Attending AWSome day online conference 2019

  04/08/2019       Nitin J Mutkawoa      Add Comment

The AWSome day was a free online Conference and a training event sponsor by Intel that will provide a step-by-step introduction to the core AWS (Amazon Web Services) services. Its free and everyone can attend. It was scheduled on 26 March 2019 online. The agenda covered broad topics such as AWS Cloud Concepts, AWS Core Services, AWS Security, AWS Architecting and AWS Pricing and Support. It’s pretty interesting for IT manager, system engineers, system administrators, and architects who are eager to learn more about cloud computing and how to get started on the AWS cloud. I do have some experience in managing AWS servers and even host my own server. However, I registered for the free training to refresh my knowledge and get more exposure such as the AWS pricing which I am not aware at all. Another interesting thing is that you will receive a certificate of attendance and you received 25 USD of AWS credits. Pretty cool right?

Attending AWSome day online conference 2019 1

Right from the beginning, I knew this was something interesting. I encountered a minor problem whilst signing in. I had to send a mail to support and it was resolved immediately. Once connected to the lobby, it was pretty easy to attend and follow the online conference. After some minutes, Steven Bryen, head in the AWS Cloud delivered the keynote speech.

Attending AWSome day online conference 2019 2

There was also an online challenge and I score 25,821 on the Trivia Leaderboard.

Attending AWSome day online conference 2019 3

On the “Ask an Expert” tab, I was mostly interested in Man on the Side Attack – MOTS attack. They referred me to the WAF section on AWS. Another interesting link is the whitepaper of the AWS Overview of Security guidelines. AWS also offers comprehensive security across all the layers, SSL, DDoS, Firewall, HSM and Networking. I also shoot some question on Metric and Monitoring on application level such as on MariaDB. I discovered about the RDS performance insight. For applications on EC2, Containers, and Lamda, X-Ray looks very promising. Apart from virtualization, its good to note that AWS also provides containerization services.

The event was pretty enriching. The panel on the question area knows well their subject. I discovered a lot by participating in the AWSomeDay. I’m looking forward to AWS certifications in the near future.


   Linux Application, Linux System, MeetUps and Presentations, Security, Virtualisation      , , , ,

Building Docker images and publishing ports

  04/07/2019       Nitin J Mutkawoa      Add Comment

One of the most challenging tasks in a production environment with Docker is to build images and publish ports. As promised in the previous article I will publish more articles on Docker images. So, here we are! For those who missed the previous articles on Docker, firstly we have the basic installation of Docker and some basic commands and secondly, we have an article dedicated about 30 basic commands to start with Docker container. Note that all illustrations and commands in this blog post have been tested on Fedora.

Building Docker images and publishing ports 4

Building Docker images

What is a Docker image? Firstly, we need to understand what is an image. It is a compressed self-piece of software. Once unwrapped, it becomes meaningful to use because it’s all about the functionality that makes the image useful. An image could contain software, operating system, a service, etc.. On the other hand, the Docker image is created by a series or sequence of commands written to a file called “Dockerfile”.  Whenever you execute the Dockerfile using Docker command, it will output an image, thus, a Docker image. In this blog post, we are going to build a Docker image using existing Docker image.

1. As described in the article “30 basic commands to start with Docker container” in part 3, to view the current images available you can use the following command:

docker images

2. In my case, I have a Centos image. My goal is to make a Docker image which has Apache web server already pre-installed. Now, there are two methods to create an image from the existing one. The first is the commit method with the Docker commit command which is not extensively used due to less flexibility. The other is by creating a Docker file. In my home directory, I created a directory at /home/webserver. Now, this directory will be used to build up the web server. You can also create an index.html file to be used as the index page of the web server. Use the following basic commands:

mkdir /home/webserver && touch /home/webserver/{index.html,Dockerfile}

3. I then edited the index.html. Let’s enter some random phrase in it for testing purpose.

This is a test by TheTunnelix

4. Edit the Dockerfile and define the Dockerfile as indicated below. From the comment section, I gave some explanations for each line:

FROM centos:latest # Take the latest image.
LABEL tunnelix.com <[email protected]> # Just a reference using my E-mail.
RUN yum install httpd -y # Run the command to install HTTPD.
COPY index.html /var/www/html # Copy from webserver folder to the docroot.
CMD ["/usr/sbin/httpd", "-D", "FOREGROUND"] # Always launch the binary to start the daemon HTTPD.
EXPOSE 80 # Run Apache on port 80. This port need to be exposed to run the HTTPD webserver.

5. Now, point yourself in the directory where your Dockerfile and index.html is located. We will build the image using the Dockerfile using docker build command.

docker build -t centos:apache .

6. You can check it using the command docker images and you should notice that a new image has been created which has been tagged with apache. You also view details all steps using the following command:

docker images -a

7.  To run it, you can use:

docker run -dit --name=ApacheTunnelix centos:apache

At this stage, a docker ps will show you the container running. Remember from the article “30 commands to start with Docker container” in part 24, we learned that Docker will create a bridge. You can check it using docker network ls. You can also confirm it using the command brctl show command.

8. When launching the command docker inspect in the section containers, I can notice my container is accessible with the IPAddress 172.17.0.2 and same is accessible on my browser with the same content of the index.html file created in section 3. You can also check it using the following curl command:

curl http://172.17.0.2

Publishing the port

9. The point is that the container ApacheTunnelix with IPAddress 172.17.0.2 is not available outside the physical host onto which I am running my Docker engine. The catch is that we need to go through a step called publishing ports.

10. I will now create another web server to better differentiate between the container (ApacheTunnelix) accessible locally and that another container (Let’s call it ApacheTunnelixProd) which need to be accessible on the same network of the Physical machine. I copied the directory /home/webserver to /home/webserverprod and pointed myself inside the directory webserverprod.

cp -rp /home/webserver /home/webserverprod && cd /home/webserverprod

11. For my own reference, I change the index.html to:

This is a test by TheTunnelix on Prod.

12. Repeat step 5 by building a new image with a new name:

docker build -t centos:apacheProd

13. Compare to step 7 where we have run the container without publishing the port, this time we will run it by publishing the port from outside the physical machine. By default, the container will run on port 80. To make it accessible, say on port 5000, we use the following command:

docker run -dit --name=ApacheTunnelixProd -p 5000:80 centos:apacheProd

14. By now the container should be accessible on any IP on the network of the local machine including localhost. In my case, the IP address of my physical machine is 192.168.100.9. You can test it using the command:

curl http://192.168.100.9:5000

Or you can simply access your machine from a browser:

Building Docker images and publishing ports 5

15. A docker ps is of great importance to understand as same will show you from the source and destination of the port mapping. Another interesting command to understand the port mapping is the docker port. For example:

docker port ApacheTunnelixProd

This will show the following result:

80/tcp -> 0.0.0.0:5000

In the next article on Docker, I will share some more interesting tips on Docker Networking. keep in touch and comment below for suggestions and improvements.

Tips:

  • EXPOSE allows anyone outside the container to access the web server on the port 80. If you do not expose it, the web server will not be accessible outside the container.
  • CMD allows you to run a command as soon as the container is launched. CMD is different from RUN. RUN is used whilst building the image and CMD is used whilst launching the image.
  • Always check the official Docker documentation when creating Dockerfile.
  • You always stop a running container using the command docker stop <name of the container>. For example, docker stop ApacheTunnelixProd.
  • Also, you can remove a container with the command docker rm <name of the container>. For example, docker rm ApacheTunnelixProd.

Updates:

As explained by Arnaud Bonnet, one should be careful when using distributions such as Centos, Debian etc which can be vulnerable. So auditing is important prior before deploying on Production. A look into Alpine and BusyBox can be very useful.

Also, the MAINTAINER has been deprecated and now used by LABEL. Arnaud gave some examples such as:

LABEL com.example.version=”0.0.1-beta”
LABEL vendor=”ACME Incorporated”
LABEL com.example.release-date=”2015-02-12″
LABEL com.example.version.is-production=”


   Linux Application      , , ,

IETF 104 Hackathon remotely from Mauritius

  04/01/2019       Nitin J Mutkawoa      Add Comment

When it comes to innovation in code contribution in the latest RFC’s and IETF drafts at the IETF hackathon, the cyberstorm.mu team is always here as a team hacking for the improvement of the Internet. For the IETF 104 hackathon which happened in Hilton, Prague, Czech Republic, we had pushed ourselves towards innovation: Joining more working groups at the same time championing other working groups. For those who are not aware of the IETF Hackathon, its a team collaborative event working towards the same goal: Securing the Internet and leveling up Open Source software in the world. The IETF 104 hackathon was a special one. Cyberstorm.mu contributed to the following working groups: TLS 1.3,  SSH,  HTTP 451, DSCP, Mobile APP, IPv6 & QUIC with more than 15 members remotely and 1(Muzaffar) onsite who was selected as an IETF fellow. We also had three newcomers for the IETF 104 hackathon and proud new members of cyberstorm.mu. Congratulations to Muzaffar Auhammud for making it onsite to Prague, Czech Republic representing cyberstorm.mu after being selected as an IETF Fellow. As a pioneer in Africa, cyberstorm.mu was also present in remote viewing hubs in Africa. Loganaden Velvindron, co-founder of cyberstorm.mu and Infrastructure and Security engineer at Afrinic demonstrated with great talent the implication of Africans in the IETF hackathon. I am proud of those leading the Viewing hub in the big Africa continent. This is where management and leadership skills play a great role here.

IETF 104 Hackathon remotely from Mauritius 6

Day-0: It was a pretty tiring day with the assembly of the network and preparation of logistics as well as planning of the event. Food, medical kits, water, mosquitoes repellant, etc.. We also had to keep in touch with the weather information as there was a cyclone nearby. All precautions and planning were done. Once on the location of the hackathon which is at Mauritius Villa at Pointe aux Piments in the north west of Mauritius, the guys were almost ready. We ensure the new-comers feel at ease and integrating the group easily. As usual, an introduction to IETF was explained as well as the online video shown. We made the most to ensure professionalism and a good standard.

Prev 1 of 1 Next
    Prev 1 of 1 Next

    Day-1: It was a pretty intense day but at the same time addictive and fun. The team was already in the mood and ready to hack. Slaying the RC4 monster was one of my tasks and also had to lead Jagveer Loky, Network Engineer at Orange Business Services who was also participating in the SSH working group. The other part of the team which includes, Jeremie Daniel, a student at University of Mauritius Rahul Golam and Avi Soomirthee Linux system administrator at Linkbynet Indian Ocean who focussed a lot on TLS 1.3. On the other side, Bruno Bernard, Full stack developer was constantly improving and testing the IETF mobile App. We also had Veegish Ramdani and Yashveer Jadoo (First comer at the IETF hackathon remotely with the cyberstorm.mu team), Students at the University of Mauritius were hacking into DSCP LE. And finally, one the youngest newcomer, Rahul Kumar Shivadan, 15 years old student at St-Esprit college made it to DSCP and hacked into NetPerf. We also had Codarren Velvindron who was working remotely on TLS 1.3. Other cyberstorm.mu members were also here supporting us and helping remotely. When it comes to Internet connectivity, we thanks Mauritius Telecom who sponsored our Internet connectivity up to 100 Mbit/s for the IETF Hackathon.

    Day-2: As usual, newcomers of cyberstorm.mu team are given their @cyberstorm.mu email address and all necessary procedures carried out. At cyberstorm.mu team, we lay emphasis on running code and a collaborating team. To focus on the goal is sometimes hard and in the beginning, it looks difficult to achieve, but with perseverance and motivation, we had been able to reach our goals. The testing part which includes the understanding of the IETF drafts, a pre-check methodology of the running code, testing and implementation prior before any modification carried out is considered to be the basic baseline before getting into it. Once this part has been grasped, it now comes to logic and mathematics. This is where helping each other in the team is important. And finally, code deployment, unit code testing and other incremental testing methodologies to make the code running and ready for use. On day-2, I still remembered Jagveer’s laptop encountered a crash which looks like an incompatible driver. The time factor was important, we decided to format everything and restart from scratch. At the cyberstorm.mu hackathon, it does not mean only hacking into codes, but also a moment of sharing and doing a round table, interviews, pool interviews and a moment where newcomers gave their feedback. We jumped into the pool, chill a little bit, whilst the others are enjoying a LAN gaming as well as eating nice food.

    IETF 104 Hackathon remotely from Mauritius 7
    Pizza on progress at the IETF hackathon

    Day-3: It was such a rush, We made sure everyone has their patch commit and it was time to pack up and leave. Whilst others left, It was only me and Logan, Jeremie and Bruno who stayed till a little bit late. Whilst Jeremie was still preparing for his assignments, myself and Logan was preparing for our live presentation remotely at the IETF 104 hackathon. On the other hand, Bruno streamed the event live too on Facebook which was a pretty nice idea. 

     

    What newcomers said about the IETF 104 hackathon:

    “I was very lucky to get an invitation to participate at the IETF 104 hackathon to learn more about networking and work in collaboration in a team of two on Lower Effort Per-Domain Behavior.” – Yashveer Jadoo

    “I had no idea how to deal with networking by setting packets priority and then without any hesitation, I asked cyberstorm.mu team for help and everyone tried their best to help me.” – Rahul Kumar Shivadan

    “These past few days the experience is great, the food is great, and everything is getting better ! With Laugh and codes, I’ve been working on the IETF Application championed by Chris Marrow and Warren Kumari on IETF 104 track.” – Bruno Bernard


       MeetUps and Presentations      , ,

    30 basic commands to start with Docker Container

      03/19/2019       Nitin J Mutkawoa      Add Comment

    It’s been a long time, I did not blog anything about Docker. In the article Installing, Updating and Playing around with a Docker container that dated back to the year 2016, I showed some basics on Docker installation and some basic commands to start with. Time to dive a little bit deeper into the basics of Docker. For installation on Fedora Operating system, please see the official installation of Docker on the Docker webpage. All commands and illustrations on this blog post have been tested on Fedora. Once Docker installed, there are various interesting commands you can adventure around.

    30 basic commands to start with Docker Container 8

    Starting up with Docker containerization

    1. Searching for CentOS image with the most stars:

    docker search --filter=stars=100 centos

    2. You can also pull an image:

    docker pull centos

    3. To view the images, simply do this:

    docker images

    4. You can also run the container/images

    docker run  -it --name=centostunnelix centos /bin/bash

    5. When you run containers and even after exiting, you cannot re-run it again, because that container name, in my case centostunnelix, was used previously. Note that the container has been stopped and not removed! You will find it stopped using the following command:

    docker ps -a

    6. You can now start the container back:

    docker start centostunnelix

    7. And after starting it, you can simply stop the container:

    docker stop centostunnelix

    8. You can also gracefully remove it:

    docker rm centostunnelix

    9. Also renamed it to another instance, for example, centosprod in this case:

    docker rename centostunnelix centosprod

    10. A Docker in exited mode means that the changes you made are still there. However, it is still not running. You can now run it either by connecting directly to it or simply run it in the background and attach to it whilst it is running.

    docker start centosprod
    docker attach centosprod

    Warming up with Docker…

    11. Moreover, if you need to detach from the container without stopping it, you simply need to do the following two key combination one after each other. It is a good practice to check it using docker ps -a though:

    Ctrl+p and Ctrl+q

    12. But this keys combination can be painful and as a good practice after starting a Docker container, use the following command to get into the container and by typing Ctrl+d or exit to keep your container still up and running:

    docker exec -it centosprod /bin/bash 

    13. To get the last container that you have run using the following command:

    docker ps -l

    14. To see all the commands that have been executed inside a container with its timestamp, use the following command:

    docker logs centosprod -t

    15. You can also pause and unpause containers which are actually freezing and unfreezing it using the following commands:

    docker pause centosprod
    docker unpause centosprod

    16. Imagine you want to run a container, but as soon as you exit from the container, it should get destroyed immediately. For that to be done, you need to start the container with the following command:

    docker run --rm --it centosprod /bin/bash

    Docker Hub

    17. The Docker Hub is a library and community for Docker container images. You can access it at hub.docker.com and created an account to it. Then, from your Terminal, use the following command to log in to the Docker Hub.

    docker login

    18. As explained in part 3, to see the list of images created, you can use docker images. Note that image ID is the same. However, to push an image to your repository, firstly, you need to give a tag to the image using the following command:

    docker image tag centos thetunnelix/centostunnelix

    19. By now, if you launch again the command docker images, you will see the same images under a new name tag. To upload it to your repository using the following command:

    docker image push thetunnelix/centostunnelix

    20. You can also delete an image locally using the following command:

    docker image rm -f centostunnelix

    21. To retrieve back your image use the following command:

    docker pull thetunnelix/centostunnelix

    Let’s dive into Networking

    22. Once into the Docker container, the command ipconfig is not present. I have installed the package net-tools using the command yum install net-tools -y. After installing the package, after firing an ipconfig, you would notice that the network card has been assigned with an IP address. On your physical machine, launch the following command to see your connection names, UUID, Type and Devices. You will see a connection name docker0 as a bridge:

    nmcli connection show

    23. To see how many virtual connected devices to docker0, you can use the following command:

    brctl show docker0

    24. Since Docker, create a virtual bridge on the machine, you can also see it using the following command:

    docker network ls

    25. To get more details about the network configuration of each container use the following:

    docker network inspect bridge

    26. So, we have seen by default docker create a bridge and all containers are assigned IP from that bridge only. However, we can also create another bridge and also specifying the gateway as well as the subnet which is pretty interesting:

    docker network create tunnel0 --subnet 10.0.0.0/24 --gateway 10.0.0.1

    27. Once you have created a new network bridge, you can use again the command docker network ls and docker network inspect bridge to confirm if the bridge has been created. Now, to start a container in the subnet 10.0.0.0/24, simply use the following command that was used in step 4 but this time with the argument –net <name of virtual bridge>:

    docker run -it --net tunnel0 --name=centosprodnew centos /bin/bash

    28. In step 27, we have seen how to create a container for a particular network. Imagine that you want to attach the same container to “bridge” that has been created by default. You would notice it using the command docker network ls. To connect it to “bridge”, use the following command.

    docker network connect bridge centosprodnew

    29. To disconnect it from “bridge”, simply do the following:

    docker network disconnect bridge centosprodnew

    30. To get logs at host level launch the following command:

    journalctl -u docker.service

    Tips:

    • You can run directly an image, for example, docker run fedora even if you did not pull it. Docker will automatically pull it and run it for you.
    • Every time you run a container with a different container name, it will assign a unique ID to it under the directory /var/lib/docker/containers. For every container, you have a unique ID and docker ps -aq will show you the containers.
    • When a name is not specified when starting a Docker container, Docker will assign names to it; it could be a really funny name.
    • Imagine that you are exiting from a container and you want the container to be removed automatically.
    • Always remember, whenever you start a Docker container, a unique ID will be allocated to the container and a filesystem will be allocated and mounts as Read/Write for the container. It will also allocate a Network/Bridge interface following an IP assignment and finally the process execution by the user.
    • By default, all Docker containers will be assigned an IP address range from docker0.
    • You can also create a container by using the argument –hostname and by default docker will append the /etc/hosts file with the IP and hostname of the container.
    • Virtual network binds to the bridge which creates a virtual subnet shared between the host and every virtual container. It’s basically a NAT rule that allows containers to talk to the internet but not the other way around. This concept is similar to the option of NAT in Virtual Box.
    • In step 28, “bridge” is the name of the virtual bridge that has been created by default in Docker.

    If you liked these Docker basics and have any question please comment below. In future articles, I will focus on building Docker images and publish ports, Docker Swarm, Kubernetes with Docker, Metrics, and Monitoring of Docker containers etc.


        Linux Application      , , , , 
    30 basic Powershell commands to start with Windows Server
       03/04/2019       Nitin J Mutkawoa      2 Comments 
    Getting started with Windows 2019 nano server can be very challenging especially if you are not used to CLI on Linux servers. I decided to install Windows 2019 server core only i.e; without GUI and take it as a challenge to learn more about it. Since I’m mostly from a Unix/Linux background, I decided to dive a little bit more in the Windows Operating system. In this article, I’m sharing some commands to start with. However, the Microsoft website covers enough part which will lead to the Windows 2016 MCSE certification. My goal in this article is to get PowerShell beginners on track and paint an idea of what Windows Powershell is capable of.
    30 basic Powershell commands to start with Windows Server 9
    Windows Updates
    1. Some modules are not available by default on the PowerShell. So you will need to manually download it. I downloaded the module PSWindowsUpdate which will enable me to update the OS from PowerShell.
    Get-Module PSWindowsUpdate
    2. One of the first things you might want to do is to get the updates that need to be installed on  the Operating System first which I did with the following command:
    Get-WindowsUpdate
    3. Now you can install the updates using the following command. Once installed, reboot the server which might take some time.
    Install-WindowsUpdate
    4. You can also find the list of updates installed on the machine using the following command:
    Get-Hotfix
    OS basic verification
    5. To get the version of the PowerShell, use the following command:
    • Get-host | select Version
    • $PSVersionTable
    6. To get the reboot history :
    Get-EventLog system | where-object {$_.eventid -eq 6006} | select -last 10
    7. List of services running:
    Get-Service
    8. List of Installed programs:
    Get-Module PSWindowsUpdate

    Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table –AutoSize
    9. Get the process running on Windows
    Get-process
    Networking
    10. Finding the rules on the firewall:
    Get-NetFirewallRule
    11. IP configuration:
    Get-NetIPConfiguration
    12. To verify if IPv4 or IPv6 is enabled or not
    Get-NetAdapterLso
    13. To get the routing table
    Get-NetRoute
    14. Source and remote IPs on listening mode
    Get-NetTCPConnection | ? {$_.State -eq "Listen"}
    Storage
    15. Get the disk space information
    Get-WmiObject win32_logicaldisk
    Get-PhysicalDisk
    16. To get the health status of the disk:
    Get-PhysicalDisk | Sort Size | FT FriendlyName, Size, MediaType, SpindleSpeed, HealthStatus, OperationalStatus -AutoSize
    17. Getting the used/free space:
    Get-PSDrive C | Select-Object Used, Free
    PowerShell Modules and repository
    18. The PowerShell Gallery is the central repository for PowerShell content. You can find new PowerShell commands or Desired State Configuration (DSC) resources in the Gallery. To check which repository you are using use the following :
    get-PSRepository

    19. By default, PowerShell modules are installed in several directories. You can download certain modules in any directory you want. To execute it, you need to append the environment. To see the module paths of your environment, launch the following command:
    $Env:PSModulePath
    20. To add a path to the environment’s module path, use the following command:
    $env:PSModulePath = $env:PSModulePath + ";C:\ModulePath"
    21. To get a list of installed modules and the directories in which it has been installed:
    Get-Module -ListAvailable
    22. To install a module, you can search for it and install it directly:
    find-module -Name PendingReboot | install-module 
    23. After installing a module, it is always a good practice to import it using the following:
    Import-Module PendingReboot
    24. To get information which command to use for a pending reboot use:
    Get-Command -Module PendingReboot
    Downloads and unzip
    25. Recently, I saw a link where having a script on Technet. You can use the following command to download the zip file.
    Invoke-WebRequest https://gallery.technet.microsoft.com/scriptcenter/Get-RebootHistory-bc804819/file/130620/2/Get-RebootHistory.zip -outfile Get-RebootHistory.zip
    26. To unzip a file:
    Expand-Archive -path '.\Get-RebootHistory.zip' -DestinationPath 'C:\Users\Administrator\Documents\WindowsPowerShell\Modules'
    Getting Help
    27. Getting help with commands arguments are pretty easy. Let’s say you want to know the possible arguments of the command Get-Command, simply do:
    Get-Command -?
    28.  You can also use the Get-Help module. For example, consider the Compress-Archive module:
    Get-Help -name Compress-Archive
    29. Consider that you need an example of a specific module:
    Get-Help -name Compress-Archive -examples
    30. The help/man command is also interesting to get fast syntax about a command.
    man Compress-Archive
    help Compress-Archive
    One interesting source of information is gallery.technet.microsoft.com/scriptcenter where you can access several scripts for Microsoft Windows Server Administration. Personally, Windows PowerShell commands seem to be more complexed compared to Linux commands. Probably, its a matter of getting used to it. I will try my best to update this article. Don’t forget to comment below if needed. My last article on Windows was on the installation of SSH on Windows server through Powershell.
     
        Windows      , ,