Yum repositories don't work unless there are exceptions in the AWS firewall. How do I make the exceptions based on a DNS name?

Question

When I try to install something via yum (e.g., yum install java), I get the following:

Could not contact CDS load balancer rhui2-cds01.us-west-2.aws.ce.redhat.com, trying others.

Could not contact any CDS load balancers: rhui2-cds01.us-west-2.aws.ce.redhat.com, rhui2-cds02.us-west-2.aws.ce.redhat.com.

Earlier today I installed various yum packages. This evening I tried several, but none worked.

This link explains that certain firewall rules need to be made: https://access.redhat.com/solutions/11214

I don't have an explanation why all Yum install commands were working earlier today. Several different ones later stopped working. Here is the solution: via the AWS console, I opened all traffic over port 443 (inbound and outbound traffic).

This isn't an ideal solution or a permanent solution. The security groups in the AWS console only permit filtering based on IP addresses and IP address ranges. DNS names aren't part of the filtering.

Using AWS, how can I open port 443 and port 80 to specific DNS names?

Answer 1

On AWS Amazon Web Services, make sure you are the 'root' user and not ec2-user.

Type:

sudo su - root

This fixed my problem.

Answer 2

Try sudo yum install ...

That worked for me without doing any extra firewall changes.

Answer 3

You want to defend against INBOUND traffic and can generally leave your OUTBOUND rules open. AWS Security Groups are a stateful firewall, so if a VM establishes a connection (e.g. to a yum repo), the return traffic will be automatically allowed.

You can test this by opening up your OUTBOUND rules and closing off your INBOUND rules to only allow your SSH connection. The yum commands will work assuming you're not being blocked by a VPC Network ACL.

Answer 4

On AWS Amazon Web Services , can you try to ping yahoo.com ? if you get unknown hosts.

I got the same issue,i resolved it as follow , you can have a try.

you need config the dns resolver. 1.vi /etc/resolv.conf; 2.add one row nameserver 8.8.8.8