. Requests for any host name the instance does not serve are dropped, only GET and HEAD are accepted, cross site requests are refused, nginx is blocked from the instance metadata service and the AMI requires IMDSv2.
• No build toolchain on the image. IT Tools is built from the pinned upstream release with its own lockfile; Node.js and the compilers used for the build are removed again, so only the static files and nginx ship.
• Fully patched Ubuntu 24.04 LTS at build time, with unattended security upgrades switched on.

What is on the image: IT Tools 2024.10.22 (the static build in /var/www/it-tools, with the unmodified source in /usr/share/it-tools), nginx, Ubuntu 24.04 LTS, cloud-init and the AWS Systems Manager agent.

Default user: ubuntu · Architecture: x86_64 · Recommended instance type: m5.large

Prerequisites

• An AWS account subscribed to the listing, an EC2 key pair and a VPC subnet with a route to the internet (or a private route you use for management).
• A security group that allows TCP 22 (SSH), TCP 443 (IT Tools) and TCP 80 (redirects to HTTPS) from your own networks only.

Step 1: Launch the instance

In the AWS Marketplace listing choose Continue to Subscribe, then Continue to Configuration, pick IT Tools 2024.10.22 on Ubuntu 24.04 as the software version and your Region, then Launch through EC2. Choose m5.large (IT Tools itself needs very little, because the tools run in your users' browsers), your key pair, and a security group as above.

With the AWS CLI (replace the values in angle brackets):

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=it-tools}]'

Step 2: Connect to your instance

ssh -i <your-key.pem> ubuntu@<public-ip>

Step 3: Check the services

First boot generates the certificate and the password, then nginx starts:

systemctl is-active nginx it-tools-firstboot
sudo test -f /var/lib/cloudimg/it-tools-firstboot.done && echo FIRSTBOOT_DONE

Both units are active and the first boot marker is present:

active
active
FIRSTBOOT_DONE

Only SSH and nginx listen on the network:

sudo ss -lntp | awk 'NR>1 {print $4, $6}' | grep -v '127.0.0.5' | sort

0.0.0.0:22 users:(("sshd",...))
0.0.0.0:443 users:(("nginx",...))
0.0.0.0:80 users:(("nginx",...))
[::]:22 users:(("sshd",...))
[::]:443 users:(("nginx",...))
[::]:80 users:(("nginx",...))

Step 4: Get your URL and password

sudo cat /var/lib/cloudimg/it-tools-credentials.txt

The file is readable by root only and holds the URL, the user name and this instance's password:

IT_TOOLS_URL=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/
IT_TOOLS_USERNAME=admin
IT_TOOLS_PASSWORD=<IT_TOOLS_PASSWORD>

The URL uses the instance's public DNS name from EC2 instance metadata. The certificate also names the public and private IP addresses, so https://<public-ip>/ works too. To serve IT Tools under your own DNS name, see Step 8.

Step 5: Sign in from your browser

Open the IT_TOOLS_URL in your browser. The certificate is self signed, so your browser asks you to confirm it the first time (or install your own certificate, Step 8). Sign in as admin with the password from Step 4. The browser remembers the login for the session.

The home page lists every tool as a card, grouped in the menu on the left (Crypto, Converter, Web, Images and videos, Development, Network, Math, Measurement, Text, Data). Use the search box (Cmd+K or Ctrl+K) to jump to a tool, and the heart on a card to pin your favourites to the top:

Step 6: Use the tools

Token generator builds random strings from the character sets you choose, at any length up to 512. Use it for API keys, passwords and test data; the string is generated in your browser:

Hash text computes MD5, SHA1, SHA256, SHA224, SHA512, SHA384, SHA3 and RIPEMD160 of whatever you type, in hexadecimal, base64 or binary. Here the SHA256 of hello is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824, as expected:

IPv4 subnet calculator takes an address with a mask and shows the network and broadcast addresses, the netmask in decimal and binary, the wildcard mask, the size and the first and last usable addresses, with buttons to step to the previous and next block. Useful when you plan VPC subnets:

Every tool has its own address, so you can bookmark or share a link such as https://<your-host>/uuid-generator or https://<your-host>/crontab-generator with your team (they sign in with the same password).

Step 7: Check the security posture from the command line

Without a login the tools are refused, port 80 redirects to HTTPS, the health check stays open for load balancers, and a request for a host name the instance does not serve is dropped without an answer:

H=$(sudo grep '^IT_TOOLS_URL=' /var/lib/cloudimg/it-tools-credentials.txt | sed -E 's#^IT_TOOLS_URL=https://([^/]+)/.*#\1#')
curl -s -o /dev/null -w 'http://  -> %{http_code} %{redirect_url}\n' --resolve "$H:80:127.0.0.1" "http://$H/"
curl -sk -o /dev/null -w 'no login -> HTTP %{http_code}\n' --resolve "$H:443:127.0.0.1" "https://$H/"
curl -sk -o /dev/null -w 'health -> HTTP %{http_code}\n' --resolve "$H:443:127.0.0.1" "https://$H/health"
curl -sk -o /dev/null -w 'unknown host -> %{http_code}\n' --resolve "evil.example:443:127.0.0.1" "https://evil.example/" || true
curl -sk --resolve "$H:443:127.0.0.1" "https://$H/" | grep -o '401 Authorization Required'

http://  -> 301 https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/
no login -> HTTP 401
health -> HTTP 200
unknown host -> 000
401 Authorization Required

000 means nginx closed the connection without answering, which is how it treats any host name it does not serve.

With the password, IT Tools is served. The password is passed to curl on standard input, so it never appears in the process list or your shell history:

sudo bash -c '
  F=/var/lib/cloudimg/it-tools-credentials.txt
  P=$(grep "^IT_TOOLS_PASSWORD=" $F | cut -d= -f2-)
  H=$(grep "^IT_TOOLS_URL=" $F | sed -E "s#^IT_TOOLS_URL=https://([^/]+)/.*#\1#")
  auth() { printf "user = \"admin:%s\"\n" "$P"; }
  auth | curl -K - -sk --resolve "$H:443:127.0.0.1" -o /dev/null -w "with login -> HTTP %{http_code}\n" "https://$H/"
  auth | curl -K - -sk --resolve "$H:443:127.0.0.1" "https://$H/" | grep -o "<title>[^<]*</title>"
'

with login -> HTTP 200
<title>IT Tools - Handy online tools for developers</title>

nginx keeps only a bcrypt hash of the password; the plain text is in the root only credentials file:

sudo sed -E 's/\$2y\$12\$.*/$2y$12$<bcrypt-hash>/' /etc/nginx/.it-tools-htpasswd
sudo stat -c '%a %U:%G %n' /etc/nginx/.it-tools-htpasswd /var/lib/cloudimg/it-tools-credentials.txt

admin:$2y$12$<bcrypt-hash>
640 root:www-data /etc/nginx/.it-tools-htpasswd
600 root:root /var/lib/cloudimg/it-tools-credentials.txt

The certificate was generated on this instance and names its own addresses:

H=$(sudo grep '^IT_TOOLS_URL=' /var/lib/cloudimg/it-tools-credentials.txt | sed -E 's#^IT_TOOLS_URL=https://([^/]+)/.*#\1#')
echo | openssl s_client -connect 127.0.0.1:443 -servername "$H" 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

subject=CN = ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, O = cloudimg
X509v3 Subject Alternative Name:
    DNS:ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, IP Address:<public-ip>, IP Address:<private-ip>, IP Address:127.0.0.1, DNS:localhost

nginx cannot reach the instance metadata service, and it will not start until first boot has finished:

systemctl show nginx -p IPAddressDeny | grep 169.254.169.254
systemctl cat nginx | grep -E '^ExecStartPre=/usr/bin/test'

IPAddressDeny=fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32
ExecStartPre=/usr/bin/test -f /var/lib/cloudimg/it-tools-firstboot.done
ExecStartPre=/usr/bin/test -s /etc/nginx/.it-tools-htpasswd

nginx also refuses a request whose Origin is another web site (HTTP 403), because browsers resend Basic Auth credentials on cross site requests:

H=$(sudo grep '^IT_TOOLS_URL=' /var/lib/cloudimg/it-tools-credentials.txt | sed -E 's#^IT_TOOLS_URL=https://([^/]+)/.*#\1#')
curl -sk --resolve "$H:443:127.0.0.1" -H 'Origin: https://evil.example' -d x=1 "https://$H/" | grep -o '403 Forbidden'

403 Forbidden

Step 8: Your own DNS name and certificate

Point a DNS record at the instance, then set the name IT Tools is served as. This mints a new self signed certificate for the name, updates nginx and the URL in the credentials file, and keeps the name across reboots:

sudo it-tools-set-hostname <your-domain>

To use a certificate from your own certificate authority instead, copy it over the generated pair and reload nginx (running it-tools-set-hostname again replaces it with a self signed one):

sudo install -m 0644 <your-domain>.crt /etc/ssl/it-tools/it-tools.crt
sudo install -m 0600 <your-domain>.key /etc/ssl/it-tools/it-tools.key
sudo nginx -t && sudo systemctl reload nginx

Step 9: Change the password or add users

The login is an nginx Basic Auth file. To set a new password for admin, hand it to htpasswd on standard input (printf is a shell builtin, so the password never appears in the process list; start the line with a space so most shells keep it out of your history), then reload nginx:

 printf '%s\n' '<new-password>' | sudo htpasswd -i -B -C 12 /etc/nginx/.it-tools-htpasswd admin
sudo systemctl reload nginx

Running sudo htpasswd -B -C 12 /etc/nginx/.it-tools-htpasswd <user> without -i prompts for the password instead. Use it with another user name to give a colleague their own login, and sudo htpasswd -D /etc/nginx/.it-tools-htpasswd <user> to remove one. Then update or delete IT_TOOLS_PASSWORD in /var/lib/cloudimg/it-tools-credentials.txt so it does not hold an old password.

Step 10: Server components

ls -l /usr/share/it-tools/ | awk 'NR>1{print $1,$5,$9}'
command -v node || echo "no node runtime"
nginx -v 2>&1

-rw-r--r-- 35148 LICENSE
-rw-r--r-- 541 README.source.txt
-rw-r--r-- 684344 it-tools-v2024.10.22-7ca5933-source.tar.gz
no node runtime
nginx version: nginx/1.24.0 (Ubuntu)

Step 11: Security recommendations

• Allow ports 22, 80 and 443 in the security group from your own networks only.
• Keep the per instance password secret, and rotate it if it may have been shared (Step 9).
• Use your own DNS name and a certificate your clients trust (Step 8).
• Keep the operating system patched; unattended security upgrades are on, and sudo apt-get update && sudo apt-get upgrade applies everything else.

Support and licensing

IT Tools is open source under the GNU General Public License v3.0; there is no per user or per CPU licence fee. The complete, unmodified source of the version on the image is in /usr/share/it-tools/. The AMI price covers cloudimg's hardening, first boot setup and support.

• Email: support@cloudimg.co.uk
• Website: https://www.cloudimg.co.uk
• Support: 24/7, with a 24 hour response SLA