Redirecting a custom domain to a website hosted at AWS S3 with CloudFront

One of my friend was having a bit hard time in redircting a custom domain to website hosted hosted at AWS S3 with CloudFront. Then I was helping him with possible options and decided to write an article with my suggestions.

If you are new to webhosting with S3, you may refer the URLs given as references.

To stard with possible DNS records to be configured to direct your URL to web hosting server at the Domain Name service provider i.e. GoDaddy, 123-Reg

A Records:

A Records are the most basic type of DNS record and are used to point a domain or subdomain to an IP address. Assigning a value to an A record is as simple as providing your DNS management panel with an IP address to where the domain or subdomain should point and a TTL.

CNAME:

CNAME records can be used to alias one name to another. CNAME stands for Canonical Name. A common example is when you have both example.com and www.example.com pointing to the same application and hosted by the same server. In this case, to avoid maintaining two different records, it’s common to create:

    An A record for example.com pointing to the server IP address
    A CNAME record for www.example.com pointing to example.com

As a result, example.com points to the server IP address, and www.example.com points to the same address via example.com. Should the IP address change, you only need to update it in one place: just edit the A record for example.com, and www.example.com automatically inherits the changes.

What is CloudFront?

Amazon CloudFront is a web service that speeds up distribution of your static and dynamic web content, such as .html, .css, .js, and image files, to your users. CloudFront delivers your content through a worldwide network of data centers called edge locations. When a user requests content that you're serving with CloudFront, the user is routed to the edge location that provides the lowest latency (time delay), so that content is delivered with the best possible performance.

My friend had purchased a custom domain (Let's assume "www.example.com") from 123-Reg and he wanted to redirect www.example.com and example.com both to a website hosted at AWS S3. He had already configured CloudFront and let's assume his clourd front URL is as d4k69jpeqpexyz.cloudfront.net.

In CloudFront, an alternate domain name, also known as a CNAME, lets use the custom domain name (www.example.com) for links to files instead of using the domain name that CloudFront assigns to the distribution (d4k69jpeqpexyz.cloudfront.net

). Both web and RTMP distributions support alternate domain names.

When you use the CloudFront domain name for your files, the URL for a file called /images/image.jpg is:

http://d4k69jpeqpexyz.cloudfront.net/images/image.jpg

If you want to use your own domain name www.example.com, instead of the cloudfront.net domain name, you can add an alternate domain name to your distribution, like www.example.com. You can then use the following URL to view /images/image.jpg:

http://www.example.com/images/image.jpg

However you will not be able to configure alternative domain name as example.com. You can only configure it as www.example.com. Then you will face the same problem as my friend did.

Once the cloudfront configuration is ready, we need to configure the DNS record at DNS provider.  In our case 123-reg.

Using the DNS provider's tools, (123-reg in our case) we created a CNAME record to map www.example.com to d4k69jpeqpexyz.cloudfront.net

The CNAME is the only thing we needed if we wanted www.example.com. Unfortunately as most people do, we wanted "example.com" to work so we need another step.

example.com is often referred to as a naked domain or the apex record of the domain. The reason it's a problem is that it can't be a CNAME. CNAMEs only work on subdomains like "www." This makes it is difficult to point as a subdomain.

The remaining approach was to use a service to automatically redirect any request going to example.com to point to www.example.com. This picks up the CNAME record and the site will be served from CloudFront.

The automatic redirect is not possible with plain old DNS so we used another service. Some DNS providers offer this service along with their DNS (godaddy does, 123-reg does not.)

When the DNS provider doesn't do it, there are a few free services. One that We've used is http://wwwizer.com/naked-domain-redirect - it doesn't require any registration or payment.

To use this type of service, we need to create a DNS "A" record for the naked domain "example.com". For the wwwizer.com service, we needed to create an A record to point example.com to 174.129.25.170. That's all!

So, with this setup, if a user types example.com into their browser, the following would happen:

    DNS query: example.com -> 174.129.25.170 (wwwizer.com's service)
    HTTP request to 174.129.25.170 for example.com
    174.129.25.170 redirects example.com -> www.example.com
    DNS query: www.example.com -> CNAME to d4k69jpeqpexyz.cloudfront.net
    DNS query: d4k69jpeqpexyz.cloudfront.net -> points to Amazon S3
    HTTP request for www.example.com is now served by Amazon S3

Reference:
Web hosting with S3: https://medium.com/@kyle.galbraith/how-to-host-a-website-on-s3-without-getting-lost-in-the-sea-e2b82aa6cd38
Record Types: https://kb.pressable.com/article/dns-record-types-explained/
Configure DNS with GoDaddy: https://www.godaddy.com/garage/configuring-and-working-with-domains-dns/
CloudFront: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html
Configure CloudFront: https://medium.com/@kyle.galbraith/how-to-make-use-of-cloudfront-for-secure-delivery-of-static-websites-to-the-world-d2f54e8b096

Read More

Run SNMPWALK on CISCO Switch from Ubuntu Desktop

To check the SNMP agent status of the targeted switch. A remote connection or terminal session is required for the Switch to configure SNMP.

Switch# show snmp

When the SNMP agent is not enabled.

Switch# configure terminal
Switch (Config)# snmp-server enable traps
Switch (Config)# snmp-server community public ro    //ro - read-only
Switch (Config)# snmp-server community private rw    //rw - read-write
Switch (Config)# snmp-server location myoffice-location   
Switch (Config)# snmp-server contact myoffice-contact
Switch (Config)# end
Switch# show snmp                     //display the current configuration


Lets do a SNMPWALK to snmp configuration (SNMPv1 or SNMPv2). This was tested using ubuntu
First to install snmp
# apt install snmp

Then to run a snmpwalk
#snmpwalk -v 1 -c public 192.168.10.1 1.3.6.1.2.1.2

For more information on snmpwalk attributes refer the man page

For more information on SMP MIBs, refer the below guide.

Base OID for MIB-2 defined SNMP variables

Superior references

    1.3.6.1.2 - IETF Management
    1.3.6.1 - OID assignments from 1.3.6.1 - Internet
    1.3.6 - US Department of Defense
    1.3 - ISO Identified Organization
    1 - ISO assigned OIDs
    Top of OID tree

Subsidiary references (single level)

    1.3.6.1.2.1.1 - SNMP MIB-2 System
    1.3.6.1.2.1.2 - SNMP MIB-2 Interfaces
    1.3.6.1.2.1.3 - at
    1.3.6.1.2.1.4 - ip
    1.3.6.1.2.1.5 - icmp
    1.3.6.1.2.1.6 - tcp
    1.3.6.1.2.1.7 - udp
    1.3.6.1.2.1.8 - egp
    1.3.6.1.2.1.9 - cmot
    1.3.6.1.2.1.10 - transmission
    1.3.6.1.2.1.11 - snmp
    1.3.6.1.2.1.14 - OSPF Version 2 MIB
    1.3.6.1.2.1.15 - BGPv4
    1.3.6.1.2.1.16 - Managed Objects for Bridges
    1.3.6.1.2.1.17 - Bridge Mib
    1.3.6.1.2.1.22 - rptrHealth
    1.3.6.1.2.1.25 - HOST-RESOURCES-MIB, from RFC 1514
    1.3.6.1.2.1.26 - Ethernet MAU mib
    1.3.6.1.2.1.27 - Application MIB module
    1.3.6.1.2.1.28 - MTA MIB module
    1.3.6.1.2.1.29 - X.500 Directory MIB module
    1.3.6.1.2.1.31 - ifMib
    1.3.6.1.2.1.33 - upsMIB
    1.3.6.1.2.1.34 - snaNode
    1.3.6.1.2.1.38 - mdmMib
    1.3.6.1.2.1.41 - sdlcStatus
    1.3.6.1.2.1.43 - Printer-MIB
    1.3.6.1.2.1.47 - entity-mib
    1.3.6.1.2.1.69 - docsDev
    1.3.6.1.2.1.92 - notificationLogMIB

Read More

CISCO Switch Port Mirroring to Capture Traffic

Network traffic passing through ports can be analyzed by using Switched Port Analyzer (SPAN). This sends a copy of the traffic to another port on the switch that has been connected to a SwitchProbe device, another Remote Monitoring (RMON) probe or security device. SPAN mirrors receive or transmit (or both) traffic on one or more source ports to a destination port for analysis.

To display the details of available interfaces
Switch# show interface status

To display the details of configured vlans
Switch# show vlan

If the switch needs to be accessed over the network, IP address needs to be assigned.

Switch# enable
Switch# configure terminal
Switch(config)# interface vlan 1
Switch(config if)# ip address 192.168.10.1 255.255.255.0
Switch(config if)# no shutdown
Switch(config if)# exit
Switch(config)# exit
Switch#

This example shows how to set up a SPAN session (session 1) for monitoring source port traffic to a destination port.

Check for up and running interfaces of the Switch
Switch# show ip interface brief


Check if any already configured monitoring sessions are available
Switch# show monitor session 1

If any monitoring sessions are available. Need to remove them first. To remove that, switch to configuration mode.
Switch# configure terminal
Switch(config)# no monitor session 1

To configure monitoring sessions. Interface 1/1 to 1/5 is going to be monitored from the interface 1/15.

Switch(config)# monitor session 1 source interface fastEthernet 1/1 - 5
Switch(config)# monitor session 1 destination interface fastEthernet 1/15 encapsulation replicate
Switch(config)# exit

Further you can also configure to monitor traffic on a VLAN traffic. In order to monitor traffic for a particular vlan:

Switch(config)# monitor session 1 source vlan 1

Switch(config)# monitor session 1 destination interface fastEthernet 1/15 encapsulation replicate
Switch(config)# exit

Copy running config to startup config:
Switch# copy running-config startup-config


When a PC, which is running a network traffic capturing solution such as wireshark, connected to interface 1/15, network traffic can be captured.

Read More

Mounting / Unmounting encrypted external drive over command line in Ubuntu 18.04

If you have an encrypted external disk (or an internal disk that is not in fstab), you will see an entry for it in Nautilus. You can click on this volume, and am prompted for a password to decrypt and mount the device. However if you want mount and unmount the same over command line.

I follow the below steps to mount and unmount encrypted partitions.

You may require to install cryptsetup first.

sudo apt-get install cryptsetup

To decrypt the volume:

sudo cryptsetup luksOpen /dev/sda1 my_encrypted_volume

Now you can mount it as usual:

sudo mkdir /media/my_device
sudo mount /dev/mapper/my_encrypted_volume /media/my_device

To lock the container again, it needs to be unmounted first:

sudo umount /media/my_device
sudo cryptsetup luksClose my_encrypted_volume

To automatically put it in the /media location, use the udisks tool

sudo udisks --mount /dev/mapper/my_encrypted_volume

Read More

Phishing Attacks Dos and Don’ts for Employees

Phishing is a fake email, text or social media message with the intent of having you click on a link or open an attachment. By doing so, the criminals are hoping to get you to change your password so they can access your information, get into your computer to find your financial information, or infect your phone, tablet or smartphone with malicious software allowing them to see everything you do.

Dos

1. Do ask yourself if the email is from someone you know, or if the subject line is odd or suspect.
2. Do check email content for spelling and grammar mistakes if you feel the email is suspicious.
3. Do ask yourself if you were expecting a new document or zip file.
4. Do delete any suspicious emails from your inbox and then from your deleted folder.
5. Do verify the legitimacy of requests or sources. Look up the company contact information from which the email, text or call claims to be. Then call the company yourself to verify that the email or text is legitimate. If you suspect a credit card scam, hang up with the caller and dial the toll-free number on the back of your credit card to verify the call.
6. Do participate in up-to-date security training sessions within the com.
7. Do scan files, received as attachments, for viruses before opening them. "This can be accomplished by going to the downloads folder, right clicking on the file and then choosing 'scan for viruses'".
8. Do report phishing scams / any suspicious emails to information security department of your organization.

Don’ts

1. Don’t open suspicious emails claiming to be from Ceylinco Life, any other financial institution, from your friend or other trustworthy organization if you are not expecting them. Common phishing phrases include “verify your account,” “Dear Valued Customer,” “within the next 48 hours,” “click this link” and “open this attachment.”
2. Don’t click on a link from an email or open an attachment that you're unfamiliar with or even if it’s from someone you know. If you weren’t expecting grandma to send you an email containing your bank statements, for instance, ask her if she did send you something before opening it.
3. Don’t click on a link or attachments in suspicious emails with grammar and spelling mistakes. Phishing emails are known to contain spelling mistakes and bad grammar; threats; attachments with incorrect or suspicious filenames or extensions (e.g., .zip, .exe, .vbs, .bin, .com, .pif or .zzx); and links for unexpected e-cards, tracking for unknown packages, pictures or videos.
4. Don’t click — only hover your mouse over — links in suspicious emails to see the real web address. If it doesn’t match the link typed in the message where the email says it will take you, it could lead you to a malicious website or a malicious file as an attachment, which will spread malicious software on your computer. Even if the links match, it’s better not to click links in emails unless you’re absolutely certain it comes from a reliable source.
5. Don’t provide any personal information (i.e., login, account information, date of birth, social security number, etc.) via email, phone, text or social messages.
6. Don’t visit websites that contain pirated information. When browsing websites, don’t visit or download files from suspicious websites. If downloading a file, always download it from the vendor’s or author’s website. This will eliminate the chances of getting pirated software.

Clues to Identify Phishing Scams

There are clues that a message is an attack. Here are the most common ones:

1. A message asking you to click a link to view a statement (often a bank statement, for example).
2. A tremendous sense of urgency that demands “immediate action” before something bad happens, like threatening to close an account or send you to jail. The attacker wants to rush you into making a mistake. For example, your bank account has been frozen and you need to click the link immediately to rectify the situation.
3. Pressuring you to bypass or ignore your policies or procedures at work.
4. A text message with a link telling you your account has been compromised.
5. Your refund awaits or there's money waiting for you from a lottery or other source. The fraudster is asking you to visit a fraudulent website, click on an attachment or wire money to receive a cash prize (that never arrives).
6. A generic salutation like “Dear Customer.” Most companies or friends contacting you know your name.
7. Requesting highly sensitive information, such as your credit card number, password, or any other information that a legitimate sender should already know.
8. The message says it comes from an official organization, but has poor grammar or spelling or uses a personal email address like @gmail.com.
9. The message comes from an official email (such as your boss) but has a Reply-To address going to someone’s personal email account.
10. A funny joke from what seems like a friend or coworker that conceals a malicious link or attachment.
11. You receive a message from someone you know, but the tone or wording just does not sound like him or her.

Read More

Cybersecurity Dos and Don'ts Your Employees Should Follow

DO:Check Mark

1. Use care when entering passwords in front of others
2. Create and maintain strong passwords and change them every 60-90 days (We recommend a combination of lowercase & uppercase letters and special characters)
3. Change your password immediately if you suspect that it has been compromised
4. Report suspicious activity to the IT team/CSIRT to help minimize cyber risks
5. Protect personal computers and devices with anti-virus/anti-malware software when working remotely, and keep it current

DO NOT:

1. Allow others to use your login ID or password
2. Use the same password for every applicationX Mark
3. Store passwords on a piece of paper or other easily accessible document
4. Open email or attachments if the sender is unknown or suspicious
5. ​Get caught by phishing attempts, which can occur via email, phone, instant message, SMS or social media
6. Provide information such as login IDs, passwords, social security numbers, account numbers, etc. via unencrypted email
7. Leave your laptop or mobile device unattended while in a public place. Lost or stolen equipment, including mobile devices connected to corporate network, should be reported immediately
8. Keep open files containing personal or confidential information on your desks or in an unlocked file cabinet when away from your office/desk
9. Install unauthorized programs on your work (or home) computer
10. Plug in personal devices without permission from IT

Read More

How to Turn On Sandbox Feature in Windows Defender Antivirus

Sandboxing is a process that runs an application in a safe environment isolated from the rest of the operating system and applications on a computer. So that if a sandboxed application gets compromised, the technique prevents its damage from spreading outside the closed area.

Microsoft Windows built-in anti-malware tool, Windows Defender, has become the very first antivirus software to have the ability to run inside a sandbox environment.

Windows Defender running on Windows 10, version 1703 (also known as the Creators Update) or later, support the sandbox feature, which is not enabled by default, but you can turn the feature on by running following command on your system:

• Open Start and Search for "CMD" or "Command Prompt"
• Right Click on it and select "Run as administrator."
• Type: "setx /M MP_FORCE_USE_SANDBOX 1" and then press ENTER
• Then restart your computer, that’s it

Read More