Redirecting a custom domain to a website hosted at AWS S3 with CloudFront

One of my friend was having a bit hard time in redircting a custom domain to website hosted hosted at AWS S3 with CloudFront. Then I was helping him with possible options and decided to write an article with my suggestions.

If you are new to webhosting with S3, you may refer the URLs given as references.

To stard with possible DNS records to be configured to direct your URL to web hosting server at the Domain Name service provider i.e. GoDaddy, 123-Reg

A Records:

A Records are the most basic type of DNS record and are used to point a domain or subdomain to an IP address. Assigning a value to an A record is as simple as providing your DNS management panel with an IP address to where the domain or subdomain should point and a TTL.

CNAME:

CNAME records can be used to alias one name to another. CNAME stands for Canonical Name. A common example is when you have both example.com and www.example.com pointing to the same application and hosted by the same server. In this case, to avoid maintaining two different records, it’s common to create:

    An A record for example.com pointing to the server IP address
    A CNAME record for www.example.com pointing to example.com

As a result, example.com points to the server IP address, and www.example.com points to the same address via example.com. Should the IP address change, you only need to update it in one place: just edit the A record for example.com, and www.example.com automatically inherits the changes.

What is CloudFront?

Amazon CloudFront is a web service that speeds up distribution of your static and dynamic web content, such as .html, .css, .js, and image files, to your users. CloudFront delivers your content through a worldwide network of data centers called edge locations. When a user requests content that you're serving with CloudFront, the user is routed to the edge location that provides the lowest latency (time delay), so that content is delivered with the best possible performance.

My friend had purchased a custom domain (Let's assume "www.example.com") from 123-Reg and he wanted to redirect www.example.com and example.com both to a website hosted at AWS S3. He had already configured CloudFront and let's assume his clourd front URL is as d4k69jpeqpexyz.cloudfront.net.

In CloudFront, an alternate domain name, also known as a CNAME, lets use the custom domain name (www.example.com) for links to files instead of using the domain name that CloudFront assigns to the distribution (d4k69jpeqpexyz.cloudfront.net

). Both web and RTMP distributions support alternate domain names.

When you use the CloudFront domain name for your files, the URL for a file called /images/image.jpg is:

http://d4k69jpeqpexyz.cloudfront.net/images/image.jpg

If you want to use your own domain name www.example.com, instead of the cloudfront.net domain name, you can add an alternate domain name to your distribution, like www.example.com. You can then use the following URL to view /images/image.jpg:

http://www.example.com/images/image.jpg

However you will not be able to configure alternative domain name as example.com. You can only configure it as www.example.com. Then you will face the same problem as my friend did.

Once the cloudfront configuration is ready, we need to configure the DNS record at DNS provider.  In our case 123-reg.

Using the DNS provider's tools, (123-reg in our case) we created a CNAME record to map www.example.com to d4k69jpeqpexyz.cloudfront.net

The CNAME is the only thing we needed if we wanted www.example.com. Unfortunately as most people do, we wanted "example.com" to work so we need another step.

example.com is often referred to as a naked domain or the apex record of the domain. The reason it's a problem is that it can't be a CNAME. CNAMEs only work on subdomains like "www." This makes it is difficult to point as a subdomain.

The remaining approach was to use a service to automatically redirect any request going to example.com to point to www.example.com. This picks up the CNAME record and the site will be served from CloudFront.

The automatic redirect is not possible with plain old DNS so we used another service. Some DNS providers offer this service along with their DNS (godaddy does, 123-reg does not.)

When the DNS provider doesn't do it, there are a few free services. One that We've used is http://wwwizer.com/naked-domain-redirect - it doesn't require any registration or payment.

To use this type of service, we need to create a DNS "A" record for the naked domain "example.com". For the wwwizer.com service, we needed to create an A record to point example.com to 174.129.25.170. That's all!

So, with this setup, if a user types example.com into their browser, the following would happen:

    DNS query: example.com -> 174.129.25.170 (wwwizer.com's service)
    HTTP request to 174.129.25.170 for example.com
    174.129.25.170 redirects example.com -> www.example.com
    DNS query: www.example.com -> CNAME to d4k69jpeqpexyz.cloudfront.net
    DNS query: d4k69jpeqpexyz.cloudfront.net -> points to Amazon S3
    HTTP request for www.example.com is now served by Amazon S3

Reference:
Web hosting with S3: https://medium.com/@kyle.galbraith/how-to-host-a-website-on-s3-without-getting-lost-in-the-sea-e2b82aa6cd38
Record Types: https://kb.pressable.com/article/dns-record-types-explained/
Configure DNS with GoDaddy: https://www.godaddy.com/garage/configuring-and-working-with-domains-dns/
CloudFront: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html
Configure CloudFront: https://medium.com/@kyle.galbraith/how-to-make-use-of-cloudfront-for-secure-delivery-of-static-websites-to-the-world-d2f54e8b096

Read More

Run SNMPWALK on CISCO Switch from Ubuntu Desktop

To check the SNMP agent status of the targeted switch. A remote connection or terminal session is required for the Switch to configure SNMP.

Switch# show snmp

When the SNMP agent is not enabled.

Switch# configure terminal
Switch (Config)# snmp-server enable traps
Switch (Config)# snmp-server community public ro    //ro - read-only
Switch (Config)# snmp-server community private rw    //rw - read-write
Switch (Config)# snmp-server location myoffice-location   
Switch (Config)# snmp-server contact myoffice-contact
Switch (Config)# end
Switch# show snmp                     //display the current configuration


Lets do a SNMPWALK to snmp configuration (SNMPv1 or SNMPv2). This was tested using ubuntu
First to install snmp
# apt install snmp

Then to run a snmpwalk
#snmpwalk -v 1 -c public 192.168.10.1 1.3.6.1.2.1.2

For more information on snmpwalk attributes refer the man page

For more information on SMP MIBs, refer the below guide.

Base OID for MIB-2 defined SNMP variables

Superior references

    1.3.6.1.2 - IETF Management
    1.3.6.1 - OID assignments from 1.3.6.1 - Internet
    1.3.6 - US Department of Defense
    1.3 - ISO Identified Organization
    1 - ISO assigned OIDs
    Top of OID tree

Subsidiary references (single level)

    1.3.6.1.2.1.1 - SNMP MIB-2 System
    1.3.6.1.2.1.2 - SNMP MIB-2 Interfaces
    1.3.6.1.2.1.3 - at
    1.3.6.1.2.1.4 - ip
    1.3.6.1.2.1.5 - icmp
    1.3.6.1.2.1.6 - tcp
    1.3.6.1.2.1.7 - udp
    1.3.6.1.2.1.8 - egp
    1.3.6.1.2.1.9 - cmot
    1.3.6.1.2.1.10 - transmission
    1.3.6.1.2.1.11 - snmp
    1.3.6.1.2.1.14 - OSPF Version 2 MIB
    1.3.6.1.2.1.15 - BGPv4
    1.3.6.1.2.1.16 - Managed Objects for Bridges
    1.3.6.1.2.1.17 - Bridge Mib
    1.3.6.1.2.1.22 - rptrHealth
    1.3.6.1.2.1.25 - HOST-RESOURCES-MIB, from RFC 1514
    1.3.6.1.2.1.26 - Ethernet MAU mib
    1.3.6.1.2.1.27 - Application MIB module
    1.3.6.1.2.1.28 - MTA MIB module
    1.3.6.1.2.1.29 - X.500 Directory MIB module
    1.3.6.1.2.1.31 - ifMib
    1.3.6.1.2.1.33 - upsMIB
    1.3.6.1.2.1.34 - snaNode
    1.3.6.1.2.1.38 - mdmMib
    1.3.6.1.2.1.41 - sdlcStatus
    1.3.6.1.2.1.43 - Printer-MIB
    1.3.6.1.2.1.47 - entity-mib
    1.3.6.1.2.1.69 - docsDev
    1.3.6.1.2.1.92 - notificationLogMIB

Read More

CISCO Switch Port Mirroring to Capture Traffic

Network traffic passing through ports can be analyzed by using Switched Port Analyzer (SPAN). This sends a copy of the traffic to another port on the switch that has been connected to a SwitchProbe device, another Remote Monitoring (RMON) probe or security device. SPAN mirrors receive or transmit (or both) traffic on one or more source ports to a destination port for analysis.

To display the details of available interfaces
Switch# show interface status

To display the details of configured vlans
Switch# show vlan

If the switch needs to be accessed over the network, IP address needs to be assigned.

Switch# enable
Switch# configure terminal
Switch(config)# interface vlan 1
Switch(config if)# ip address 192.168.10.1 255.255.255.0
Switch(config if)# no shutdown
Switch(config if)# exit
Switch(config)# exit
Switch#

This example shows how to set up a SPAN session (session 1) for monitoring source port traffic to a destination port.

Check for up and running interfaces of the Switch
Switch# show ip interface brief


Check if any already configured monitoring sessions are available
Switch# show monitor session 1

If any monitoring sessions are available. Need to remove them first. To remove that, switch to configuration mode.
Switch# configure terminal
Switch(config)# no monitor session 1

To configure monitoring sessions. Interface 1/1 to 1/5 is going to be monitored from the interface 1/15.

Switch(config)# monitor session 1 source interface fastEthernet 1/1 - 5
Switch(config)# monitor session 1 destination interface fastEthernet 1/15 encapsulation replicate
Switch(config)# exit

Further you can also configure to monitor traffic on a VLAN traffic. In order to monitor traffic for a particular vlan:

Switch(config)# monitor session 1 source vlan 1

Switch(config)# monitor session 1 destination interface fastEthernet 1/15 encapsulation replicate
Switch(config)# exit

Copy running config to startup config:
Switch# copy running-config startup-config


When a PC, which is running a network traffic capturing solution such as wireshark, connected to interface 1/15, network traffic can be captured.

Read More

Mounting / Unmounting encrypted external drive over command line in Ubuntu 18.04

If you have an encrypted external disk (or an internal disk that is not in fstab), you will see an entry for it in Nautilus. You can click on this volume, and am prompted for a password to decrypt and mount the device. However if you want mount and unmount the same over command line.

I follow the below steps to mount and unmount encrypted partitions.

You may require to install cryptsetup first.

sudo apt-get install cryptsetup

To decrypt the volume:

sudo cryptsetup luksOpen /dev/sda1 my_encrypted_volume

Now you can mount it as usual:

sudo mkdir /media/my_device
sudo mount /dev/mapper/my_encrypted_volume /media/my_device

To lock the container again, it needs to be unmounted first:

sudo umount /media/my_device
sudo cryptsetup luksClose my_encrypted_volume

To automatically put it in the /media location, use the udisks tool

sudo udisks --mount /dev/mapper/my_encrypted_volume

Read More