Creating Amazon AMI 2023 Hyper-V Instances

Step-by-Step Guide

Creating a Hyper-V instance running Amazon Machine Image (AMI) 2023 involves several detailed steps. This guide provides a detailed walkthrough for creating a Hyper-V instance running Amazon Machine Image (AMI) 2023. It outlines the necessary prerequisites, steps for downloading the AMI image, configuring the instance, and additional security measures.

• Prerequisites for Setup: Users need access to an AWS account, a configured Hyper-V on their Windows machine, and the PowerISO tool to create an ISO file. 
• Downloading AMI 2023 Image: The Amazon Linux 2023 disk images can be downloaded from cdn.amazonlinux.com. 
• Creating Cloud-Init Configuration: Users must create a NoCloud (seed.iso) cloud-init configuration to set up the instance and add users. This involves creating USER-DATA and META-DATA. 
• Setting Up the Virtual Machine: The guide specifies steps to create a new virtual machine in Hyper-V, including naming, memory allocation, and networking configuration. 
• Starting the Virtual Machine: Users are instructed on how to start the virtual machine and log in using the credentials set up in the seed.iso file. 
• Post-Setup Security Configuration: The document advises on enabling password authentication for SSH, detaching the seed.iso, and setting the hostname. 
  

Before beginning, ensure you have the following:

• Access to an AWS account.
• Hyper-V is enabled on your Windows machine and fully configured.
• Hyper-V Instance Requirements: https://docs.aws.amazon.com/linux/al2023/ug/hyperv-supported-configurations.html
• PowerISO – you can use the eval version as your ISO we will be creating is only around 2.25MB
  

• Using Notepad ++ or Notepad create a file named META-DATA with the following text (Note the file does not have an extension)

Make sure to replace InstanceName with the name you want the Instance to have. If you want to setup static IPs, uncomment the IP Sections

local-hostname: InstanceName

# eth0 is the default network interface enabled in the image. You can configure

# static network settings with an entry like below.

#network-interfaces: |

# iface eth0 inet static

# address 192.168.0.10

# network 192.168.0.0

# netmask 255.255.255.0

# broadcast 192.168.0.255

# gateway 192.168.0.1

• For example, mine looks like, because I will be using DHCP to assign IP:
  

• Copy those two files META-DATA and USER-DATA into the CD by dragging and dropping them in the root of the CD or using the add files. It should look like this:
  

• Open File > Image properties
  

• Set Label to cidata
  

• Click on More Labels … and set the Volume Set ID to cidata
  

• Set the following settings:
• CD/DVD File System to ISO 9660, RockRidge, and Joliet
• ISO9660 File name to DOS(8.3)
• Joliet File Name to Standard(64)
  

• Hit Save and save it as seed.iso
  

• Select Generation 2

• Assign the memory to the virtual machine.
• Min recommended is 2GB, but in my case I am doing 1.5Gb as it will only be running apache

• Configure networking by connecting to the appropriate virtual switch.

• Select Attach Virtual Hard Disk Later

• Click Finish to complete the wizard.

• Add a Hard Drive
• Select SCSI Controller
• Hard Drive
• Add
  

• Browse to the VHDX file you copied into the Virtual Hard Disks in Step 4
  

• Add a DVD Drive
• Select SCSI Controller
• DVD Drive
• Add
  

• Change the location to 2 (or any unused one)
• Select the seed.iso you created above
  

• Set boot order where DVD is first and Hard Drive is second

• Disable Secure Boot

• Click Apply and then OK to save the changes.

By default, Amazon Linux 2023 (AMI 2023) disables password authentication over SSH for security reasons. It only allows key-based authentication. But you can enable password authentication if needed.

⚠️ Before you begin:

Make sure you understand the security implications—password auth is less secure than SSH keys, especially if you’re using weak passwords or exposing the instance to the internet.

🔥 Security note: Enabling password authentication is not recommended in production without strong passwords and a firewall in place.

Steps to enable password authentication in SSH:

• From the Hyper-V Connect window, log into the instance using the credentials provided in the seed.iso file
• Edit the SSH config file:
• sudo nano /etc/ssh/sshd_config
• Find and update (or add) these lines:
• PasswordAuthentication yes
• PermitRootLogin yes   # optional: only if you want root login
• Remember to remove the leading # if you want it to be active
• To save changes hit CTRL+O and then enter to commit the changes to the file
• To Exit nano, CTRL+X, but make sure to save before you exit if you want to commit the changes
• Restart SSH
• sudo systemctl restart sshd
  

Linux Baseline

1. Install AV and Baseline monitoring tools

2. Run these two commands:

a. To disable ICMP (ping):

echo -e "\n# sysctl -w net.ipv4.conf.all.accept_redirects=0

sysctl -w net.ipv4.conf.default.accept_redirects=0

sysctl -w net.ipv4.conf.all.secure_redirects=0

sysctl -w net.ipv4.conf.default.secure_redirects=0" | sudo tee -a /etc/sysctl.conf

b. This script updates /etc/securetty to define which terminal devices the root user is allowed to log in from, enabling access on certain virtual consoles and TTYs while commenting out others:

sudo echo -e 'console\nvc/1\nvc/2\nvc/3\nvc/4\nvc/5\nvc/6\nvc/7\nvc/8\nvc/9\n# vc/10\n# vc/11\ntty1\ntty2\ntty3\ntty4\ntty5\ntty6\ntty7\ntty8\ntty9\n# tty10\n# tty11\n# ttyS0\n# ttysclp0\n# sclp_line0\n# 3270/tty1\n# hvc0\n# hvc1\n# hvc2\n# hvc3\n# hvc4\n# hvc5\n# hvc6\n# hvc7\n# hvsi0\n# hvsi1\n# hvsi2\n# xvc0' | sudo tee /etc/securetty

3. Remove weak ciphers

a. To remove weak ciphers from AMI 2023, you'll need to modify the sshd_config file on your AMI 2023 instance to disable specific ciphers. This involves editing the ciphers section within the sshd_config file and removing any weak or outdated ciphers.

By following the steps outlined in this guide, you should be able to successfully create and run a Hyper-V instance using Amazon AMI 2023. This setup will allow you to take advantage of Hyper-V’s powerful virtualization capabilities while utilizing the robust features provided by AMI 2023.