Tech Stuff and Notes: IT-Networking

Showing posts with label IT-Networking. Show all posts

2016-08-09

CNAME vs MX DNS records: email service disabled

Did your email service stop working?

If you have a domain name (e.g. example.com) pointing to a web site, say a static web site at Amazon S3, or a blog at Blogger, etc., it might've been convenient to set up your domain's DNS records with a CNAME --- something like:

CNAME Record --- '@' --- mno3pqr4stu5.cloudfront.net

At least with NameCheap's Advanced DNS settings page, the '@' host name means a "naked domain" like "example.com". So your readers can type in "http://example.com" and it'll go to your web site --- very convenient and friendly.

The problem with that is email to user@example.com won't work.

Here's why and how to fix it.

3 Steps to Free SSL for your domain's static website on AWS S3

Today, let's talk about upgrading your static web site --- served from your own domain --- so that it serves over HTTPS secure protocol.

Prerequisites
This post assumes you've got certain things already set up. If you don't, the rest of this post won't help you, sorry.

(1) You must already have a static web site served from Amazon Web Services (AWS) S3.

But really, if all you've got is just a static web site (no dynamic content, no server side scripts, no database, etc.), using S3 is pretty awesome. It's fast, inexpensive, and pretty easy to set up --- a topic for another day perhaps.

(2) You must already have your own domain name set up for your web site, e.g. from Namecheap, and you're a little comfortable setting up custom "Advanced DNS" records like CNAME records, etc. Again, if you don't, the following won't help you, sorry.

NameCheap's been pretty fantastic for domain name and DNS services for me. Great service.

(3) You also must have email set up for your domain name. Maybe you've got email set up with that domain name from your domain name registry (e.g. Namecheap). Or maybe you've got it set up with a dedicated email hosting service, e.g. Fastmail.com, or Google Apps for Work.

Strategy
The general ideas are these:

Get a free SSL / TLS certificate for your domain name from AWS Certificate Manager (ACM)
Create an AWS Cloudfront Distribution to originate content from S3, to be served out on a Cloudfront address.
Change your domain name's DNS CNAME record to point to that Cloudfront address.

Is it Impossible to Secure Home WiFi?

So for an unsophisticated, or lazy, home network user wanting to have a wireless home network, is there a way to secure the home wifi network? It seems not.

You could use WPA-PSK security protocol with a long and random password, then it'll get hacked in 20 minutes for less than $2 in computing power.

You could put in a mac address filter, so that only those computers with a registered mac address can even get on the network to begin with. But it turns out mac addresses aren't just easy to modify, but they are communicated on the wireless unencrypted in the open, so it can be easily spoofed.

Another measure is to go with static IP addresses and a restricted IP pool, so there's less chance someone can get an IP address to your network while you're connected. But it turns out my wireless router is too cheap to let me set static IP addresses on the LAN. sigh

So am I supposed to install a RADIUS server now?

Instead, I turned down the wireless router's signal power, since I don't even go far from the router when I use the wireless. At least hackers will have to be physically closer, I guess.

And maybe I'll try to find another ethernet cable so I can just turn off the wireless entirely. A lot less headache than trying to secure an open channel.

2010-04-12

Internet security is dying painfully

Just now I saw a link on Hacker News with the following text (I'm linking it to the comments page for that link instead though):

This link says it's from YouTube but it's not (youtube.com)

Sure enough, Hacker News is reporting the host for the link is YouTube.com, and a quick glance at the URL shows it actually is (see bold):

http://www.youtube.com/redirect?username=digitalhook&q=http%3A%2F%2Fsecuritytube.net%2FSocial-Engineering-Attacks-using-Simple-Redirections-video.aspx&video_id=Vgc3NVVpb8c&event=url_redirect&url_redirect=True&usg=UE0DOmwjBRK-mgheFtW1hMTEvh4=

But look a little further and notice it says "redirect", and a little further along you see where it's redirecting (see the red above). In more malicious case, of course those could be further obfuscated so a cursory look by an intelligent human wouldn't see the redirection.

The sad part is, as noted by commenter Charles Randall, "I've taught people how to scan for valid links, and now they can't even trust that."

That's exactly right. The cost of maintaining security by the end-user, as paid by every individual end-user, is growing with little to no value created for any single one of them. The time spent checking the URL's host to ensure clicking it is safe becomes less effective with this kind of redirection: it's all cost and no gain, most of the time.

This comes right after I read Internet Security is a failure, which argues that these four facets of internet security has been a failure: "1. Identity and Authentication / 2. Transport Security / 3. Secure Software and Operating Systems / 4. Law Enforcement".

This reminds me of the article: Are users right in rejecting security advice?, and the paper from Microsoft the article links to as well: So Long, and No Thanks for the Externalities: The Rational Rejection of Security Advice by Users (pdf). Both are great readings, and it certainly makes sense to look at security as an economic question.

Anyway, internet security is in a sad state of affairs.

2010-03-10

The parts to a domain name in web addresses: Quick intro

Having never registered a domain name before, I had set out to learn how and what's involved. Sure I used domain names a lot in that I go to many web pages by typing in an address, but I have never looked fully into the mechanics behind domain names.

Here I'll explain what I learned, mainly the generalities behind what domain names are and how they work. I was dismayed by some recent news on how confusing domain names can be, so it may be helpful for you to understand how they work too.

Let's start!

Each web page you see on the world wide web is located somewhere, and so has an address. This web address is called its URL or URI (the specifics are rather technical). You should see this blog post's URL in your web browser above as:

http://blog.carsoncheng.ca/2010/03/parts-to-domain-name-in-web-addresses.html

There are a number of parts to this address that are separated by the slashes (ie, the forward slashes).

The http part tells the computer to use the Hypertext Transfer Protocol when accessing the page you want. There are other protocols too, but normally most everything uses http. If you are on a log-in page somewhere though, especially when you do online banking, the protocol should be https (note the "s"), as in the Hypertext Transfer Protocol Secure.

The :// ("colon slash slash") then tells where the rest of the address begins.

Domain Name Registrars for Canadians

This will be kind of a mind-dump of a post, more like logging my strategies for my own future reference.

I want my own domain name for my blog here, which is hosted by Google's Blogger service. I've never tried registering for a domain name before, so here's my attempt at finding a decent registrar.

Looking for reviews
I found some reviews of various domain registrars:

That then turned up these two Registrars I found interesting:

I also found out that .ca domain names are all managed by the CIRA:
http://ro.cira.ca

Checking up BBB
And I also started checking out BBB for Registrars:

Go Daddy has "nice" ads but I've heard lots of horror stories about them too, but of course with any big company there'll be those amongst the many more good stories that no one hears. BBB says they're good but there's lots of complaints regardless. Tough to say what value BBB records really have though.

I tried another tactic, i.e. to find bad things about Netfirms. For instance, I dig up WordPress hosting woes. So it might suck for WordPress hosting due to server issues. Nothing about domain name registration though that I could see.

This is my first real attempt at finding a domain registrar, and I'm realizing that I'm just trying to optimize along too many dimensions, so I asked a friend for a recommendation.

Asking for a friendly recommendation
My friend reminds me that if I need web hosting service in addition to needing DNS service, then Dotster or Network Solutions can be worth the extra money. Otherwise, Domainsatcost, Dotster, or Go Daddy, would all work.

All I need is DNS service, not web hosting. Specifically for Blogger custom domain services, I need to be able to set custom CNAMES and A NAMES records for my domain name. (See http://www.google.com/support/blogger/bin/answer.py?hl=en&answer=55373)

I also went back to looking up BBB on these companies that were suggested to me:

So the word of mouth suggestion from someone I'd tend to place more confidence on is for one company that has a F score on BBB, and one with seemingly quite expensive plans that has an A score on BBB. Both are actually quite expensive compared to, say Go Daddy though.

Decisions, decisions...

What do big sites do?
I try another tactic. I checked out some major sites (several major universities, news papers, etc.) thru whois (http://whois.cira.ca/) to see where they register through. Many come up using Webnames.ca. I check it out and it's expensive! So if you don't mind the cost, I guess it must be pretty good if many major institutions use it (or maybe they cater to major clients with other services?).

Decisions

After looking at all the available data, I'm going with GoDaddy. It's inexpensive enough, and offers enough features, and apparently is good at resolving complaints.

Tech Stuff and Notes