IT Tools 2024.10.22

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick IT Tools 2024.10.22 on Ubuntu 24.04 as the software version, choose your Region, and select Launch through EC2.

Choose m5.large, your key pair, and a security group as described above. IT Tools itself needs very little, because the tools run in your users' browsers.

To launch with the AWS CLI instead, replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=it-tools}]'

The SSH user for IT Tools 2024.10.22 on Ubuntu 24.04 is ubuntu.

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot generates the certificate and the password, and then nginx starts:

systemctl is-active nginx it-tools-firstboot
sudo test -f /var/lib/sac/data/it-tools-firstboot.done && echo FIRSTBOOT_DONE

Both units are active and the first-boot marker is present:

active active FIRSTBOOT_DONE

Only SSH and nginx listen on the network:

sudo ss -lntp | awk 'NR>1 {print $4, $6}' | grep -v '127.0.0.5' | sort

0.0.0.0:22 users:(("sshd",...)) 0.0.0.0:443 users:(("nginx",...)) 0.0.0.0:80 users:(("nginx",...)) [::]:22 users:(("sshd",...)) [::]:443 users:(("nginx",...)) [::]:80 users:(("nginx",...))

Read the credentials file:

sudo cat /var/lib/sac/data/it-tools-credentials.txt

Only root can read the file. It holds the URL, the user name and this instance's password:

IT_TOOLS_URL=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/ IT_TOOLS_USERNAME=admin IT_TOOLS_PASSWORD=<IT_TOOLS_PASSWORD>

The URL uses the instance's public DNS name from EC2 instance metadata. The certificate also names the public and private IP addresses, so https://<public-ip>/ works too.

To serve IT Tools under your own DNS name, see Step 8.

Open the IT_TOOLS_URL in your browser. The certificate is self-signed, so your browser asks you to confirm it the first time. Alternatively, install your own certificate (Step 8).

Sign in as admin with the password from Step 4. The browser remembers the login for the session.

The home page lists every tool as a card, grouped in the menu on the left (Crypto, Converter, Web, Images and videos, Development, Network, Math, Measurement, Text, Data). Use the search box (Cmd+K or Ctrl+K) to jump to a tool. Select the heart on a card to pin your favourites to the top:

Token generator builds random strings from the character sets you choose, at any length up to 512. Use it for API keys, passwords and test data. The string is generated in your browser:

Hash text computes MD5, SHA1, SHA256, SHA224, SHA512, SHA384, SHA3 and RIPEMD160 of whatever you type, in hexadecimal, base64 or binary. Here, the SHA256 of hello is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824, as expected:

IPv4 subnet calculator takes an address with a mask. It shows the network and broadcast addresses, the netmask in decimal and binary, the wildcard mask, the size, and the first and last usable addresses. Buttons let you step to the previous and next block. It is useful when you plan VPC subnets:

Every tool has its own address, so you can bookmark a link such as https://<your-host>/uuid-generator or https://<your-host>/crontab-generator, or share it with your team. They sign in with the same password.

Without a login, the tools are refused. Port 80 redirects to HTTPS, and the health check stays open for load balancers. A request for a host name that the instance does not serve is dropped without an answer:

H=$(sudo grep '^IT_TOOLS_URL=' /var/lib/sac/data/it-tools-credentials.txt | sed -E 's#^IT_TOOLS_URL=https://([^/]+)/.*#\1#')
curl -s -o /dev/null -w 'http:// -> %{http_code} %{redirect_url}\n' --resolve "$H:80:127.0.0.1" "http://$H/"
curl -sk -o /dev/null -w 'no login -> HTTP %{http_code}\n' --resolve "$H:443:127.0.0.1" "https://$H/"
curl -sk -o /dev/null -w 'health -> HTTP %{http_code}\n' --resolve "$H:443:127.0.0.1" "https://$H/health"
curl -sk -o /dev/null -w 'unknown host -> %{http_code}\n' --resolve "evil.example:443:127.0.0.1" "https://evil.example/" || true
curl -sk --resolve "$H:443:127.0.0.1" "https://$H/" | grep -o '401 Authorization Required'

http:// -> 301 https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/ no login -> HTTP 401 health -> HTTP 200 unknown host -> 000 401 Authorization Required

000 means that nginx closed the connection without answering, which is how it treats any host name that it does not serve.

With the password, IT Tools is served. The password is passed to curl on standard input, so it never appears in the process list or your shell history:

sudo bash -c ' F=/var/lib/sac/data/it-tools-credentials.txt P=$(grep "^IT_TOOLS_PASSWORD=" $F | cut -d= -f2-) H=$(grep "^IT_TOOLS_URL=" $F | sed -E "s#^IT_TOOLS_URL=https://([^/]+)/.*#\1#") auth() { printf "user = \"admin:%s\"\n" "$P"; } auth | curl -K - -sk --resolve "$H:443:127.0.0.1" -o /dev/null -w "with login -> HTTP %{http_code}\n" "https://$H/" auth | curl -K - -sk --resolve "$H:443:127.0.0.1" "https://$H/" | grep -o "<title>[^<]*</title>" '

with login -> HTTP 200 <title>IT Tools - Handy online tools for developers</title>

nginx keeps only a bcrypt hash of the password. The plain text is in the root-only credentials file:

sudo sed -E 's/\$2y\$12\$.*/$2y$12$<bcrypt-hash>/' /etc/nginx/.it-tools-htpasswd
sudo stat -c '%a %U:%G %n' /etc/nginx/.it-tools-htpasswd /var/lib/sac/data/it-tools-credentials.txt

admin:$2y$12$<bcrypt-hash> 640 root:www-data /etc/nginx/.it-tools-htpasswd 600 root:root /var/lib/sac/data/it-tools-credentials.txt

The certificate was generated on this instance and names its own addresses:

H=$(sudo grep '^IT_TOOLS_URL=' /var/lib/sac/data/it-tools-credentials.txt | sed -E 's#^IT_TOOLS_URL=https://([^/]+)/.*#\1#')
echo | openssl s_client -connect 127.0.0.1:443 -servername "$H" 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

subject=CN = ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, O = sac X509v3 Subject Alternative Name: DNS:ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, IP Address:<public-ip>, IP Address:<private-ip>, IP Address:127.0.0.1, DNS:localhost

nginx cannot reach the instance metadata service, and it does not start until first boot has finished:

systemctl show nginx -p IPAddressDeny | grep 169.254.169.254
systemctl cat nginx | grep -E '^ExecStartPre=/usr/bin/test'

IPAddressDeny=fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32 ExecStartPre=/usr/bin/test -f /var/lib/sac/data/it-tools-firstboot.done ExecStartPre=/usr/bin/test -s /etc/nginx/.it-tools-htpasswd

nginx also refuses a request whose Origin is another web site (HTTP 403), because browsers resend Basic Auth credentials on cross-site requests:

H=$(sudo grep '^IT_TOOLS_URL=' /var/lib/sac/data/it-tools-credentials.txt | sed -E 's#^IT_TOOLS_URL=https://([^/]+)/.*#\1#')
curl -sk --resolve "$H:443:127.0.0.1" -H 'Origin: https://evil.example' -d x=1 "https://$H/" | grep -o '403 Forbidden'

403 Forbidden

Point a DNS record at the instance, then set the name that IT Tools is served as. The command below creates a new self-signed certificate for the name, updates nginx and the URL in the credentials file, and keeps the name across reboots:

sudo it-tools-set-hostname <your-domain>

To use a certificate from your own certificate authority instead, copy it over the generated pair and reload nginx. Running it-tools-set-hostname again replaces it with a self-signed one:

sudo install -m 0644 <your-domain>.crt /etc/ssl/it-tools/it-tools.crt
sudo install -m 0600 <your-domain>.key /etc/ssl/it-tools/it-tools.key
sudo nginx -t && sudo systemctl reload nginx

The login is an nginx Basic Auth file. To set a new password for admin, hand it to htpasswd on standard input, then reload nginx.

printf is a shell builtin, so the password never appears in the process list. Start the line with a space, so that most shells keep it out of your history:

printf '%s\n' '<new-password>' | sudo htpasswd -i -B -C 12 /etc/nginx/.it-tools-htpasswd admin
sudo systemctl reload nginx

Running sudo htpasswd -B -C 12 /etc/nginx/.it-tools-htpasswd <user> without -i prompts for the password instead. Use it with another user name to give a colleague their own login. Use sudo htpasswd -D /etc/nginx/.it-tools-htpasswd <user> to remove a user.

Then update or delete IT_TOOLS_PASSWORD in /var/lib/sac/data/it-tools-credentials.txt, so that it does not hold an old password.

• IT Tools static build: /var/www/it-tools
• Unmodified source and licence: /usr/share/it-tools/
• nginx site: /etc/nginx/sites-available/sac-it-tools
• Basic Auth file: /etc/nginx/.it-tools-htpasswd (bcrypt)
• Certificate and key: /etc/ssl/it-tools/
• First boot script: /usr/local/sbin/it-tools-firstboot.sh
• Host name helper: /usr/local/sbin/it-tools-set-hostname
• Credentials: /var/lib/sac/data/it-tools-credentials.txt (mode 0600)

ls -l /usr/share/it-tools/ | awk 'NR>1{print $1,$5,$9}' command -v node || echo "no node runtime" nginx -v 2>&1

-rw-r--r-- 35148 LICENSE -rw-r--r-- 541 README.source.txt -rw-r--r-- 684344 it-tools-v2024.10.22-7ca5933-source.tar.gz no node runtime nginx version: nginx/1.24.0 (Ubuntu)

• Allow ports 22, 80 and 443 in the security group from your own networks only.
• Keep the per-instance password secret, and rotate it if it may have been shared (Step 9).
• Use your own DNS name and a certificate your clients trust (Step 8).
• Keep the operating system patched. Unattended security upgrades are on, and sudo apt-get update && sudo apt-get upgrade applies everything else.